Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
OqAVRCkQ3T.exe

Overview

General Information

Sample name:OqAVRCkQ3T.exe
renamed because original name is a hash value
Original sample name:649ec4858e572e0145e35a9faa712708949b7bb1bce1594154cda580d80a0ca9.exe
Analysis ID:1524835
MD5:6d6a207d5513fa5ac6ead647f5d66a6a
SHA1:913e0d1aadbc1593b76f6442bb89070bc4a5e224
SHA256:649ec4858e572e0145e35a9faa712708949b7bb1bce1594154cda580d80a0ca9
Tags:AciraConsultingIncexeuser-JAMESWT_MHT
Infos:

Detection

Score:44
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Yara detected UAC Bypass using CMSTP
.NET source code contains very large strings
Found direct / indirect Syscall (likely to bypass EDR)
Modifies the DNS server
NDIS Filter Driver detected (likely used to intercept and sniff network traffic)
Queries sensitive system registry key value via command line tool
Reads the Security eventlog
Reads the System eventlog
Suspicious powershell command line found
Switches to a custom stack to bypass stack traces
Uses cmd line tools excessively to alter registry or file data
Adds / modifies Windows certificates
Allocates memory with a write watch (potentially for evading sandboxes)
Binary contains a suspicious time stamp
Checks if the current process is being debugged
Contains functionality to call native functions
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Contains functionality to communicate with device drivers
Contains functionality to delete services
Contains functionality to dynamically determine API calls
Contains functionality to execute programs as a different user
Contains functionality to open a port and listen for incoming connection (possibly a backdoor)
Contains functionality to query CPU information (cpuid)
Contains functionality to query locales information (e.g. system language)
Contains functionality to read device registry values (via SetupAPI)
Contains functionality to read the PEB
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Contains long sleeps (>= 3 min)
Creates a process in suspended mode (likely to inject code)
Creates a start menu entry (Start Menu\Programs\Startup)
Creates driver files
Creates files inside the driver directory
Creates files inside the system directory
Creates or modifies windows services
Deletes files inside the Windows folder
Detected potential crypto function
Drops PE files
Drops PE files to the windows directory (C:\Windows)
Drops certificate files (DER)
Enables debug privileges
Enables driver privileges
Enables security privileges
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Found dropped PE file which has not been started or loaded
Found large amount of non-executed APIs
Found potential string decryption / allocating functions
Installs a raw input device (often for capturing keystrokes)
May sleep (evasive loops) to hinder dynamic analysis
Modifies existing windows services
Monitors certain registry keys / values for changes (often done to protect autostart functionality)
OS version to string mapping found (often used in BOTs)
One or more processes crash
PE file contains executable resources (Code or Archives)
PE file contains sections with non-standard names
Queries device information via Setup API
Queries disk information (often used to detect virtual machines)
Queries information about the installed CPU (vendor, model number etc)
Queries sensitive Operating System Information (via WMI, Win32_ComputerSystem, often done to detect virtual machines)
Queries the installation date of Windows
Queries the product ID of Windows
Queries the volume information (name, serial number etc) of a device
Sample execution stops while process was sleeping (likely an evasion)
Sample file is different than original file name gathered from version info
Sigma detected: Startup Folder File Write
Sigma detected: Suspicious Copy From or To System Directory
Sigma detected: Tap Installer Execution
Stores files to the Windows start menu directory
Stores large binary data to the registry
Uses 32bit PE files
Uses code obfuscation techniques (call, push, ret)
Uses reg.exe to modify the Windows registry
Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

  • System is w10x64
  • OqAVRCkQ3T.exe (PID: 5912 cmdline: "C:\Users\user\Desktop\OqAVRCkQ3T.exe" MD5: 6D6A207D5513FA5AC6EAD647F5D66A6A)
    • OqAVRCkQ3T.tmp (PID: 4828 cmdline: "C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmp" /SL5="$203F6,29832184,735744,C:\Users\user\Desktop\OqAVRCkQ3T.exe" MD5: 259E3EE4646FC251C3513EEF2683479F)
      • ComDebug.exe (PID: 5956 cmdline: "C:\Program Files\FastestVPN\Resources\ComDebug.exe" MD5: F892887D8532D19F74884CDC48B1AC8B)
        • more.com (PID: 4068 cmdline: C:\Windows\SysWOW64\more.com MD5: 03805AE7E8CBC07840108F5C80CF4973)
          • conhost.exe (PID: 2220 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
      • cmd.exe (PID: 5720 cmdline: "C:\Windows\system32\cmd.exe" /C ""C:\Program Files\FastestVPN\Resources\driver\install_tap.bat"" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)
        • conhost.exe (PID: 2992 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
        • reg.exe (PID: 7160 cmdline: reg Query "HKLM\Hardware\Description\System\CentralProcessor\0" MD5: 227F63E1D9008B36BDBCC4B397780BE4)
        • find.exe (PID: 3560 cmdline: find /i "x86" MD5: 4BF76A28D31FC73AA9FC970B22D056AF)
        • cmd.exe (PID: 2720 cmdline: C:\Windows\system32\cmd.exe /c ver MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)
        • tapinstall.exe (PID: 6628 cmdline: tapinstall.exe remove tap0901 MD5: E313336C82EB265542664CC7A360C5FF)
        • tapinstall.exe (PID: 6192 cmdline: tapinstall.exe install OemVista.inf tap0901 MD5: E313336C82EB265542664CC7A360C5FF)
      • cmd.exe (PID: 6852 cmdline: "C:\Windows\system32\cmd.exe" /C ""C:\Program Files\FastestVPN\Resources\sp\install_sp.bat"" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)
        • conhost.exe (PID: 6912 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
        • sc.exe (PID: 6924 cmdline: sc stop fastestvpndriver MD5: 3FB5CF71F7E7EB49790CB0E663434D80)
          • conhost.exe (PID: 5920 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
        • reg.exe (PID: 2688 cmdline: reg Query "HKLM\Hardware\Description\System\CentralProcessor\0" MD5: 227F63E1D9008B36BDBCC4B397780BE4)
        • find.exe (PID: 6896 cmdline: find /i "x86" MD5: 4BF76A28D31FC73AA9FC970B22D056AF)
        • reg.exe (PID: 5200 cmdline: reg QUERY "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion" MD5: 227F63E1D9008B36BDBCC4B397780BE4)
        • find.exe (PID: 3476 cmdline: find /i "Windows 7" MD5: 4BF76A28D31FC73AA9FC970B22D056AF)
        • xcopy.exe (PID: 4132 cmdline: xcopy /y driver\windows8\amd64\fastestvpndriver.sys C:\Windows\system32\drivers MD5: 39FBFD3AF58238C6F9D4D408C9251FF5)
        • nfregdrv.exe (PID: 6468 cmdline: release\nfregdrv.exe -u fastestvpndriver MD5: 9333F583E2D32A47276DCEC7C2391FD2)
        • nfregdrv.exe (PID: 6360 cmdline: release\nfregdrv.exe fastestvpndriver MD5: 9333F583E2D32A47276DCEC7C2391FD2)
      • sc.exe (PID: 2884 cmdline: "C:\Windows\system32\sc.exe" stop FastestVPNService MD5: 3FB5CF71F7E7EB49790CB0E663434D80)
        • conhost.exe (PID: 1456 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
      • FastestVPN.WindowsService.exe (PID: 2540 cmdline: "C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe" --uninstall MD5: 22D4E4267DFE093E5E23C2F3D7741AA4)
        • WerFault.exe (PID: 6272 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 2540 -s 1076 MD5: C31336C1EFC2CCB44B4326EA793040F2)
      • sc.exe (PID: 1616 cmdline: "C:\Windows\system32\sc.exe" delete FastestVPNService MD5: 3FB5CF71F7E7EB49790CB0E663434D80)
        • conhost.exe (PID: 1656 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
      • FastestVPN.WindowsService.exe (PID: 6776 cmdline: "C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe" --install MD5: 22D4E4267DFE093E5E23C2F3D7741AA4)
      • subinacl.exe (PID: 7080 cmdline: "C:\Program Files\FastestVPN\subinacl.exe" /service FastestVPNService /GRANT=everyone=TO MD5: 4798226EE22C513302EE57D3AA94398B)
        • conhost.exe (PID: 2884 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
      • sc.exe (PID: 1284 cmdline: "C:\Windows\system32\sc.exe" start FastestVPNService MD5: 3FB5CF71F7E7EB49790CB0E663434D80)
        • conhost.exe (PID: 2096 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
      • FastestVPN.exe (PID: 2616 cmdline: "C:\Program Files\FastestVPN\FastestVPN.exe" MD5: 01CF6EF766C41BB2C99A2CCCDECC69C1)
  • svchost.exe (PID: 6916 cmdline: C:\Windows\system32\svchost.exe -k DcomLaunch -p -s DeviceInstall MD5: B7F884C1B74A263F746EE12A5F7C9F6A)
    • drvinst.exe (PID: 1464 cmdline: DrvInst.exe "4" "0" "C:\Users\user\AppData\Local\Temp\{4cb0eb0d-a103-7c4c-aedf-5caef9610c0c}\oemvista.inf" "9" "4d14a44ff" "0000000000000154" "WinSta0\Default" "0000000000000168" "208" "c:\program files\fastestvpn\resources\driver\windows10\amd64" MD5: 294990C88B9D1FE0A54A1FA8BF4324D9)
    • drvinst.exe (PID: 1916 cmdline: DrvInst.exe "2" "211" "ROOT\NET\0000" "C:\Windows\INF\oem4.inf" "oem4.inf:3beb73aff103cc24:tap0901.ndi:9.24.2.601:tap0901," "4d14a44ff" "0000000000000154" MD5: 294990C88B9D1FE0A54A1FA8BF4324D9)
  • svchost.exe (PID: 5940 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s NetSetupSvc MD5: B7F884C1B74A263F746EE12A5F7C9F6A)
  • FastestVPN.exe (PID: 3192 cmdline: "C:\Program Files\FastestVPN\FastestVPN.exe" -autorun MD5: 01CF6EF766C41BB2C99A2CCCDECC69C1)
    • powershell.exe (PID: 424 cmdline: "powershell" -windowstyle hidden get-wmiobject Win32_ComputerSystemProduct | Select-Object -ExpandProperty UUID MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)
      • conhost.exe (PID: 3780 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
  • svchost.exe (PID: 6032 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)
  • svchost.exe (PID: 6348 cmdline: C:\Windows\System32\svchost.exe -k WerSvcGroup MD5: B7F884C1B74A263F746EE12A5F7C9F6A)
    • WerFault.exe (PID: 1664 cmdline: C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 2540 -ip 2540 MD5: C31336C1EFC2CCB44B4326EA793040F2)
  • FastestVPN.WindowsService.exe (PID: 3632 cmdline: "C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe" MD5: 22D4E4267DFE093E5E23C2F3D7741AA4)
  • cleanup

Malware Configuration

⊘No configs have been found

Yara Signatures

Memory Dumps

SourceRuleDescriptionAuthorStrings
00000002.00000003.3069897606.0000000005580000.00000004.00001000.00020000.00000000.sdmpJoeSecurity_UACBypassusingCMSTPYara detected UAC Bypass using CMSTPJoe Security
    Process Memory Space: OqAVRCkQ3T.tmp PID: 4828JoeSecurity_UACBypassusingCMSTPYara detected UAC Bypass using CMSTPJoe Security

      Sigma Signatures

      System Summary

      barindex
      Sigma detected: Startup Folder File Write
      Source: File createdAuthor: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research): Data: EventID: 11, Image: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmp, ProcessId: 4828, TargetFilename: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\FastestVPN.lnk
      Sigma detected: Suspicious Copy From or To System Directory
      Source: Process startedAuthor: Florian Roth (Nextron Systems), Markus Neis, Tim Shelton (HAWK.IO), Nasreddine Bencherchali (Nextron Systems): Data: Command: xcopy /y driver\windows8\amd64\fastestvpndriver.sys C:\Windows\system32\drivers, CommandLine: xcopy /y driver\windows8\amd64\fastestvpndriver.sys C:\Windows\system32\drivers, CommandLine|base64offset|contains: ), Image: C:\Windows\System32\xcopy.exe, NewProcessName: C:\Windows\System32\xcopy.exe, OriginalFileName: C:\Windows\System32\xcopy.exe, ParentCommandLine: "C:\Windows\system32\cmd.exe" /C ""C:\Program Files\FastestVPN\Resources\sp\install_sp.bat"", ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 6852, ParentProcessName: cmd.exe, ProcessCommandLine: xcopy /y driver\windows8\amd64\fastestvpndriver.sys C:\Windows\system32\drivers, ProcessId: 4132, ProcessName: xcopy.exe
      Sigma detected: Tap Installer Execution
      Source: Process startedAuthor: Daniil Yugoslavskiy, Ian Davis, oscd.community: Data: Command: tapinstall.exe remove tap0901, CommandLine: tapinstall.exe remove tap0901, CommandLine|base64offset|contains: , Image: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exe, NewProcessName: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exe, OriginalFileName: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exe, ParentCommandLine: "C:\Windows\system32\cmd.exe" /C ""C:\Program Files\FastestVPN\Resources\driver\install_tap.bat"", ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 5720, ParentProcessName: cmd.exe, ProcessCommandLine: tapinstall.exe remove tap0901, ProcessId: 6628, ProcessName: tapinstall.exe
      Sigma detected: Non Interactive PowerShell Process Spawned
      Source: Process startedAuthor: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: "powershell" -windowstyle hidden get-wmiobject Win32_ComputerSystemProduct | Select-Object -ExpandProperty UUID, CommandLine: "powershell" -windowstyle hidden get-wmiobject Win32_ComputerSystemProduct | Select-Object -ExpandProperty UUID, CommandLine|base64offset|contains: v,)^, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Program Files\FastestVPN\FastestVPN.exe" -autorun, ParentImage: C:\Program Files\FastestVPN\FastestVPN.exe, ParentProcessId: 3192, ParentProcessName: FastestVPN.exe, ProcessCommandLine: "powershell" -windowstyle hidden get-wmiobject Win32_ComputerSystemProduct | Select-Object -ExpandProperty UUID, ProcessId: 424, ProcessName: powershell.exe
      Sigma detected: Windows Processes Suspicious Parent Directory
      Source: Process startedAuthor: vburov: Data: Command: C:\Windows\system32\svchost.exe -k DcomLaunch -p -s DeviceInstall, CommandLine: C:\Windows\system32\svchost.exe -k DcomLaunch -p -s DeviceInstall, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 632, ProcessCommandLine: C:\Windows\system32\svchost.exe -k DcomLaunch -p -s DeviceInstall, ProcessId: 6916, ProcessName: svchost.exe

      Suricata Signatures

      ⊘No Suricata rule has matched

      Joe Sandbox Signatures

      Click to jump to signature section

      Show All Signature Results

      Exploits

      barindex
      Yara detected UAC Bypass using CMSTP
      Source: Yara matchFile source: 00000002.00000003.3069897606.0000000005580000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
      Source: Yara matchFile source: Process Memory Space: OqAVRCkQ3T.tmp PID: 4828, type: MEMORYSTR
      Source: OqAVRCkQ3T.exeStatic PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpWindow detected: License AgreementPlease read the following important information before continuing.Please read the following License Agreement. You must accept the terms of this agreement before continuing with the installation.Terms of ServiceThis is an agreement between you and FastestVPN.com for virtual private network communications services related services and features. It is NOT a service for the commission of criminal acts. It is an anonymity and privacy service. You agree not to violate any laws of any jurisdiction you are originating from or terminating into.You agree to protect your user id/password and our system from unauthorized use. You are responsible for all actions that occur on our servers where the login uses your user id/password.You agree not to use the system for sending spam port scanning scanning for open proxies or open relays sending opt-in email unsolicited email or any type or version of email sent in large quantities even if the email is ultimately sent off of another server. You agree not to launch any pop-ups from our service. You agree not to attack in any way shape or form any other computer or network while on our service.Actual service coverage speeds locations and quality may vary. The Service will attempt to be available at all times except for limited periods for maintenance and repair. However the Service may be subject to unavailability for a variety of factors beyond our control including emergencies third party service failures transmission equipment or network problems or limitations interference signal strength and may be interrupted refused limited or curtailed. We are not responsible for data messages or pages lost not delivered delayed or misdirected because of interruptions or performance issues with the Service or communications services or networks (e.g. T-1 lines or the Internet). We may impose usage or Service limits suspend Service or block certain kinds of usage in our sole discretion to protect users or the Service. Network speed is an estimate and is no indication of the speed at which your or the Service sends or receives data. Actual network speed will vary based on configuration compression network congestion and other factors. The accuracy and timeliness of data received is not guaranteed; delays or omissions may occur.We do not log any user activity (sites visited DNS lookups emails etc.) We only log access attempts to our servers (for security and troubleshooting). We do not get involved in any form of censorship. We do not give your personal info to any third parties. We do not cooperate with any requests for information unless we are ordered by a court of competent jurisdiction and the vast majority of these requests would not be from a court of competent jurisdiction. We will protect you to the max and our system is setup to automatically do so. There are hundreds of good reasons for being anonymous and we respect them fully.Hacking cracking distribution of viruses fraudulent activities network sa
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpWindow detected: License AgreementPlease read the following important information before continuing.Please read the following License Agreement. You must accept the terms of this agreement before continuing with the installation.Terms of ServiceThis is an agreement between you and FastestVPN.com for virtual private network communications services related services and features. It is NOT a service for the commission of criminal acts. It is an anonymity and privacy service. You agree not to violate any laws of any jurisdiction you are originating from or terminating into.You agree to protect your user id/password and our system from unauthorized use. You are responsible for all actions that occur on our servers where the login uses your user id/password.You agree not to use the system for sending spam port scanning scanning for open proxies or open relays sending opt-in email unsolicited email or any type or version of email sent in large quantities even if the email is ultimately sent off of another server. You agree not to launch any pop-ups from our service. You agree not to attack in any way shape or form any other computer or network while on our service.Actual service coverage speeds locations and quality may vary. The Service will attempt to be available at all times except for limited periods for maintenance and repair. However the Service may be subject to unavailability for a variety of factors beyond our control including emergencies third party service failures transmission equipment or network problems or limitations interference signal strength and may be interrupted refused limited or curtailed. We are not responsible for data messages or pages lost not delivered delayed or misdirected because of interruptions or performance issues with the Service or communications services or networks (e.g. T-1 lines or the Internet). We may impose usage or Service limits suspend Service or block certain kinds of usage in our sole discretion to protect users or the Service. Network speed is an estimate and is no indication of the speed at which your or the Service sends or receives data. Actual network speed will vary based on configuration compression network congestion and other factors. The accuracy and timeliness of data received is not guaranteed; delays or omissions may occur.We do not log any user activity (sites visited DNS lookups emails etc.) We only log access attempts to our servers (for security and troubleshooting). We do not get involved in any form of censorship. We do not give your personal info to any third parties. We do not cooperate with any requests for information unless we are ordered by a court of competent jurisdiction and the vast majority of these requests would not be from a court of competent jurisdiction. We will protect you to the max and our system is setup to automatically do so. There are hundreds of good reasons for being anonymous and we respect them fully.Hacking cracking distribution of viruses fraudulent activities network sa
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpWindow detected: License AgreementPlease read the following important information before continuing.Please read the following License Agreement. You must accept the terms of this agreement before continuing with the installation.Terms of ServiceThis is an agreement between you and FastestVPN.com for virtual private network communications services related services and features. It is NOT a service for the commission of criminal acts. It is an anonymity and privacy service. You agree not to violate any laws of any jurisdiction you are originating from or terminating into.You agree to protect your user id/password and our system from unauthorized use. You are responsible for all actions that occur on our servers where the login uses your user id/password.You agree not to use the system for sending spam port scanning scanning for open proxies or open relays sending opt-in email unsolicited email or any type or version of email sent in large quantities even if the email is ultimately sent off of another server. You agree not to launch any pop-ups from our service. You agree not to attack in any way shape or form any other computer or network while on our service.Actual service coverage speeds locations and quality may vary. The Service will attempt to be available at all times except for limited periods for maintenance and repair. However the Service may be subject to unavailability for a variety of factors beyond our control including emergencies third party service failures transmission equipment or network problems or limitations interference signal strength and may be interrupted refused limited or curtailed. We are not responsible for data messages or pages lost not delivered delayed or misdirected because of interruptions or performance issues with the Service or communications services or networks (e.g. T-1 lines or the Internet). We may impose usage or Service limits suspend Service or block certain kinds of usage in our sole discretion to protect users or the Service. Network speed is an estimate and is no indication of the speed at which your or the Service sends or receives data. Actual network speed will vary based on configuration compression network congestion and other factors. The accuracy and timeliness of data received is not guaranteed; delays or omissions may occur.We do not log any user activity (sites visited DNS lookups emails etc.) We only log access attempts to our servers (for security and troubleshooting). We do not get involved in any form of censorship. We do not give your personal info to any third parties. We do not cooperate with any requests for information unless we are ordered by a court of competent jurisdiction and the vast majority of these requests would not be from a court of competent jurisdiction. We will protect you to the max and our system is setup to automatically do so. There are hundreds of good reasons for being anonymous and we respect them fully.Hacking cracking distribution of viruses fraudulent activities network sa
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpDirectory created: C:\Program Files\FastestVPNJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpDirectory created: C:\Program Files\FastestVPN\unins000.datJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpDirectory created: C:\Program Files\FastestVPN\is-RRCOJ.tmpJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpDirectory created: C:\Program Files\FastestVPN\is-ALQ73.tmpJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpDirectory created: C:\Program Files\FastestVPN\is-U1J8U.tmpJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpDirectory created: C:\Program Files\FastestVPN\is-G45GB.tmpJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpDirectory created: C:\Program Files\FastestVPN\is-NTHCN.tmpJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpDirectory created: C:\Program Files\FastestVPN\is-TQ8EO.tmpJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpDirectory created: C:\Program Files\FastestVPN\is-9RDU4.tmpJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpDirectory created: C:\Program Files\FastestVPN\is-Q6C5B.tmpJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpDirectory created: C:\Program Files\FastestVPN\is-HOPCL.tmpJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpDirectory created: C:\Program Files\FastestVPN\is-IAI1H.tmpJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpDirectory created: C:\Program Files\FastestVPN\is-L85R1.tmpJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpDirectory created: C:\Program Files\FastestVPN\is-2DBGR.tmpJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpDirectory created: C:\Program Files\FastestVPN\is-PQTD6.tmpJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpDirectory created: C:\Program Files\FastestVPN\is-JOA76.tmpJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpDirectory created: C:\Program Files\FastestVPN\is-GVJ6C.tmpJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpDirectory created: C:\Program Files\FastestVPN\is-7EKKK.tmpJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpDirectory created: C:\Program Files\FastestVPN\is-O9AN2.tmpJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpDirectory created: C:\Program Files\FastestVPN\is-CVBBG.tmpJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpDirectory created: C:\Program Files\FastestVPN\is-LGHQU.tmpJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpDirectory created: C:\Program Files\FastestVPN\is-67AMD.tmpJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpDirectory created: C:\Program Files\FastestVPN\is-2J970.tmpJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpDirectory created: C:\Program Files\FastestVPN\is-Q0KU7.tmpJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpDirectory created: C:\Program Files\FastestVPN\is-Q7N7F.tmpJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpDirectory created: C:\Program Files\FastestVPN\is-3TGVV.tmpJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpDirectory created: C:\Program Files\FastestVPN\is-RP1DP.tmpJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpDirectory created: C:\Program Files\FastestVPN\is-F69J1.tmpJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpDirectory created: C:\Program Files\FastestVPN\is-N38EL.tmpJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpDirectory created: C:\Program Files\FastestVPN\is-C2OV1.tmpJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpDirectory created: C:\Program Files\FastestVPN\is-OO2G4.tmpJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpDirectory created: C:\Program Files\FastestVPN\is-L0D1P.tmpJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpDirectory created: C:\Program Files\FastestVPN\is-E3G7B.tmpJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpDirectory created: C:\Program Files\FastestVPN\is-M7G5C.tmpJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpDirectory created: C:\Program Files\FastestVPN\is-AC86P.tmpJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpDirectory created: C:\Program Files\FastestVPN\is-0B265.tmpJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpDirectory created: C:\Program Files\FastestVPN\is-28KS7.tmpJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpDirectory created: C:\Program Files\FastestVPN\is-EFE8N.tmpJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpDirectory created: C:\Program Files\FastestVPN\is-MM0UH.tmpJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpDirectory created: C:\Program Files\FastestVPN\is-MD8VT.tmpJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpDirectory created: C:\Program Files\FastestVPN\is-9DEC1.tmpJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpDirectory created: C:\Program Files\FastestVPN\is-4N32R.tmpJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpDirectory created: C:\Program Files\FastestVPN\is-ILJO4.tmpJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpDirectory created: C:\Program Files\FastestVPN\is-K0SIQ.tmpJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpDirectory created: C:\Program Files\FastestVPN\is-EES9I.tmpJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpDirectory created: C:\Program Files\FastestVPN\is-DQ4HF.tmpJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpDirectory created: C:\Program Files\FastestVPN\is-MB689.tmpJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpDirectory created: C:\Program Files\FastestVPN\is-NJH6K.tmpJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpDirectory created: C:\Program Files\FastestVPN\is-1GRRH.tmpJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpDirectory created: C:\Program Files\FastestVPN\is-AASMC.tmpJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpDirectory created: C:\Program Files\FastestVPN\ResourcesJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpDirectory created: C:\Program Files\FastestVPN\Resources\is-CC2NP.tmpJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpDirectory created: C:\Program Files\FastestVPN\Resources\is-LGI72.tmpJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpDirectory created: C:\Program Files\FastestVPN\Resources\is-RFTSN.tmpJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpDirectory created: C:\Program Files\FastestVPN\Resources\is-EANN9.tmpJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpDirectory created: C:\Program Files\FastestVPN\Resources\is-6SU3B.tmpJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpDirectory created: C:\Program Files\FastestVPN\Resources\is-6403S.tmpJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpDirectory created: C:\Program Files\FastestVPN\Resources\is-2FSRR.tmpJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpDirectory created: C:\Program Files\FastestVPN\Resources\is-DJHTV.tmpJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpDirectory created: C:\Program Files\FastestVPN\Resources\is-B0TRN.tmpJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpDirectory created: C:\Program Files\FastestVPN\Resources\is-56EGR.tmpJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpDirectory created: C:\Program Files\FastestVPN\Resources\is-4NIRM.tmpJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpDirectory created: C:\Program Files\FastestVPN\Resources\is-O25O5.tmpJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpDirectory created: C:\Program Files\FastestVPN\Resources\is-CDU5N.tmpJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpDirectory created: C:\Program Files\FastestVPN\Resources\is-2225N.tmpJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpDirectory created: C:\Program Files\FastestVPN\Resources\is-79FJ0.tmpJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpDirectory created: C:\Program Files\FastestVPN\Resources\is-PHPNK.tmpJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpDirectory created: C:\Program Files\FastestVPN\Resources\is-QLNQ0.tmpJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpDirectory created: C:\Program Files\FastestVPN\Resources\is-80EU7.tmpJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpDirectory created: C:\Program Files\FastestVPN\Resources\is-E9ECF.tmpJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpDirectory created: C:\Program Files\FastestVPN\Resources\is-OOEI3.tmpJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpDirectory created: C:\Program Files\FastestVPN\Resources\is-9K65C.tmpJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpDirectory created: C:\Program Files\FastestVPN\Resources\is-EHLQ3.tmpJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpDirectory created: C:\Program Files\FastestVPN\Resources\dataJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpDirectory created: C:\Program Files\FastestVPN\Resources\data\is-BVC6U.tmpJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpDirectory created: C:\Program Files\FastestVPN\Resources\data\is-OKD1B.tmpJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpDirectory created: C:\Program Files\FastestVPN\Resources\data\is-6ID8J.tmpJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpDirectory created: C:\Program Files\FastestVPN\Resources\data\is-8S2T4.tmpJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpDirectory created: C:\Program Files\FastestVPN\Resources\driverJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpDirectory created: C:\Program Files\FastestVPN\Resources\driver\is-C6TL3.tmpJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpDirectory created: C:\Program Files\FastestVPN\Resources\driver\is-7QK33.tmpJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpDirectory created: C:\Program Files\FastestVPN\Resources\driver\windowsJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpDirectory created: C:\Program Files\FastestVPN\Resources\driver\windows\amd64Jump to behavior
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpDirectory created: C:\Program Files\FastestVPN\Resources\driver\windows\amd64\is-JEVOC.tmpJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpDirectory created: C:\Program Files\FastestVPN\Resources\driver\windows\amd64\is-K5BF2.tmpJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpDirectory created: C:\Program Files\FastestVPN\Resources\driver\windows\amd64\is-PS4TM.tmpJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpDirectory created: C:\Program Files\FastestVPN\Resources\driver\windows\amd64\is-HM6P4.tmpJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpDirectory created: C:\Program Files\FastestVPN\Resources\driver\windows\amd64\is-9R4TG.tmpJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpDirectory created: C:\Program Files\FastestVPN\Resources\driver\windows\amd64\is-C4BRK.tmpJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpDirectory created: C:\Program Files\FastestVPN\Resources\driver\windows\i386Jump to behavior
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpDirectory created: C:\Program Files\FastestVPN\Resources\driver\windows\i386\is-3L7RG.tmpJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpDirectory created: C:\Program Files\FastestVPN\Resources\driver\windows\i386\is-C8Q95.tmpJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpDirectory created: C:\Program Files\FastestVPN\Resources\driver\windows\i386\is-ESUKM.tmpJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpDirectory created: C:\Program Files\FastestVPN\Resources\driver\windows\i386\is-LC5II.tmpJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpDirectory created: C:\Program Files\FastestVPN\Resources\driver\windows\i386\is-DP5T8.tmpJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpDirectory created: C:\Program Files\FastestVPN\Resources\driver\windows\i386\is-6S3SU.tmpJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpDirectory created: C:\Program Files\FastestVPN\Resources\driver\windows10Jump to behavior
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpDirectory created: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64Jump to behavior
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpDirectory created: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\is-A6FEM.tmpJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpDirectory created: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\is-KVT7L.tmpJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpDirectory created: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\is-63E5N.tmpJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpDirectory created: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\is-4K729.tmpJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpDirectory created: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\is-OI0G9.tmpJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpDirectory created: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\is-KVOIK.tmpJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpDirectory created: C:\Program Files\FastestVPN\Resources\driver\windows10\i386Jump to behavior
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpDirectory created: C:\Program Files\FastestVPN\Resources\driver\windows10\i386\is-O4LBK.tmpJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpDirectory created: C:\Program Files\FastestVPN\Resources\driver\windows10\i386\is-MJ3AR.tmpJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpDirectory created: C:\Program Files\FastestVPN\Resources\driver\windows10\i386\is-SJ7I7.tmpJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpDirectory created: C:\Program Files\FastestVPN\Resources\driver\windows10\i386\is-SUSF8.tmpJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpDirectory created: C:\Program Files\FastestVPN\Resources\driver\windows10\i386\is-6GBPO.tmpJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpDirectory created: C:\Program Files\FastestVPN\Resources\driver\windows10\i386\is-GT2CF.tmpJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpDirectory created: C:\Program Files\FastestVPN\Resources\spJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpDirectory created: C:\Program Files\FastestVPN\Resources\sp\is-MDD17.tmpJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpDirectory created: C:\Program Files\FastestVPN\Resources\sp\is-EIAT9.tmpJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpDirectory created: C:\Program Files\FastestVPN\Resources\sp\driverJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpDirectory created: C:\Program Files\FastestVPN\Resources\sp\driver\windows7Jump to behavior
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpDirectory created: C:\Program Files\FastestVPN\Resources\sp\driver\windows7\amd64Jump to behavior
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpDirectory created: C:\Program Files\FastestVPN\Resources\sp\driver\windows7\amd64\is-N7JEQ.tmpJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpDirectory created: C:\Program Files\FastestVPN\Resources\sp\driver\windows7\i386Jump to behavior
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpDirectory created: C:\Program Files\FastestVPN\Resources\sp\driver\windows7\i386\is-UE60Q.tmpJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpDirectory created: C:\Program Files\FastestVPN\Resources\sp\driver\windows8Jump to behavior
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpDirectory created: C:\Program Files\FastestVPN\Resources\sp\driver\windows8\amd64Jump to behavior
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpDirectory created: C:\Program Files\FastestVPN\Resources\sp\driver\windows8\amd64\is-JUHU2.tmpJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpDirectory created: C:\Program Files\FastestVPN\Resources\sp\driver\windows8\i386Jump to behavior
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpDirectory created: C:\Program Files\FastestVPN\Resources\sp\driver\windows8\i386\is-T910E.tmpJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpDirectory created: C:\Program Files\FastestVPN\Resources\sp\releaseJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpDirectory created: C:\Program Files\FastestVPN\Resources\sp\release\is-8GLTJ.tmpJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpDirectory created: C:\Program Files\FastestVPN\Resources\sp\release\is-UGM5N.tmpJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpDirectory created: C:\Program Files\FastestVPN\ServiceJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpDirectory created: C:\Program Files\FastestVPN\Service\is-JFLTF.tmpJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpDirectory created: C:\Program Files\FastestVPN\Service\is-0SL0F.tmpJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpDirectory created: C:\Program Files\FastestVPN\Service\is-BBQCR.tmpJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpDirectory created: C:\Program Files\FastestVPN\Service\is-04ESR.tmpJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpDirectory created: C:\Program Files\FastestVPN\Service\is-PPT86.tmpJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpDirectory created: C:\Program Files\FastestVPN\Service\is-ABK95.tmpJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpDirectory created: C:\Program Files\FastestVPN\Service\is-9KRN8.tmpJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpDirectory created: C:\Program Files\FastestVPN\Service\is-M7EC0.tmpJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpDirectory created: C:\Program Files\FastestVPN\Service\is-5GMR0.tmpJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpDirectory created: C:\Program Files\FastestVPN\Service\is-AC1A8.tmpJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpDirectory created: C:\Program Files\FastestVPN\Service\is-51UBL.tmpJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpDirectory created: C:\Program Files\FastestVPN\Service\is-8F2SU.tmpJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpDirectory created: C:\Program Files\FastestVPN\Service\is-H126L.tmpJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpDirectory created: C:\Program Files\FastestVPN\Service\is-17HNF.tmpJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpDirectory created: C:\Program Files\FastestVPN\Service\is-4F6CO.tmpJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpDirectory created: C:\Program Files\FastestVPN\Service\is-C2OTC.tmpJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpDirectory created: C:\Program Files\FastestVPN\Service\is-SLLFS.tmpJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpDirectory created: C:\Program Files\FastestVPN\Service\is-NGC8I.tmpJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpDirectory created: C:\Program Files\FastestVPN\Service\is-D7DH9.tmpJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpDirectory created: C:\Program Files\FastestVPN\Service\is-O78V3.tmpJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpDirectory created: C:\Program Files\FastestVPN\Service\is-2G3FE.tmpJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpDirectory created: C:\Program Files\FastestVPN\Service\is-6V6PA.tmpJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpDirectory created: C:\Program Files\FastestVPN\Service\is-DPP41.tmpJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpDirectory created: C:\Program Files\FastestVPN\is-HB5NQ.tmpJump to behavior
      Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeDirectory created: C:\Program Files\FastestVPN\Service\InstallUtil.InstallLog
      Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeDirectory created: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.InstallLog
      Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeDirectory created: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.InstallState
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpRegistry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\FastestVPN_is1Jump to behavior
      Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeFile created: C:\Program Files\FastestVPN\Service\InstallUtil.InstallLog
      Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeFile created: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.InstallLog
      Source: OqAVRCkQ3T.exeStatic PE information: certificate valid
      Source: OqAVRCkQ3T.exeStatic PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
      Source: Binary string: System.Configuration.Install.pdb source: FastestVPN.WindowsService.exe, 00000027.00000002.3018526379.00000000026E6000.00000004.00000800.00020000.00000000.sdmp
      Source: Binary string: D:\a\SQLitePCL.raw\SQLitePCL.raw\SQLitePCL.raw\src\SQLitePCLRaw.core\obj\Release\netstandard2.0\SQLitePCLRaw.core.pdb source: FastestVPN.exe, FastestVPN.exe, 00000016.00000002.4016598487.0000000000D43000.00000004.00000020.00020000.00000000.sdmp, FastestVPN.exe, 00000016.00000002.4100015977.000000000BD42000.00000002.00000001.01000000.00000031.sdmp
      Source: Binary string: C:\Users\samuli\source\repos\tap-windows6\devcon\x64\Release\devcon.pdb source: tapinstall.exe, 0000000C.00000000.2573049272.00007FF6EC504000.00000002.00000001.01000000.00000009.sdmp, tapinstall.exe, 0000000C.00000002.2574132408.00007FF6EC504000.00000002.00000001.01000000.00000009.sdmp, tapinstall.exe, 0000000D.00000002.2641262515.00007FF6EC504000.00000002.00000001.01000000.00000009.sdmp, tapinstall.exe, 0000000D.00000000.2574430578.00007FF6EC504000.00000002.00000001.01000000.00000009.sdmp
      Source: Binary string: mTC:\Windows\FastestVPN.WindowsService.pdb source: FastestVPN.WindowsService.exe, 00000027.00000002.3016279133.00000000008F9000.00000004.00000010.00020000.00000000.sdmp
      Source: Binary string: C:\BuildAgent\work\da2c3d9512902c54\Tooling\obj\Release\System.Web.Cors\System.Web.Cors.pdb source: FastestVPN.WindowsService.exe, FastestVPN.WindowsService.exe, 00000032.00000002.4028919891.00000000042A2000.00000002.00000001.01000000.00000040.sdmp
      Source: Binary string: D:\Sagar Work FastestVPN\FastestVPN-Windows-App\FastestVPN.WindowsService\obj\Release\FastestVPN.WindowsService.pdbe\FastestVPN.WindowsServic source: FastestVPN.WindowsService.exe, 00000027.00000002.3016279133.00000000008F9000.00000004.00000010.00020000.00000000.sdmp
      Source: Binary string: /_/artifacts/obj/Microsoft.AspNet.SignalR.Client/Release/net45/Microsoft.AspNet.SignalR.Client.pdb source: is-3TGVV.tmp.2.dr
      Source: Binary string: D:\VPN core\FastestVPN-Windows-Core\VPN\obj\Debug\VPN.pdbB3\3 N3_CorDllMainmscoree.dll source: FastestVPN.WindowsService.exe, 00000032.00000002.4031178164.0000000004372000.00000002.00000001.01000000.00000042.sdmp, is-DQ4HF.tmp.2.dr
      Source: Binary string: D:\VPN core\FastestVPN-Windows-Core\VPN.Common\obj\Debug\VPN.Common.pdb source: OqAVRCkQ3T.tmp, 00000002.00000003.3069897606.0000000005580000.00000004.00001000.00020000.00000000.sdmp, FastestVPN.WindowsService.exe, FastestVPN.WindowsService.exe, 00000027.00000002.3020037971.0000000005062000.00000002.00000001.01000000.0000002B.sdmp
      Source: Binary string: D:\a\SQLitePCL.raw\SQLitePCL.raw\SQLitePCL.raw\src\SQLitePCLRaw.provider.dynamic_cdecl\obj\Release\netstandard2.0\SQLitePCLRaw.provider.dynamic_cdecl.pdb source: FastestVPN.exe, FastestVPN.exe, 00000016.00000002.4100328999.000000000BD62000.00000002.00000001.01000000.00000032.sdmp, is-AC86P.tmp.2.dr
      Source: Binary string: /_/artifacts/obj/Microsoft.AspNet.SignalR.Core/Release/net45/Microsoft.AspNet.SignalR.Core.pdbSHA256Z source: FastestVPN.WindowsService.exe, 00000027.00000002.3020164102.00000000050A2000.00000002.00000001.01000000.0000002A.sdmp, FastestVPN.WindowsService.exe, 00000032.00000002.4013372056.0000000000C66000.00000004.00000020.00020000.00000000.sdmp, FastestVPN.WindowsService.exe, 00000032.00000002.4019346826.000000000183D000.00000004.00000800.00020000.00000000.sdmp
      Source: Binary string: q!Microsoft.AspNet.SignalR.Core.pdb source: FastestVPN.WindowsService.exe, 00000032.00000002.4019346826.000000000183D000.00000004.00000800.00020000.00000000.sdmp
      Source: Binary string: c:\users\samuli\opt\tap-windows6-mattock\tapinstall\7600\objfre_wlh_amd64\amd64\tapinstall.pdb source: is-80EU7.tmp.2.dr
      Source: Binary string: Microsoft.Owin.Cors.pdbSHA256 source: FastestVPN.WindowsService.exe, 00000032.00000002.4028217019.0000000004282000.00000002.00000001.01000000.0000003C.sdmp
      Source: Binary string: \??\C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.PDBgz~ source: FastestVPN.WindowsService.exe, 00000027.00000002.3016856876.0000000000AE0000.00000004.00000020.00020000.00000000.sdmp
      Source: Binary string: E:\nt\dnsrv\sdktools\reskit\content\subinacl\source\obj\i386\subinacl.pdb source: OqAVRCkQ3T.tmp, 00000002.00000003.3069897606.0000000005580000.00000004.00001000.00020000.00000000.sdmp, subinacl.exe, subinacl.exe, 0000002E.00000002.3048569979.0000000001001000.00000020.00000001.01000000.00000035.sdmp, subinacl.exe, 0000002E.00000000.3045272953.0000000001001000.00000020.00000001.01000000.00000035.sdmp, is-0B265.tmp.2.dr
      Source: Binary string: qEC:\Program Files\FastestVPN\Service\Microsoft.AspNet.SignalR.Core.pdb source: FastestVPN.WindowsService.exe, 00000032.00000002.4019346826.000000000183D000.00000004.00000800.00020000.00000000.sdmp
      Source: Binary string: Microsoft.Owin.Cors.pdb source: FastestVPN.WindowsService.exe, FastestVPN.WindowsService.exe, 00000032.00000002.4028217019.0000000004282000.00000002.00000001.01000000.0000003C.sdmp
      Source: Binary string: \??\C:\Windows\symbols\dll\System.Configuration.Install.pdb source: FastestVPN.WindowsService.exe, 00000027.00000002.3016856876.0000000000AE0000.00000004.00000020.00020000.00000000.sdmp
      Source: Binary string: D:\Sagar Work FastestVPN\FastestVPN-Windows-App\FastestVPN.Common\obj\Release\FastestVPN.Common.pdb source: FastestVPN.WindowsService.exe, FastestVPN.WindowsService.exe, 00000032.00000002.4024676130.0000000004132000.00000002.00000001.01000000.00000036.sdmp
      Source: Binary string: Microsoft.Owin.Diagnostics.pdbSHA256 source: FastestVPN.WindowsService.exe, 00000032.00000002.4029624292.0000000004322000.00000002.00000001.01000000.0000003D.sdmp
      Source: Binary string: /_/artifacts/obj/Microsoft.AspNet.SignalR.Core/Release/net45/Microsoft.AspNet.SignalR.Core.pdb@\ source: FastestVPN.WindowsService.exe, 00000032.00000002.4019346826.000000000183D000.00000004.00000800.00020000.00000000.sdmp
      Source: Binary string: D:\VPN core\FastestVPN-Windows-Core\VPN\obj\Debug\VPN.pdb source: FastestVPN.WindowsService.exe, FastestVPN.WindowsService.exe, 00000032.00000002.4031178164.0000000004372000.00000002.00000001.01000000.00000042.sdmp, is-DQ4HF.tmp.2.dr
      Source: Binary string: C:\Users\samuli\source\repos\tap-windows6\src\Release\tap0901.pdb source: is-SUSF8.tmp.2.dr
      Source: Binary string: c:\Users\Junaid AK\Desktop\New folder (2)\SingleInstanceApplication\SingleInstanceApplication\obj\Release\SingleInstanceApplication.pdb source: FastestVPN.exe, FastestVPN.exe, 00000034.00000002.3092111478.0000000004F72000.00000002.00000001.01000000.00000010.sdmp, is-L0D1P.tmp.2.dr
      Source: Binary string: Microsoft.Owin.Hosting.pdbSHA256d"M! source: FastestVPN.WindowsService.exe, 00000032.00000002.4025246226.0000000004152000.00000002.00000001.01000000.00000037.sdmp
      Source: Binary string: D:\a\SQLitePCL.raw\SQLitePCL.raw\SQLitePCL.raw\src\SQLitePCLRaw.provider.dynamic_cdecl\obj\Release\netstandard2.0\SQLitePCLRaw.provider.dynamic_cdecl.pdbSHA256 source: FastestVPN.exe, 00000016.00000002.4100328999.000000000BD62000.00000002.00000001.01000000.00000032.sdmp, is-AC86P.tmp.2.dr
      Source: Binary string: C:\Windows\Microsoft.NET\Framework\v4.0.30319\spNet.SignalR.Core.pdb561934e089\System.dlllO~SZ source: FastestVPN.WindowsService.exe, 00000032.00000002.4013372056.0000000000BF7000.00000004.00000020.00020000.00000000.sdmp
      Source: Binary string: \??\C:\Windows\dll\Microsoft.AspNet.SignalR.Core.pdb source: FastestVPN.WindowsService.exe, 00000032.00000002.4013372056.0000000000BF7000.00000004.00000020.00020000.00000000.sdmp
      Source: Binary string: D:\VPN core\FastestVPN-Windows-Core\VPN.OpenVpn\obj\Debug\VPN.OpenVpn.pdbRhlh ^h_CorDllMainmscoree.dll source: FastestVPN.WindowsService.exe, 00000032.00000002.4031311191.0000000004382000.00000002.00000001.01000000.00000043.sdmp
      Source: Binary string: D:\a\1\s\SDK\AppCenterAnalytics\Microsoft.AppCenter.Analytics.WindowsDesktop\obj\Microsoft.AppCenter.Analytics.WindowsDesktop\Release\net472\Microsoft.AppCenter.Analytics.pdb source: FastestVPN.exe, FastestVPN.exe, 00000016.00000002.4069583912.00000000060B2000.00000002.00000001.01000000.0000002E.sdmp
      Source: Binary string: /_/artifacts/obj/Microsoft.AspNet.SignalR.Core/Release/net45/Microsoft.AspNet.SignalR.Core.pdb source: FastestVPN.WindowsService.exe, FastestVPN.WindowsService.exe, 00000027.00000002.3020164102.00000000050A2000.00000002.00000001.01000000.0000002A.sdmp, FastestVPN.WindowsService.exe, 00000032.00000002.4013372056.0000000000C66000.00000004.00000020.00020000.00000000.sdmp, FastestVPN.WindowsService.exe, 00000032.00000002.4013372056.0000000000BF7000.00000004.00000020.00020000.00000000.sdmp, FastestVPN.WindowsService.exe, 00000032.00000002.4019346826.000000000183D000.00000004.00000800.00020000.00000000.sdmp
      Source: Binary string: c:\projects\projectsJ\nfsdk2_1.6\bin\release\win32\nfapi.pdb< source: nfregdrv.exe, 00000023.00000002.2673541932.0000000010019000.00000002.00000001.01000000.00000028.sdmp, nfregdrv.exe, 00000024.00000002.2674794145.0000000010019000.00000002.00000001.01000000.00000028.sdmp
      Source: Binary string: D:\a\1\s\SDK\AppCenterCrashes\Microsoft.AppCenter.Crashes.WindowsDesktop\obj\Microsoft.AppCenter.Crashes.WindowsDesktop\Release\net472\Microsoft.AppCenter.Crashes.pdbSHA256 source: FastestVPN.exe, 00000016.00000002.4069804140.00000000060C2000.00000002.00000001.01000000.0000002F.sdmp
      Source: Binary string: Hardcodet.NotifyIcon.Wpf.pdbSHA256[ source: FastestVPN.exe, 00000016.00000002.4059523377.0000000005A92000.00000002.00000001.01000000.0000001D.sdmp
      Source: Binary string: h:\projects\netfilter3\bin\Release\Win32\nfregdrv.pdb )0THi source: nfregdrv.exe, 00000023.00000000.2664840496.0000000000408000.00000002.00000001.01000000.00000027.sdmp, nfregdrv.exe, 00000023.00000002.2671884603.0000000000408000.00000002.00000001.01000000.00000027.sdmp, nfregdrv.exe, 00000024.00000000.2673854725.0000000000408000.00000002.00000001.01000000.00000027.sdmp, nfregdrv.exe, 00000024.00000002.2674392034.0000000000408000.00000002.00000001.01000000.00000027.sdmp
      Source: Binary string: D:\a\SQLitePCL.raw\SQLitePCL.raw\SQLitePCL.raw\src\SQLitePCLRaw.bundle_green\obj\Release\net461\SQLitePCLRaw.batteries_v2.pdbSHA256x source: FastestVPN.exe, 00000016.00000002.4099109913.000000000BCF2000.00000002.00000001.01000000.00000030.sdmp
      Source: Binary string: /_/artifacts/obj/Microsoft.AspNet.SignalR.Client/Release/net45/Microsoft.AspNet.SignalR.Client.pdbSHA256 source: is-3TGVV.tmp.2.dr
      Source: Binary string: \??\C:\Windows\symbols\dll\System.ServiceProcess.pdb source: FastestVPN.WindowsService.exe, 00000027.00000002.3016856876.0000000000AE0000.00000004.00000020.00020000.00000000.sdmp
      Source: Binary string: C:\projects\projectsJ\nfsdk2_1.6\driver_wfp\Win8\Win8Release\x64\netfilter2.pdb source: xcopy.exe, 00000022.00000002.2663759074.000001F775D11000.00000004.00000020.00020000.00000000.sdmp
      Source: Binary string: h:\projects\netfilter3\bin\Release\Win32\nfregdrv.pdb source: nfregdrv.exe, 00000023.00000000.2664840496.0000000000408000.00000002.00000001.01000000.00000027.sdmp, nfregdrv.exe, 00000023.00000002.2671884603.0000000000408000.00000002.00000001.01000000.00000027.sdmp, nfregdrv.exe, 00000024.00000000.2673854725.0000000000408000.00000002.00000001.01000000.00000027.sdmp, nfregdrv.exe, 00000024.00000002.2674392034.0000000000408000.00000002.00000001.01000000.00000027.sdmp
      Source: Binary string: C:\Windows\System.Configuration.Install.pdbpdball.pdb source: FastestVPN.WindowsService.exe, 00000027.00000002.3016856876.0000000000AE0000.00000004.00000020.00020000.00000000.sdmp
      Source: Binary string: agar Work FastestVPN\FastestVPN-Windows-App\FastestVPN.WindowsService\obj\Release\FastestVPN.WindowsService.pdb source: FastestVPN.WindowsService.exe, 00000027.00000002.3016856876.0000000000AE0000.00000004.00000020.00020000.00000000.sdmp
      Source: Binary string: D:\VPN core\FastestVPN-Windows-Core\VPN.Common\obj\Debug\VPN.Common.pdbH source: OqAVRCkQ3T.tmp, 00000002.00000003.3069897606.0000000005580000.00000004.00001000.00020000.00000000.sdmp, FastestVPN.WindowsService.exe, 00000027.00000002.3020037971.0000000005062000.00000002.00000001.01000000.0000002B.sdmp
      Source: Binary string: D:\VPN core\FastestVPN-Windows-Core\VPN.WireGuard\obj\Debug\VPN.WireGuard.pdb source: FastestVPN.WindowsService.exe, FastestVPN.WindowsService.exe, 00000032.00000002.4032342359.00000000043D2000.00000002.00000001.01000000.00000045.sdmp
      Source: Binary string: /_/artifacts/obj/Microsoft.Extensions.DependencyInjection.Abstractions/Release/net462/Microsoft.Extensions.DependencyInjection.Abstractions.pdbSHA256 source: FastestVPN.exe, 00000016.00000002.4055392390.0000000005342000.00000002.00000001.01000000.00000013.sdmp
      Source: Binary string: D:\Sagar Work FastestVPN\FastestVPN-Windows-App\FastestVPN.Data.Local\obj\Release\FastestVPN.Data.Local.pdb source: FastestVPN.exe, FastestVPN.exe, 00000016.00000002.4058466848.00000000058C2000.00000002.00000001.01000000.0000001B.sdmp
      Source: Binary string: D:\Sagar Work FastestVPN\FastestVPN-Windows-App\FastestVPN.WindowsService\obj\Release\FastestVPN.WindowsService.pdb source: FastestVPN.WindowsService.exe, 00000027.00000000.2677169939.0000000000472000.00000002.00000001.01000000.00000029.sdmp, FastestVPN.WindowsService.exe, 00000027.00000002.3018526379.00000000026E6000.00000004.00000800.00020000.00000000.sdmp, FastestVPN.WindowsService.exe, 00000027.00000002.3016279133.00000000008F9000.00000004.00000010.00020000.00000000.sdmp
      Source: Binary string: E:\A\_work\89\s\corefx\bin\obj\AnyOS.AnyCPU.Release\System.Memory\netstandard\System.Memory.pdbSHA256HXhZm source: FastestVPN.exe, 00000016.00000002.4101032372.000000000BDD2000.00000002.00000001.01000000.00000033.sdmp
      Source: Binary string: Microsoft.Owin.pdbSHA256 source: FastestVPN.WindowsService.exe, 00000032.00000002.4026203269.00000000041A2000.00000002.00000001.01000000.00000039.sdmp
      Source: Binary string: mscorlib.pdb source: FastestVPN.exe, 00000016.00000002.4016598487.0000000000D43000.00000004.00000020.00020000.00000000.sdmp
      Source: Binary string: D:\VPN core\FastestVPN-Windows-Core\VPN.RAS\obj\Debug\VPN.RAS.pdb source: OqAVRCkQ3T.tmp, 00000002.00000003.3069897606.0000000005580000.00000004.00001000.00020000.00000000.sdmp, OqAVRCkQ3T.tmp, 00000002.00000002.3098599633.000000000018C000.00000004.00000010.00020000.00000000.sdmp, FastestVPN.WindowsService.exe, FastestVPN.WindowsService.exe, 00000032.00000002.4032058607.00000000043C2000.00000002.00000001.01000000.00000044.sdmp, is-NJH6K.tmp.2.dr
      Source: Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\System.pdb source: FastestVPN.WindowsService.exe, 00000032.00000002.4013372056.0000000000BF7000.00000004.00000020.00020000.00000000.sdmp
      Source: Binary string: c:\projects\projectsj\nfsdk2_1.6\driver_wfp\std\objfre_win7_amd64\amd64\netfilter2.pdb source: is-N7JEQ.tmp.2.dr
      Source: Binary string: \??\C:\Windows\Microsoft.AspNet.SignalR.Core.pdbi4hn source: FastestVPN.WindowsService.exe, 00000032.00000002.4013372056.0000000000BF7000.00000004.00000020.00020000.00000000.sdmp
      Source: Binary string: /_/artifacts/obj/Microsoft.Extensions.DependencyInjection.Abstractions/Release/net462/Microsoft.Extensions.DependencyInjection.Abstractions.pdb source: FastestVPN.exe, FastestVPN.exe, 00000016.00000002.4055392390.0000000005342000.00000002.00000001.01000000.00000013.sdmp
      Source: Binary string: C:\projects\wpfanimatedgif\WpfAnimatedGif\obj\Release\net40\WpfAnimatedGif.pdbSHA256 source: FastestVPN.exe, 00000016.00000002.4067532678.0000000005DF2000.00000002.00000001.01000000.0000001E.sdmp
      Source: Binary string: D:\a\1\s\SDK\AppCenter\Microsoft.AppCenter.WindowsDesktop\obj\Microsoft.AppCenter.WindowsDesktop\Release\net472\Microsoft.AppCenter.pdb source: FastestVPN.exe, FastestVPN.exe, 00000016.00000002.4078599339.0000000008862000.00000002.00000001.01000000.0000002D.sdmp, FastestVPN.exe, 00000016.00000002.4016598487.0000000000D43000.00000004.00000020.00020000.00000000.sdmp
      Source: Binary string: D:\Sagar Work FastestVPN\FastestVPN-Windows-App\FastestVPN.ViewModel\obj\Release\FastestVPN.ViewModel.pdb source: FastestVPN.exe, FastestVPN.exe, 00000016.00000002.4057691774.0000000005872000.00000002.00000001.01000000.00000017.sdmp
      Source: Binary string: Microsoft.Owin.Host.HttpListener.pdbSHA256-( source: FastestVPN.WindowsService.exe, 00000032.00000002.4026934919.00000000041D2000.00000002.00000001.01000000.0000003A.sdmp
      Source: Binary string: \??\C:\Windows\symbols\exe\FastestVPN.WindowsService.pdbL source: FastestVPN.WindowsService.exe, 00000027.00000002.3016856876.0000000000AE0000.00000004.00000020.00020000.00000000.sdmp
      Source: Binary string: Microsoft.Owin.Security.pdbSHA256U source: FastestVPN.WindowsService.exe, 00000032.00000002.4030619936.0000000004352000.00000002.00000001.01000000.0000003E.sdmp
      Source: Binary string: System.pdbN|2h|2 Z|2_CorDllMainmscoree.dll source: FastestVPN.WindowsService.exe, 00000032.00000002.4013372056.0000000000BF7000.00000004.00000020.00020000.00000000.sdmp, FastestVPN.WindowsService.exe, 00000032.00000002.4019346826.000000000183D000.00000004.00000800.00020000.00000000.sdmp
      Source: Binary string: \??\C:\Windows\symbols\exe\FastestVPN.WindowsService.pdb? source: FastestVPN.WindowsService.exe, 00000027.00000002.3016856876.0000000000AE0000.00000004.00000020.00020000.00000000.sdmp
      Source: Binary string: D:\Sagar Work FastestVPN\FastestVPN-Windows-App\FastestVPN.Data.Remote\obj\Release\FastestVPN.Data.Remote.pdb source: FastestVPN.exe, FastestVPN.exe, 00000016.00000002.4058632607.00000000058D2000.00000002.00000001.01000000.0000001C.sdmp
      Source: Binary string: D:\Sagar Work FastestVPN\FastestVPN-Windows-App\FastestVPN.BLL\obj\Release\FastestVPN.BLL.pdbVepe be_CorDllMainmscoree.dll source: FastestVPN.exe, 00000016.00000002.4058237613.00000000058B2000.00000002.00000001.01000000.0000001A.sdmp
      Source: Binary string: symbols\exe\FastestVPN.WindowsService.pdb source: FastestVPN.WindowsService.exe, 00000027.00000002.3016279133.00000000008F9000.00000004.00000010.00020000.00000000.sdmp
      Source: Binary string: /_/src/Flurl.Http/obj/Release/net472/Flurl.Http.pdbSHA256 source: is-CVBBG.tmp.2.dr
      Source: Binary string: D:\VPN core\FastestVPN-Windows-Core\VPN.OpenVpn\obj\Debug\VPN.OpenVpn.pdb source: FastestVPN.WindowsService.exe, FastestVPN.WindowsService.exe, 00000032.00000002.4031311191.0000000004382000.00000002.00000001.01000000.00000043.sdmp
      Source: Binary string: /_/artifacts/obj/Microsoft.Bcl.AsyncInterfaces/Release/net462/Microsoft.Bcl.AsyncInterfaces.pdbSHA256 source: FastestVPN.exe, 00000016.00000002.4056210634.00000000054A2000.00000002.00000001.01000000.00000014.sdmp, is-RP1DP.tmp.2.dr
      Source: Binary string: q^/_/artifacts/obj/Microsoft.AspNet.SignalR.Core/Release/net45/Microsoft.AspNet.SignalR.Core.pdb source: FastestVPN.WindowsService.exe, 00000032.00000002.4019346826.000000000183D000.00000004.00000800.00020000.00000000.sdmp
      Source: Binary string: Microsoft.Owin.Diagnostics.pdb source: FastestVPN.WindowsService.exe, FastestVPN.WindowsService.exe, 00000032.00000002.4029624292.0000000004322000.00000002.00000001.01000000.0000003D.sdmp
      Source: Binary string: mscorlib.pdb^ source: FastestVPN.exe, 00000016.00000002.4070565606.00000000085E3000.00000004.00000020.00020000.00000000.sdmp
      Source: Binary string: System.ServiceProcess.pdb source: FastestVPN.WindowsService.exe, 00000027.00000002.3018526379.00000000026E6000.00000004.00000800.00020000.00000000.sdmp
      Source: Binary string: c:\projects\projectsJ\nfsdk2_1.5.5\bin\release_c_api\win32\nfapi.pdb source: is-17HNF.tmp.2.dr
      Source: Binary string: /_/artifacts/obj/Microsoft.Extensions.DependencyInjection/Release/net462/Microsoft.Extensions.DependencyInjection.pdbSHA256 source: FastestVPN.exe, 00000016.00000002.4056338798.00000000054B2000.00000002.00000001.01000000.00000015.sdmp
      Source: Binary string: System.Configuration.Install.pdbxF source: FastestVPN.WindowsService.exe, 00000027.00000002.3018526379.00000000026E6000.00000004.00000800.00020000.00000000.sdmp
      Source: Binary string: D:\VPN core\FastestVPN-Windows-Core\VPN.WireGuard\obj\Debug\VPN.WireGuard.pdb2;L; >;_CorDllMainmscoree.dll source: FastestVPN.WindowsService.exe, 00000032.00000002.4032342359.00000000043D2000.00000002.00000001.01000000.00000045.sdmp
      Source: Binary string: E:\nt\dnsrv\sdktools\reskit\content\subinacl\source\obj\i386\subinacl.pdbPa source: OqAVRCkQ3T.tmp, 00000002.00000003.3069897606.0000000005580000.00000004.00001000.00020000.00000000.sdmp, subinacl.exe, 0000002E.00000002.3048569979.0000000001001000.00000020.00000001.01000000.00000035.sdmp, subinacl.exe, 0000002E.00000000.3045272953.0000000001001000.00000020.00000001.01000000.00000035.sdmp, is-0B265.tmp.2.dr
      Source: Binary string: C:\projects\projectsJ\nfsdk2_1.6\driver_wfp\Win8\Win8Release\x64\netfilter2.pdb source: xcopy.exe, 00000022.00000002.2663759074.000001F775D11000.00000004.00000020.00020000.00000000.sdmp
      Source: Binary string: D:\a\1\s\SDK\AppCenterAnalytics\Microsoft.AppCenter.Analytics.WindowsDesktop\obj\Microsoft.AppCenter.Analytics.WindowsDesktop\Release\net472\Microsoft.AppCenter.Analytics.pdbSHA256 source: FastestVPN.exe, 00000016.00000002.4069583912.00000000060B2000.00000002.00000001.01000000.0000002E.sdmp
      Source: Binary string: E:\A\_work\156\s\corefx\bin\obj\AnyOS.AnyCPU.Release\System.Threading.Tasks.Extensions\netfx\System.Threading.Tasks.Extensions.pdb source: FastestVPN.exe, FastestVPN.exe, 00000016.00000002.4056758757.00000000054D2000.00000002.00000001.01000000.00000016.sdmp
      Source: Binary string: D:\Sagar Work FastestVPN\FastestVPN-Windows-App\FastestVPN.Diagnostics\obj\Release\FastestVPN.Diagnostics.pdb source: FastestVPN.exe, FastestVPN.exe, 00000016.00000002.4056893733.00000000054E2000.00000002.00000001.01000000.00000019.sdmp
      Source: Binary string: c:\projects\projectsJ\nfsdk2_1.6\bin\release\win32\nfapi.pdb source: nfregdrv.exe, 00000023.00000002.2673541932.0000000010019000.00000002.00000001.01000000.00000028.sdmp, nfregdrv.exe, 00000024.00000002.2674794145.0000000010019000.00000002.00000001.01000000.00000028.sdmp
      Source: Binary string: /_/artifacts/obj/Microsoft.Bcl.AsyncInterfaces/Release/net462/Microsoft.Bcl.AsyncInterfaces.pdb source: FastestVPN.exe, FastestVPN.exe, 00000016.00000002.4056210634.00000000054A2000.00000002.00000001.01000000.00000014.sdmp, is-RP1DP.tmp.2.dr
      Source: Binary string: c:\Users\lodejard\Projects\owin-hosting\src\main\Owin.Startup\obj\Release\Owin.pdb source: FastestVPN.WindowsService.exe, FastestVPN.WindowsService.exe, 00000032.00000002.4025763037.0000000004172000.00000002.00000001.01000000.00000038.sdmp
      Source: Binary string: Microsoft.Owin.Hosting.pdb source: FastestVPN.WindowsService.exe, FastestVPN.WindowsService.exe, 00000032.00000002.4025246226.0000000004152000.00000002.00000001.01000000.00000037.sdmp
      Source: Binary string: D:\Sagar Work FastestVPN\FastestVPN-Windows-App\FastestVPN.DependencyInjection\obj\Release\FastestVPN.DI.pdb source: FastestVPN.exe, FastestVPN.exe, 00000016.00000002.4055277483.0000000005332000.00000002.00000001.01000000.00000012.sdmp, is-Q6C5B.tmp.2.dr
      Source: Binary string: D:\a\1\s\SDK\AppCenterCrashes\Microsoft.AppCenter.Crashes.WindowsDesktop\obj\Microsoft.AppCenter.Crashes.WindowsDesktop\Release\net472\Microsoft.AppCenter.Crashes.pdb source: FastestVPN.exe, FastestVPN.exe, 00000016.00000002.4069804140.00000000060C2000.00000002.00000001.01000000.0000002F.sdmp
      Source: Binary string: \??\C:\Windows\FastestVPN.WindowsService.pdbdb source: FastestVPN.WindowsService.exe, 00000027.00000002.3016856876.0000000000AE0000.00000004.00000020.00020000.00000000.sdmp
      Source: Binary string: /_/artifacts/obj/Microsoft.Extensions.DependencyInjection/Release/net462/Microsoft.Extensions.DependencyInjection.pdb source: FastestVPN.exe, FastestVPN.exe, 00000016.00000002.4056338798.00000000054B2000.00000002.00000001.01000000.00000015.sdmp
      Source: Binary string: C:\Windows\System.ServiceProcess.pdbpdbess.pdb source: FastestVPN.WindowsService.exe, 00000027.00000002.3016856876.0000000000AE0000.00000004.00000020.00020000.00000000.sdmp
      Source: Binary string: c:\Users\Junaid AK\Desktop\New folder (2)\SingleInstanceApplication\SingleInstanceApplication\obj\Release\SingleInstanceApplication.pdb@:^: P:_CorDllMainmscoree.dll source: FastestVPN.exe, 00000034.00000002.3092111478.0000000004F72000.00000002.00000001.01000000.00000010.sdmp, is-L0D1P.tmp.2.dr
      Source: Binary string: /_/Src/Newtonsoft.Json/obj/Release/net45/Newtonsoft.Json.pdbSHA256 source: OqAVRCkQ3T.tmp, 00000002.00000003.3069897606.0000000005580000.00000004.00001000.00020000.00000000.sdmp, FastestVPN.WindowsService.exe, 00000032.00000002.4032701232.0000000004432000.00000002.00000001.01000000.0000003F.sdmp
      Source: Binary string: E:\A\_work\89\s\corefx\bin\obj\AnyOS.AnyCPU.Release\System.Memory\netstandard\System.Memory.pdb source: FastestVPN.exe, FastestVPN.exe, 00000016.00000002.4101032372.000000000BDD2000.00000002.00000001.01000000.00000033.sdmp
      Source: Binary string: C:\projects\wpfanimatedgif\WpfAnimatedGif\obj\Release\net40\WpfAnimatedGif.pdb source: FastestVPN.exe, FastestVPN.exe, 00000016.00000002.4067532678.0000000005DF2000.00000002.00000001.01000000.0000001E.sdmp
      Source: Binary string: D:\Sagar Work FastestVPN\FastestVPN-Windows-App\FastestVPN.BLL\obj\Release\FastestVPN.BLL.pdb source: FastestVPN.exe, FastestVPN.exe, 00000016.00000002.4058237613.00000000058B2000.00000002.00000001.01000000.0000001A.sdmp
      Source: Binary string: D:\a\SQLitePCL.raw\SQLitePCL.raw\SQLitePCL.raw\src\SQLitePCLRaw.bundle_green\obj\Release\net461\SQLitePCLRaw.batteries_v2.pdb source: FastestVPN.exe, FastestVPN.exe, 00000016.00000002.4099109913.000000000BCF2000.00000002.00000001.01000000.00000030.sdmp
      Source: Binary string: Microsoft.Owin.Security.pdb source: FastestVPN.WindowsService.exe, FastestVPN.WindowsService.exe, 00000032.00000002.4030619936.0000000004352000.00000002.00000001.01000000.0000003E.sdmp
      Source: Binary string: D:\Sagar Work FastestVPN\FastestVPN-Windows-App\FastestVPN.Common\obj\Release\FastestVPN.Common.pdb source: FastestVPN.WindowsService.exe, 00000032.00000002.4024676130.0000000004132000.00000002.00000001.01000000.00000036.sdmp
      Source: Binary string: /_/Src/Newtonsoft.Json/obj/Release/net45/Newtonsoft.Json.pdb source: OqAVRCkQ3T.tmp, 00000002.00000003.3069897606.0000000005580000.00000004.00001000.00020000.00000000.sdmp, FastestVPN.WindowsService.exe, FastestVPN.WindowsService.exe, 00000032.00000002.4032701232.0000000004432000.00000002.00000001.01000000.0000003F.sdmp
      Source: Binary string: \??\C:\Windows\dll\System.ServiceProcess.pdb* source: FastestVPN.WindowsService.exe, 00000027.00000002.3016856876.0000000000AE0000.00000004.00000020.00020000.00000000.sdmp
      Source: Binary string: D:\VPN core\FastestVPN-Windows-Core\VPN.AdvancedNetwork\obj\Debug\VPN.AdvancedNetwork.pdb source: FastestVPN.WindowsService.exe, FastestVPN.WindowsService.exe, 00000032.00000002.4029086350.00000000042B2000.00000002.00000001.01000000.00000041.sdmp, is-NGC8I.tmp.2.dr
      Source: Binary string: D:\Sagar Work FastestVPN\FastestVPN-Windows-App\FastestVPN\obj\Release\FastestVPN.pdb source: FastestVPN.exe, 00000016.00000000.2625434306.00000000005AD000.00000002.00000001.01000000.0000000D.sdmp
      Source: Binary string: mC:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.pdbY source: FastestVPN.WindowsService.exe, 00000027.00000002.3016279133.00000000008F9000.00000004.00000010.00020000.00000000.sdmp
      Source: Binary string: \??\C:\Windows\exe\FastestVPN.WindowsService.pdb source: FastestVPN.WindowsService.exe, 00000027.00000002.3016856876.0000000000AE0000.00000004.00000020.00020000.00000000.sdmp
      Source: Binary string: \??\C:\Windows\dll\System.ServiceProcess.pdbLw source: FastestVPN.WindowsService.exe, 00000027.00000002.3016856876.0000000000AE0000.00000004.00000020.00020000.00000000.sdmp
      Source: Binary string: System.pdb source: FastestVPN.WindowsService.exe, 00000032.00000002.4013372056.0000000000BF7000.00000004.00000020.00020000.00000000.sdmp, FastestVPN.WindowsService.exe, 00000032.00000002.4019346826.000000000183D000.00000004.00000800.00020000.00000000.sdmp
      Source: Binary string: b77a5c561934e089.pdbj source: FastestVPN.WindowsService.exe, 00000027.00000002.3016856876.0000000000AE0000.00000004.00000020.00020000.00000000.sdmp
      Source: Binary string: Microsoft.Owin.Host.HttpListener.pdb source: FastestVPN.WindowsService.exe, FastestVPN.WindowsService.exe, 00000032.00000002.4026934919.00000000041D2000.00000002.00000001.01000000.0000003A.sdmp
      Source: Binary string: D:\a\1\s\SDK\AppCenter\Microsoft.AppCenter.WindowsDesktop\obj\Microsoft.AppCenter.WindowsDesktop\Release\net472\Microsoft.AppCenter.pdbSHA256 source: FastestVPN.exe, 00000016.00000002.4078599339.0000000008862000.00000002.00000001.01000000.0000002D.sdmp, FastestVPN.exe, 00000016.00000002.4016598487.0000000000D43000.00000004.00000020.00020000.00000000.sdmp
      Source: Binary string: D:\Sagar Work FastestVPN\FastestVPN-Windows-App\FastestVPN.Data.Remote\obj\Release\FastestVPN.Data.Remote.pdbb^|^ n^_CorDllMainmscoree.dll source: FastestVPN.exe, 00000016.00000002.4058632607.00000000058D2000.00000002.00000001.01000000.0000001C.sdmp
      Source: Binary string: D:\Sagar Work FastestVPN\FastestVPN-Windows-App\FastestVPN.DependencyInjection\obj\Release\FastestVPN.DI.pdbY6s6 e6_CorDllMainmscoree.dll source: FastestVPN.exe, 00000016.00000002.4055277483.0000000005332000.00000002.00000001.01000000.00000012.sdmp, is-Q6C5B.tmp.2.dr
      Source: Binary string: c:\users\samuli\opt\tap-windows6-mattock\tapinstall\7600\objfre_wlh_amd64\amd64\tapinstall.pdbH source: is-80EU7.tmp.2.dr
      Source: Binary string: C:\Users\samuli\source\repos\tap-windows6\src\x64\Release\tap0901.pdb source: drvinst.exe, 00000013.00000003.2602533419.000002520D746000.00000004.00000020.00020000.00000000.sdmp, drvinst.exe, 00000013.00000003.2600241743.000002520D6FB000.00000004.00000020.00020000.00000000.sdmp, is-HM6P4.tmp.2.dr
      Source: Binary string: \??\C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.pdb7q source: FastestVPN.WindowsService.exe, 00000027.00000002.3016856876.0000000000AE0000.00000004.00000020.00020000.00000000.sdmp
      Source: Binary string: D:\a\SQLitePCL.raw\SQLitePCL.raw\SQLitePCL.raw\src\SQLitePCLRaw.core\obj\Release\netstandard2.0\SQLitePCLRaw.core.pdbSHA256Ci\ source: FastestVPN.exe, 00000016.00000002.4016598487.0000000000D43000.00000004.00000020.00020000.00000000.sdmp, FastestVPN.exe, 00000016.00000002.4100015977.000000000BD42000.00000002.00000001.01000000.00000031.sdmp
      Source: Binary string: /_/src/Flurl.Http/obj/Release/net472/Flurl.Http.pdb source: is-CVBBG.tmp.2.dr
      Source: Binary string: Microsoft.Owin.pdb source: FastestVPN.WindowsService.exe, FastestVPN.WindowsService.exe, 00000032.00000002.4026203269.00000000041A2000.00000002.00000001.01000000.00000039.sdmp
      Source: Binary string: \??\C:\Windows\dll\System.Configuration.Install.pdb source: FastestVPN.WindowsService.exe, 00000027.00000002.3016856876.0000000000AE0000.00000004.00000020.00020000.00000000.sdmp
      Source: Binary string: \??\C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.pdb source: FastestVPN.WindowsService.exe, 00000027.00000002.3016856876.0000000000AE0000.00000004.00000020.00020000.00000000.sdmp
      Source: Binary string: C:\Windows\FastestVPN.WindowsService.pdbpdbice.pdb* source: FastestVPN.WindowsService.exe, 00000027.00000002.3016856876.0000000000AE0000.00000004.00000020.00020000.00000000.sdmp
      Source: Binary string: Hardcodet.NotifyIcon.Wpf.pdb source: FastestVPN.exe, FastestVPN.exe, 00000016.00000002.4059523377.0000000005A92000.00000002.00000001.01000000.0000001D.sdmp
      Source: Binary string: m.pdb source: FastestVPN.WindowsService.exe, 00000027.00000002.3016279133.00000000008F9000.00000004.00000010.00020000.00000000.sdmp
      Source: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exeCode function: 12_2_00007FF6EC4EECAC FindFirstFileExW,FindNextFileW,FindClose,12_2_00007FF6EC4EECAC
      Source: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exeCode function: 12_2_00007FF6EC4EE810 FindFirstFileExW,12_2_00007FF6EC4EE810
      Source: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exeCode function: 12_2_00007FF6EC4EE0B0 _invalid_parameter_noinfo,_invalid_parameter_noinfo,FindFirstFileExW,FindNextFileW,FindClose,FindClose,FindClose,12_2_00007FF6EC4EE0B0
      Source: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exeCode function: 12_2_00007FF6EC4EE0B0 _invalid_parameter_noinfo,_invalid_parameter_noinfo,FindFirstFileExW,FindNextFileW,FindClose,FindClose,FindClose,12_2_00007FF6EC4EE0B0
      Source: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exeCode function: 12_2_00007FF6EC4B3630 GetWindowsDirectoryW,FindFirstFileW,FindNextFileW,FindClose,12_2_00007FF6EC4B3630
      Source: C:\Program Files\FastestVPN\subinacl.exeCode function: 46_2_0103172D __EH_prolog,#540,#922,#858,#800,#2910,wcslen,#2910,wcslen,#823,GetLastError,_CxxThrowException,#2910,#2910,swprintf,FindFirstFileW,GetLastError,#825,#2910,FindFirstFileW,wcscmp,wcscmp,wcscmp,#535,#942,#942,#535,#942,#942,#800,FindNextFileW,FindClose,#800,46_2_0103172D
      Source: C:\Program Files\FastestVPN\subinacl.exeCode function: 46_2_01031DDF __EH_prolog,#540,#925,#858,#800,#2910,wcslen,wcslen,#2910,wcslen,#823,GetLastError,_CxxThrowException,#2910,#2910,swprintf,FindFirstFileW,GetLastError,#825,#2910,FindFirstFileW,wcscmp,wcscmp,#540,#538,#922,#925,#858,#800,#800,#800,#925,#800,#858,#800,FindNextFileW,FindClose,#800,46_2_01031DDF
      Source: C:\Program Files\FastestVPN\Resources\sp\release\nfregdrv.exeCode function: 35_2_100163B0 GetLogicalDriveStringsW,QueryDosDeviceW,GetDriveTypeW,EnterCriticalSection,LeaveCriticalSection,35_2_100163B0
      Source: C:\Windows\System32\cmd.exeFile opened: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\Jump to behavior
      Source: C:\Windows\System32\cmd.exeFile opened: C:\Program Files\FastestVPN\Jump to behavior
      Source: C:\Windows\System32\cmd.exeFile opened: C:\Program Files\FastestVPN\Resources\Jump to behavior
      Source: C:\Windows\System32\cmd.exeFile opened: C:\Program Files\FastestVPN\Resources\driver\windows10\Jump to behavior
      Source: C:\Windows\System32\cmd.exeFile opened: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64Jump to behavior
      Source: C:\Windows\System32\cmd.exeFile opened: C:\Program Files\FastestVPN\Resources\driver\Jump to behavior

      Networking

      barindex
      NDIS Filter Driver detected (likely used to intercept and sniff network traffic)
      Source: is-T910E.tmp.2.drStatic PE information: Found NDIS imports: FwpmFreeMemory0, FwpmuserOpen0, FwpmuserClose0, FwpmTransactionBegin0, FwpmTransactionCommit0, FwpmTransactionAbort0, FwpmProviderAdd0, FwpmProviderContextDeleteByKey0, FwpmSubLayerAdd0, FwpmSubLayerDeleteByKey0, FwpmSubLayerCreateEnumHandle0, FwpmSubLayerEnum0, FwpmSubLayerDestroyEnumHandle0, FwpmCalloutAdd0, FwpmFilterAdd0, FwpsFlowAbort0, FwpsInjectionHandleCreate0, FwpsInjectionHandleDestroy0, FwpsRedirectHandleCreate0, FwpsFreeNetBufferList0, FwpsFreeCloneNetBufferList0, FwpsInjectNetworkSendAsync0, FwpsConstructIpHeaderForTransportPacket0, FwpsInjectTransportSendAsync0, FwpsInjectTransportReceiveAsync0, FwpsInjectNetworkReceiveAsync0, FwpsStreamInjectAsync0, FwpsCopyStreamDataToBuffer0, FwpmBfeStateGet0, FwpmBfeStateSubscribeChanges0, FwpmBfeStateUnsubscribeChanges0, FwpsFlowRemoveContext0, FwpsCompleteClassify0, FwpsRedirectHandleDestroy0, FwpsCloneStreamData0, FwpsDiscardClonedStreamData0, FwpsQueryPacketInjectionState0, FwpsApplyModifiedLayerData0, FwpsAcquireWritableLayerDataPointer0, FwpsReleaseClassifyHandle0, FwpsAcquireClassifyHandle0, FwpsFlowAssociateContext0, FwpsCalloutUnregisterByKey0, FwpsPendClassify0, FwpsCalloutRegister1, FwpsAllocateNetBufferAndNetBufferList0
      Source: is-04ESR.tmp.2.drStatic PE information: Found NDIS imports: FwpmFilterDeleteById0, FwpmSubLayerDeleteByKey0, FwpmSubLayerAdd0, FwpmuserClose0, FwpmuserOpen0, FwpmFilterAdd0, FwpmGetAppIdFromFileName0
      Source: is-7EKKK.tmp.2.drStatic PE information: Found NDIS imports: FwpmFilterDeleteById0, FwpmSubLayerDeleteByKey0, FwpmSubLayerAdd0, FwpmuserClose0, FwpmuserOpen0, FwpmFilterAdd0, FwpmGetAppIdFromFileName0
      Source: ComDebug.exe, 00000006.00000002.4015584548.0000000000E51000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2228.0 Safari/537.36Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)Mozilla/5.0 (compatible; bingbot/2.0; +http://www.bing.com/bingbot.htm)Mozilla/5.0 (compatible; Yahoo! Slurp; http://help.yahoo.com/help/us/ysearch/slurp) equals www.yahoo.com (Yahoo)
      Source: OqAVRCkQ3T.tmp, 00000002.00000003.3069897606.0000000005580000.00000004.00001000.00020000.00000000.sdmp, OqAVRCkQ3T.tmp, 00000002.00000002.3098599633.000000000018C000.00000004.00000010.00020000.00000000.sdmp, ComDebug.exe, 00000006.00000002.4022885088.0000000004DCC000.00000004.00000020.00020000.00000000.sdmp, FastestVPN.exe, 00000016.00000002.4071204873.0000000008648000.00000004.00000020.00020000.00000000.sdmp, FastestVPN.WindowsService.exe, 0000002D.00000002.3044325400.00000000058C0000.00000004.00000020.00020000.00000000.sdmp, FastestVPN.WindowsService.exe, 0000002D.00000002.3041213432.0000000001570000.00000004.00000020.00020000.00000000.sdmp, is-0B265.tmp.2.dr, is-DQ4HF.tmp.2.dr, is-80EU7.tmp.2.dr, is-NJH6K.tmp.2.dr, is-CVBBG.tmp.2.dr, is-17HNF.tmp.2.dr, is-EANN9.tmp.2.dr, is-Q6C5B.tmp.2.dr, is-NGC8I.tmp.2.dr, is-L0D1P.tmp.2.dr, is-AC86P.tmp.2.drString found in binary or memory: http://aia.entrust.net/ts2-chain256.p7c01
      Source: xcopy.exe, 00000022.00000002.2663759074.000001F775D11000.00000004.00000020.00020000.00000000.sdmp, is-HM6P4.tmp.2.drString found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDCA-1.crt0
      Source: xcopy.exe, 00000022.00000002.2663759074.000001F775D11000.00000004.00000020.00020000.00000000.sdmp, is-ESUKM.tmp.2.dr, is-HM6P4.tmp.2.drString found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
      Source: OqAVRCkQ3T.tmp, 00000002.00000003.3069897606.0000000005580000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
      Source: OqAVRCkQ3T.tmp, 00000002.00000003.3069897606.0000000005580000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://cacerts.digicert.com/DigiCertCSRSA4096RootG5.crt0E
      Source: xcopy.exe, 00000022.00000002.2663759074.000001F775D11000.00000004.00000020.00020000.00000000.sdmp, is-ESUKM.tmp.2.dr, is-HM6P4.tmp.2.drString found in binary or memory: http://cacerts.digicert.com/DigiCertEVCodeSigningCA-SHA2.crt0
      Source: xcopy.exe, 00000022.00000002.2663759074.000001F775D11000.00000004.00000020.00020000.00000000.sdmp, is-ESUKM.tmp.2.dr, is-N7JEQ.tmp.2.dr, is-HM6P4.tmp.2.drString found in binary or memory: http://cacerts.digicert.com/DigiCertHighAssuranceEVRootCA.crt0
      Source: is-ESUKM.tmp.2.drString found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDTimestampingCA.crt0
      Source: is-N7JEQ.tmp.2.drString found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2HighAssuranceCodeSigningCA.crt0
      Source: OqAVRCkQ3T.tmp, 00000002.00000003.3069897606.0000000005580000.00000004.00001000.00020000.00000000.sdmp, OqAVRCkQ3T.tmp, 00000002.00000002.3098599633.000000000018C000.00000004.00000010.00020000.00000000.sdmp, ComDebug.exe, 00000006.00000002.4022885088.0000000004DCC000.00000004.00000020.00020000.00000000.sdmp, FastestVPN.exe, 00000016.00000002.4093428327.000000000B1B4000.00000004.00000020.00020000.00000000.sdmp, FastestVPN.exe, 00000016.00000002.4075462425.0000000008758000.00000004.00000020.00020000.00000000.sdmp, FastestVPN.WindowsService.exe, 0000002D.00000002.3044325400.00000000058C0000.00000004.00000020.00020000.00000000.sdmp, FastestVPN.WindowsService.exe, 0000002D.00000002.3041458929.0000000002EF5000.00000004.00000800.00020000.00000000.sdmp, is-0B265.tmp.2.dr, is-DQ4HF.tmp.2.dr, is-NJH6K.tmp.2.dr, is-CVBBG.tmp.2.dr, is-Q6C5B.tmp.2.dr, is-NGC8I.tmp.2.dr, is-L0D1P.tmp.2.dr, is-AC86P.tmp.2.drString found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crt0
      Source: OqAVRCkQ3T.tmp, 00000002.00000003.3069897606.0000000005580000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
      Source: OqAVRCkQ3T.tmp, 00000002.00000003.3069897606.0000000005580000.00000004.00001000.00020000.00000000.sdmp, OqAVRCkQ3T.tmp, 00000002.00000002.3098599633.000000000018C000.00000004.00000010.00020000.00000000.sdmp, ComDebug.exe, 00000006.00000002.4022885088.0000000004DCC000.00000004.00000020.00020000.00000000.sdmp, FastestVPN.WindowsService.exe, 00000027.00000002.3018526379.00000000026E6000.00000004.00000800.00020000.00000000.sdmp, FastestVPN.WindowsService.exe, 0000002D.00000002.3039966230.000000000118C000.00000004.00000020.00020000.00000000.sdmp, is-0B265.tmp.2.dr, is-DQ4HF.tmp.2.dr, is-NJH6K.tmp.2.dr, is-CVBBG.tmp.2.dr, is-Q6C5B.tmp.2.dr, is-NGC8I.tmp.2.dr, is-L0D1P.tmp.2.dr, is-AC86P.tmp.2.drString found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
      Source: OqAVRCkQ3T.tmp, 00000002.00000003.3069897606.0000000005580000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://cacerts.digicert.com/NETFoundationProjectsCodeSigningCA2.crt0
      Source: is-80EU7.tmp.2.dr, is-17HNF.tmp.2.dr, is-EANN9.tmp.2.drString found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl04
      Source: OqAVRCkQ3T.tmp, 00000002.00000003.3069897606.0000000005580000.00000004.00001000.00020000.00000000.sdmp, OqAVRCkQ3T.tmp, 00000002.00000002.3098599633.000000000018C000.00000004.00000010.00020000.00000000.sdmp, ComDebug.exe, 00000006.00000002.4022885088.0000000004DCC000.00000004.00000020.00020000.00000000.sdmp, FastestVPN.WindowsService.exe, 0000002D.00000002.3041213432.0000000001570000.00000004.00000020.00020000.00000000.sdmp, FastestVPN.WindowsService.exe, 0000002D.00000002.3039966230.000000000118C000.00000004.00000020.00020000.00000000.sdmp, is-0B265.tmp.2.dr, is-DQ4HF.tmp.2.dr, is-80EU7.tmp.2.dr, is-NJH6K.tmp.2.dr, is-CVBBG.tmp.2.dr, is-17HNF.tmp.2.dr, is-EANN9.tmp.2.dr, is-Q6C5B.tmp.2.dr, is-NGC8I.tmp.2.dr, is-L0D1P.tmp.2.dr, is-AC86P.tmp.2.drString found in binary or memory: http://crl.entrust.net/csbr1.crl0
      Source: FastestVPN.WindowsService.exe, 0000002D.00000002.3044325400.00000000058C0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.entrust.net/g2ca.c
      Source: OqAVRCkQ3T.tmp, 00000002.00000003.3069897606.0000000005580000.00000004.00001000.00020000.00000000.sdmp, OqAVRCkQ3T.tmp, 00000002.00000002.3098599633.000000000018C000.00000004.00000010.00020000.00000000.sdmp, ComDebug.exe, 00000006.00000002.4022885088.0000000004DCC000.00000004.00000020.00020000.00000000.sdmp, FastestVPN.WindowsService.exe, 0000002D.00000002.3041213432.0000000001570000.00000004.00000020.00020000.00000000.sdmp, FastestVPN.WindowsService.exe, 0000002D.00000002.3039966230.000000000118C000.00000004.00000020.00020000.00000000.sdmp, is-0B265.tmp.2.dr, is-DQ4HF.tmp.2.dr, is-80EU7.tmp.2.dr, is-NJH6K.tmp.2.dr, is-CVBBG.tmp.2.dr, is-17HNF.tmp.2.dr, is-EANN9.tmp.2.dr, is-Q6C5B.tmp.2.dr, is-NGC8I.tmp.2.dr, is-L0D1P.tmp.2.dr, is-AC86P.tmp.2.drString found in binary or memory: http://crl.entrust.net/g2ca.crl0
      Source: OqAVRCkQ3T.tmp, 00000002.00000003.3069897606.0000000005580000.00000004.00001000.00020000.00000000.sdmp, OqAVRCkQ3T.tmp, 00000002.00000002.3098599633.000000000018C000.00000004.00000010.00020000.00000000.sdmp, ComDebug.exe, 00000006.00000002.4022885088.0000000004DCC000.00000004.00000020.00020000.00000000.sdmp, FastestVPN.exe, 00000016.00000002.4071204873.0000000008648000.00000004.00000020.00020000.00000000.sdmp, FastestVPN.WindowsService.exe, 0000002D.00000002.3044325400.00000000058C0000.00000004.00000020.00020000.00000000.sdmp, FastestVPN.WindowsService.exe, 0000002D.00000002.3041213432.0000000001570000.00000004.00000020.00020000.00000000.sdmp, is-0B265.tmp.2.dr, is-DQ4HF.tmp.2.dr, is-80EU7.tmp.2.dr, is-NJH6K.tmp.2.dr, is-CVBBG.tmp.2.dr, is-17HNF.tmp.2.dr, is-EANN9.tmp.2.dr, is-Q6C5B.tmp.2.dr, is-NGC8I.tmp.2.dr, is-L0D1P.tmp.2.dr, is-AC86P.tmp.2.drString found in binary or memory: http://crl.entrust.net/ts2ca.crl0
      Source: is-80EU7.tmp.2.dr, is-17HNF.tmp.2.dr, is-EANN9.tmp.2.drString found in binary or memory: http://crl.sectigo.com/SectigoPublicCodeSigningCAEVR36.crl0
      Source: is-80EU7.tmp.2.dr, is-17HNF.tmp.2.dr, is-EANN9.tmp.2.drString found in binary or memory: http://crl.sectigo.com/SectigoPublicCodeSigningRootR46.crl0
      Source: is-N7JEQ.tmp.2.drString found in binary or memory: http://crl.thawte.com/ThawteTimestampingCA.crl0
      Source: xcopy.exe, 00000022.00000002.2663759074.000001F775D11000.00000004.00000020.00020000.00000000.sdmp, is-HM6P4.tmp.2.drString found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDCA-1.crl08
      Source: OqAVRCkQ3T.tmp, 00000002.00000003.3069897606.0000000005580000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
      Source: xcopy.exe, 00000022.00000002.2663759074.000001F775D11000.00000004.00000020.00020000.00000000.sdmp, is-HM6P4.tmp.2.drString found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0:
      Source: is-ESUKM.tmp.2.drString found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0P
      Source: OqAVRCkQ3T.tmp, 00000002.00000003.3069897606.0000000005580000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://crl3.digicert.com/DigiCertCSRSA4096RootG5.crl0
      Source: xcopy.exe, 00000022.00000002.2663759074.000001F775D11000.00000004.00000020.00020000.00000000.sdmp, is-ESUKM.tmp.2.dr, is-HM6P4.tmp.2.drString found in binary or memory: http://crl3.digicert.com/DigiCertHighAssuranceEVRootCA.crl0
      Source: is-N7JEQ.tmp.2.drString found in binary or memory: http://crl3.digicert.com/DigiCertHighAssuranceEVRootCA.crl0O
      Source: OqAVRCkQ3T.tmp, 00000002.00000003.3069897606.0000000005580000.00000004.00001000.00020000.00000000.sdmp, OqAVRCkQ3T.tmp, 00000002.00000002.3098599633.000000000018C000.00000004.00000010.00020000.00000000.sdmp, ComDebug.exe, 00000006.00000002.4022885088.0000000004DCC000.00000004.00000020.00020000.00000000.sdmp, FastestVPN.exe, 00000016.00000002.4093428327.000000000B1B4000.00000004.00000020.00020000.00000000.sdmp, FastestVPN.exe, 00000016.00000002.4075462425.0000000008758000.00000004.00000020.00020000.00000000.sdmp, FastestVPN.WindowsService.exe, 0000002D.00000002.3044325400.00000000058C0000.00000004.00000020.00020000.00000000.sdmp, FastestVPN.WindowsService.exe, 0000002D.00000002.3041458929.0000000002EF5000.00000004.00000800.00020000.00000000.sdmp, FastestVPN.WindowsService.exe, 0000002D.00000002.3039966230.000000000118C000.00000004.00000020.00020000.00000000.sdmp, is-0B265.tmp.2.dr, is-DQ4HF.tmp.2.dr, is-NJH6K.tmp.2.dr, is-CVBBG.tmp.2.dr, is-Q6C5B.tmp.2.dr, is-NGC8I.tmp.2.dr, is-L0D1P.tmp.2.dr, is-AC86P.tmp.2.drString found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0S
      Source: OqAVRCkQ3T.tmp, 00000002.00000003.3069897606.0000000005580000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
      Source: OqAVRCkQ3T.tmp, 00000002.00000003.3069897606.0000000005580000.00000004.00001000.00020000.00000000.sdmp, OqAVRCkQ3T.tmp, 00000002.00000002.3098599633.000000000018C000.00000004.00000010.00020000.00000000.sdmp, ComDebug.exe, 00000006.00000002.4022885088.0000000004DCC000.00000004.00000020.00020000.00000000.sdmp, FastestVPN.WindowsService.exe, 0000002D.00000002.3039966230.000000000118C000.00000004.00000020.00020000.00000000.sdmp, is-0B265.tmp.2.dr, is-DQ4HF.tmp.2.dr, is-NJH6K.tmp.2.dr, is-CVBBG.tmp.2.dr, is-Q6C5B.tmp.2.dr, is-NGC8I.tmp.2.dr, is-L0D1P.tmp.2.dr, is-AC86P.tmp.2.drString found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
      Source: xcopy.exe, 00000022.00000002.2663759074.000001F775D11000.00000004.00000020.00020000.00000000.sdmp, is-ESUKM.tmp.2.dr, is-HM6P4.tmp.2.drString found in binary or memory: http://crl3.digicert.com/EVCodeSigningSHA2-g1.crl07
      Source: OqAVRCkQ3T.tmp, 00000002.00000003.3069897606.0000000005580000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://crl3.digicert.com/NETFoundationProjectsCodeSigningCA2.crl0F
      Source: is-ESUKM.tmp.2.drString found in binary or memory: http://crl3.digicert.com/sha2-assured-ts.crl02
      Source: is-N7JEQ.tmp.2.drString found in binary or memory: http://crl3.digicert.com/sha2-ha-cs-g1.crl00
      Source: xcopy.exe, 00000022.00000002.2663759074.000001F775D11000.00000004.00000020.00020000.00000000.sdmp, is-HM6P4.tmp.2.drString found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDCA-1.crl0w
      Source: xcopy.exe, 00000022.00000002.2663759074.000001F775D11000.00000004.00000020.00020000.00000000.sdmp, is-HM6P4.tmp.2.drString found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0
      Source: is-ESUKM.tmp.2.drString found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
      Source: xcopy.exe, 00000022.00000002.2663759074.000001F775D11000.00000004.00000020.00020000.00000000.sdmp, is-ESUKM.tmp.2.dr, is-N7JEQ.tmp.2.dr, is-HM6P4.tmp.2.drString found in binary or memory: http://crl4.digicert.com/DigiCertHighAssuranceEVRootCA.crl0
      Source: OqAVRCkQ3T.tmp, 00000002.00000003.3069897606.0000000005580000.00000004.00001000.00020000.00000000.sdmp, OqAVRCkQ3T.tmp, 00000002.00000002.3098599633.000000000018C000.00000004.00000010.00020000.00000000.sdmp, ComDebug.exe, 00000006.00000002.4022885088.0000000004DCC000.00000004.00000020.00020000.00000000.sdmp, FastestVPN.exe, 00000016.00000002.4093428327.000000000B1B4000.00000004.00000020.00020000.00000000.sdmp, FastestVPN.exe, 00000016.00000002.4075462425.0000000008758000.00000004.00000020.00020000.00000000.sdmp, FastestVPN.WindowsService.exe, 0000002D.00000002.3044325400.00000000058C0000.00000004.00000020.00020000.00000000.sdmp, FastestVPN.WindowsService.exe, 0000002D.00000002.3041458929.0000000002EF5000.00000004.00000800.00020000.00000000.sdmp, FastestVPN.WindowsService.exe, 0000002D.00000002.3039966230.000000000118C000.00000004.00000020.00020000.00000000.sdmp, is-0B265.tmp.2.dr, is-DQ4HF.tmp.2.dr, is-NJH6K.tmp.2.dr, is-CVBBG.tmp.2.dr, is-Q6C5B.tmp.2.dr, is-NGC8I.tmp.2.dr, is-L0D1P.tmp.2.dr, is-AC86P.tmp.2.drString found in binary or memory: http://crl4.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0
      Source: xcopy.exe, 00000022.00000002.2663759074.000001F775D11000.00000004.00000020.00020000.00000000.sdmp, is-ESUKM.tmp.2.dr, is-HM6P4.tmp.2.drString found in binary or memory: http://crl4.digicert.com/EVCodeSigningSHA2-g1.crl0K
      Source: OqAVRCkQ3T.tmp, 00000002.00000003.3069897606.0000000005580000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://crl4.digicert.com/NETFoundationProjectsCodeSigningCA2.crl0=
      Source: is-ESUKM.tmp.2.drString found in binary or memory: http://crl4.digicert.com/sha2-assured-ts.crl0
      Source: is-N7JEQ.tmp.2.drString found in binary or memory: http://crl4.digicert.com/sha2-ha-cs-g1.crl0L
      Source: is-80EU7.tmp.2.dr, is-17HNF.tmp.2.dr, is-EANN9.tmp.2.drString found in binary or memory: http://crt.sectigo.com/SectigoPublicCodeSigningCAEVR36.crt0#
      Source: is-80EU7.tmp.2.dr, is-17HNF.tmp.2.dr, is-EANN9.tmp.2.drString found in binary or memory: http://crt.sectigo.com/SectigoPublicCodeSigningRootR46.p7c0#
      Source: FastestVPN.exe, 00000016.00000002.4088567969.000000000B02C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en
      Source: FastestVPN.exe, 00000016.00000002.4088567969.000000000B054000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
      Source: FastestVPN.exe, 00000016.00000002.4021722402.0000000002AE3000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://defaultcontainer/FastestVPN;component/Assets/Fonts/outfit-variablefont_wght.ttf
      Source: FastestVPN.exe, 00000016.00000002.4021722402.0000000002AE3000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://defaultcontainer/FastestVPN;component/Assets/Fonts/outfit-variablefont_wght.ttfd
      Source: svchost.exe, 0000001F.00000003.2655239463.000001E6FF660000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
      Source: FastestVPN.exe, 00000034.00000002.3082000495.00000000029D1000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://foo.com/foo
      Source: ComDebug.exe, 00000006.00000002.4017666798.0000000002892000.00000004.00001000.00020000.00000000.sdmp, ComDebug.exe, 00000006.00000002.4022885088.0000000004DCC000.00000004.00000020.00020000.00000000.sdmp, ComDebug.exe, 00000006.00000002.4017666798.0000000002821000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://help.yahoo.com/help/us/ysearch/slurp)
      Source: FastestVPN.exe, FastestVPN.exe, 00000016.00000002.4058632607.00000000058D2000.00000002.00000001.01000000.0000001C.sdmpString found in binary or memory: http://ip-api.com/json
      Source: FastestVPN.WindowsService.exe, 00000032.00000002.4032701232.0000000004432000.00000002.00000001.01000000.0000003F.sdmpString found in binary or memory: http://james.newtonking.com/projects/json
      Source: powershell.exe, 0000001D.00000002.2773499593.0000000006008000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://nuget.org/NuGet.exe
      Source: is-80EU7.tmp.2.dr, is-17HNF.tmp.2.dr, is-EANN9.tmp.2.drString found in binary or memory: http://ocsp.comodoca.com0
      Source: OqAVRCkQ3T.tmp, 00000002.00000003.3069897606.0000000005580000.00000004.00001000.00020000.00000000.sdmp, OqAVRCkQ3T.tmp, 00000002.00000002.3098599633.000000000018C000.00000004.00000010.00020000.00000000.sdmp, ComDebug.exe, 00000006.00000002.4022885088.0000000004DCC000.00000004.00000020.00020000.00000000.sdmp, FastestVPN.exe, 00000016.00000002.4093428327.000000000B1B4000.00000004.00000020.00020000.00000000.sdmp, FastestVPN.exe, 00000016.00000002.4075462425.0000000008758000.00000004.00000020.00020000.00000000.sdmp, FastestVPN.WindowsService.exe, 0000002D.00000002.3044325400.00000000058C0000.00000004.00000020.00020000.00000000.sdmp, FastestVPN.WindowsService.exe, 0000002D.00000002.3041458929.0000000002EF5000.00000004.00000800.00020000.00000000.sdmp, FastestVPN.WindowsService.exe, 0000002D.00000002.3039966230.000000000118C000.00000004.00000020.00020000.00000000.sdmp, is-0B265.tmp.2.dr, is-DQ4HF.tmp.2.dr, is-NJH6K.tmp.2.dr, is-CVBBG.tmp.2.dr, is-Q6C5B.tmp.2.dr, is-NGC8I.tmp.2.dr, is-L0D1P.tmp.2.dr, is-AC86P.tmp.2.drString found in binary or memory: http://ocsp.digicert.com0
      Source: OqAVRCkQ3T.tmp, 00000002.00000003.3069897606.0000000005580000.00000004.00001000.00020000.00000000.sdmp, OqAVRCkQ3T.tmp, 00000002.00000002.3098599633.000000000018C000.00000004.00000010.00020000.00000000.sdmp, ComDebug.exe, 00000006.00000002.4022885088.0000000004DCC000.00000004.00000020.00020000.00000000.sdmp, xcopy.exe, 00000022.00000002.2663759074.000001F775D11000.00000004.00000020.00020000.00000000.sdmp, FastestVPN.WindowsService.exe, 00000027.00000002.3018526379.00000000026E6000.00000004.00000800.00020000.00000000.sdmp, FastestVPN.WindowsService.exe, 0000002D.00000002.3039966230.000000000118C000.00000004.00000020.00020000.00000000.sdmp, is-0B265.tmp.2.dr, is-DQ4HF.tmp.2.dr, is-NJH6K.tmp.2.dr, is-CVBBG.tmp.2.dr, is-Q6C5B.tmp.2.dr, is-NGC8I.tmp.2.dr, is-L0D1P.tmp.2.dr, is-AC86P.tmp.2.dr, is-HM6P4.tmp.2.drString found in binary or memory: http://ocsp.digicert.com0A
      Source: OqAVRCkQ3T.tmp, 00000002.00000003.3069897606.0000000005580000.00000004.00001000.00020000.00000000.sdmp, xcopy.exe, 00000022.00000002.2663759074.000001F775D11000.00000004.00000020.00020000.00000000.sdmp, is-ESUKM.tmp.2.dr, is-HM6P4.tmp.2.drString found in binary or memory: http://ocsp.digicert.com0C
      Source: xcopy.exe, 00000022.00000002.2663759074.000001F775D11000.00000004.00000020.00020000.00000000.sdmp, is-ESUKM.tmp.2.dr, is-HM6P4.tmp.2.drString found in binary or memory: http://ocsp.digicert.com0H
      Source: xcopy.exe, 00000022.00000002.2663759074.000001F775D11000.00000004.00000020.00020000.00000000.sdmp, is-ESUKM.tmp.2.dr, is-N7JEQ.tmp.2.dr, is-HM6P4.tmp.2.drString found in binary or memory: http://ocsp.digicert.com0I
      Source: OqAVRCkQ3T.tmp, 00000002.00000003.3069897606.0000000005580000.00000004.00001000.00020000.00000000.sdmp, is-ESUKM.tmp.2.drString found in binary or memory: http://ocsp.digicert.com0O
      Source: is-N7JEQ.tmp.2.drString found in binary or memory: http://ocsp.digicert.com0R
      Source: OqAVRCkQ3T.tmp, 00000002.00000003.3069897606.0000000005580000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://ocsp.digicert.com0X
      Source: OqAVRCkQ3T.tmp, 00000002.00000003.3069897606.0000000005580000.00000004.00001000.00020000.00000000.sdmp, OqAVRCkQ3T.tmp, 00000002.00000002.3098599633.000000000018C000.00000004.00000010.00020000.00000000.sdmp, ComDebug.exe, 00000006.00000002.4022885088.0000000004DCC000.00000004.00000020.00020000.00000000.sdmp, FastestVPN.WindowsService.exe, 0000002D.00000002.3044325400.00000000058C0000.00000004.00000020.00020000.00000000.sdmp, FastestVPN.WindowsService.exe, 0000002D.00000002.3041213432.0000000001570000.00000004.00000020.00020000.00000000.sdmp, FastestVPN.WindowsService.exe, 0000002D.00000002.3039966230.000000000118C000.00000004.00000020.00020000.00000000.sdmp, is-0B265.tmp.2.dr, is-DQ4HF.tmp.2.dr, is-80EU7.tmp.2.dr, is-NJH6K.tmp.2.dr, is-CVBBG.tmp.2.dr, is-17HNF.tmp.2.dr, is-EANN9.tmp.2.dr, is-Q6C5B.tmp.2.dr, is-NGC8I.tmp.2.dr, is-L0D1P.tmp.2.dr, is-AC86P.tmp.2.drString found in binary or memory: http://ocsp.entrust.net00
      Source: OqAVRCkQ3T.tmp, 00000002.00000003.3069897606.0000000005580000.00000004.00001000.00020000.00000000.sdmp, OqAVRCkQ3T.tmp, 00000002.00000002.3098599633.000000000018C000.00000004.00000010.00020000.00000000.sdmp, ComDebug.exe, 00000006.00000002.4022885088.0000000004DCC000.00000004.00000020.00020000.00000000.sdmp, FastestVPN.WindowsService.exe, 0000002D.00000002.3041213432.0000000001570000.00000004.00000020.00020000.00000000.sdmp, FastestVPN.WindowsService.exe, 0000002D.00000002.3039966230.000000000118C000.00000004.00000020.00020000.00000000.sdmp, is-0B265.tmp.2.dr, is-DQ4HF.tmp.2.dr, is-80EU7.tmp.2.dr, is-NJH6K.tmp.2.dr, is-CVBBG.tmp.2.dr, is-17HNF.tmp.2.dr, is-EANN9.tmp.2.dr, is-Q6C5B.tmp.2.dr, is-NGC8I.tmp.2.dr, is-L0D1P.tmp.2.dr, is-AC86P.tmp.2.drString found in binary or memory: http://ocsp.entrust.net01
      Source: OqAVRCkQ3T.tmp, 00000002.00000003.3069897606.0000000005580000.00000004.00001000.00020000.00000000.sdmp, OqAVRCkQ3T.tmp, 00000002.00000002.3098599633.000000000018C000.00000004.00000010.00020000.00000000.sdmp, ComDebug.exe, 00000006.00000002.4022885088.0000000004DCC000.00000004.00000020.00020000.00000000.sdmp, FastestVPN.exe, 00000016.00000002.4071204873.0000000008648000.00000004.00000020.00020000.00000000.sdmp, FastestVPN.WindowsService.exe, 0000002D.00000002.3044325400.00000000058C0000.00000004.00000020.00020000.00000000.sdmp, FastestVPN.WindowsService.exe, 0000002D.00000002.3041213432.0000000001570000.00000004.00000020.00020000.00000000.sdmp, is-0B265.tmp.2.dr, is-DQ4HF.tmp.2.dr, is-80EU7.tmp.2.dr, is-NJH6K.tmp.2.dr, is-CVBBG.tmp.2.dr, is-17HNF.tmp.2.dr, is-EANN9.tmp.2.dr, is-Q6C5B.tmp.2.dr, is-NGC8I.tmp.2.dr, is-L0D1P.tmp.2.dr, is-AC86P.tmp.2.drString found in binary or memory: http://ocsp.entrust.net03
      Source: is-80EU7.tmp.2.dr, is-17HNF.tmp.2.dr, is-EANN9.tmp.2.drString found in binary or memory: http://ocsp.sectigo.com0
      Source: is-80EU7.tmp.2.dr, is-17HNF.tmp.2.dr, is-EANN9.tmp.2.drString found in binary or memory: http://ocsp.sectigo.com0.
      Source: is-N7JEQ.tmp.2.drString found in binary or memory: http://ocsp.thawte.com0
      Source: powershell.exe, 0000001D.00000002.2764855375.00000000050F1000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://pesterbdd.com/images/Pester.png
      Source: FastestVPN.WindowsService.exe, 0000002D.00000002.3041458929.0000000002EF5000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://schemas.datacontract.org
      Source: FastestVPN.WindowsService.exe, 0000002D.00000002.3041458929.0000000002EF5000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://schemas.datacontract.org/2004/07/
      Source: FastestVPN.WindowsService.exe, 0000002D.00000002.3041458929.0000000002EF5000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://schemas.datacontract.org/2004/07/System.ServiceProcess
      Source: FastestVPN.WindowsService.exe, 0000002D.00000002.3041458929.0000000002EF5000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://schemas.datacontract.org/2004/07/System.ServiceProcessd
      Source: FastestVPN.exe, 00000016.00000002.4021722402.0000000002881000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://schemas.xmlsoap.org/soap/encoding/
      Source: FastestVPN.exe, 00000016.00000002.4021722402.0000000002881000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001D.00000002.2764855375.0000000004FA1000.00000004.00000800.00020000.00000000.sdmp, FastestVPN.WindowsService.exe, FastestVPN.WindowsService.exe, 00000032.00000002.4019346826.00000000017E6000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
      Source: FastestVPN.exe, 00000016.00000002.4021722402.0000000002881000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://schemas.xmlsoap.org/wsdl/
      Source: FastestVPN.WindowsService.exe, FastestVPN.WindowsService.exe, 00000027.00000002.3020164102.00000000050A2000.00000002.00000001.01000000.0000002A.sdmpString found in binary or memory: http://signalr.net/
      Source: is-N7JEQ.tmp.2.drString found in binary or memory: http://ts-aia.ws.symantec.com/tss-ca-g2.cer0
      Source: is-N7JEQ.tmp.2.drString found in binary or memory: http://ts-crl.ws.symantec.com/tss-ca-g2.crl0(
      Source: is-N7JEQ.tmp.2.drString found in binary or memory: http://ts-ocsp.ws.symantec.com07
      Source: ComDebug.exe, 00000006.00000000.2563954116.0000000000401000.00000020.00000001.01000000.00000008.sdmp, ComDebug.exe, 00000006.00000002.4022885088.00000000048BD000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://vovsoft.com
      Source: ComDebug.exe, 00000006.00000002.4022885088.0000000004DCC000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://vovsoft.com/
      Source: ComDebug.exe, 00000006.00000000.2563954116.0000000000401000.00000020.00000001.01000000.00000008.sdmp, ComDebug.exe, 00000006.00000002.4022885088.00000000048BD000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://vovsoft.com/blog/how-to-activate-using-license-key/openU
      Source: ComDebug.exe, 00000006.00000000.2563954116.0000000000401000.00000020.00000001.01000000.00000008.sdmp, ComDebug.exe, 00000006.00000002.4022885088.00000000048BD000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://vovsoft.com/blog/how-to-uninstall-vovsoft-software/openU
      Source: ComDebug.exe, 00000006.00000000.2563954116.0000000000401000.00000020.00000001.01000000.00000008.sdmp, ComDebug.exe, 00000006.00000002.4022885088.00000000048BD000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://vovsoft.com/help/
      Source: ComDebug.exe, 00000006.00000000.2563954116.0000000000401000.00000020.00000001.01000000.00000008.sdmp, ComDebug.exe, 00000006.00000002.4022885088.00000000048BD000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://vovsoft.com/openU
      Source: ComDebug.exe, 00000006.00000000.2563954116.0000000000401000.00000020.00000001.01000000.00000008.sdmp, ComDebug.exe, 00000006.00000002.4022885088.00000000048BD000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://vovsoft.comopenS
      Source: ComDebug.exe, 00000006.00000000.2563954116.0000000000401000.00000020.00000001.01000000.00000008.sdmp, ComDebug.exe, 00000006.00000002.4022885088.00000000048BD000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://vovsoft.comopenU
      Source: FastestVPN.exe, 00000016.00000002.4021722402.0000000002881000.00000004.00000800.00020000.00000000.sdmp, FastestVPN.exe, 00000016.00000000.2625434306.00000000005AD000.00000002.00000001.01000000.0000000D.sdmp, FastestVPN.exe, 00000016.00000002.4067532678.0000000005DF2000.00000002.00000001.01000000.0000001E.sdmpString found in binary or memory: http://wpfanimatedgif.codeplex.com
      Source: powershell.exe, 0000001D.00000002.2764855375.00000000050F1000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0.html
      Source: OqAVRCkQ3T.tmp, 00000002.00000003.3069897606.0000000005580000.00000004.00001000.00020000.00000000.sdmp, OqAVRCkQ3T.tmp, 00000002.00000002.3098599633.000000000018C000.00000004.00000010.00020000.00000000.sdmp, ComDebug.exe, 00000006.00000002.4022885088.0000000004DCC000.00000004.00000020.00020000.00000000.sdmp, FastestVPN.exe, 00000016.00000002.4093428327.000000000B1B4000.00000004.00000020.00020000.00000000.sdmp, FastestVPN.exe, 00000016.00000002.4075462425.0000000008758000.00000004.00000020.00020000.00000000.sdmp, FastestVPN.WindowsService.exe, 0000002D.00000002.3044325400.00000000058C0000.00000004.00000020.00020000.00000000.sdmp, FastestVPN.WindowsService.exe, 0000002D.00000002.3041458929.0000000002EF5000.00000004.00000800.00020000.00000000.sdmp, FastestVPN.WindowsService.exe, 0000002D.00000002.3039966230.000000000118C000.00000004.00000020.00020000.00000000.sdmp, is-0B265.tmp.2.dr, is-DQ4HF.tmp.2.dr, is-NJH6K.tmp.2.dr, is-CVBBG.tmp.2.dr, is-Q6C5B.tmp.2.dr, is-NGC8I.tmp.2.dr, is-L0D1P.tmp.2.dr, is-AC86P.tmp.2.drString found in binary or memory: http://www.digicert.com/CPS0
      Source: xcopy.exe, 00000022.00000002.2663759074.000001F775D11000.00000004.00000020.00020000.00000000.sdmp, is-ESUKM.tmp.2.dr, is-HM6P4.tmp.2.drString found in binary or memory: http://www.digicert.com/ssl-cps-repository.htm0
      Source: FastestVPN.exe, 00000016.00000002.4093911697.000000000B1D0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.e-trust.be/CPS/QNcerts
      Source: OqAVRCkQ3T.tmp, 00000002.00000003.3069897606.0000000005580000.00000004.00001000.00020000.00000000.sdmp, OqAVRCkQ3T.tmp, 00000002.00000002.3098599633.000000000018C000.00000004.00000010.00020000.00000000.sdmp, ComDebug.exe, 00000006.00000002.4022885088.0000000004DCC000.00000004.00000020.00020000.00000000.sdmp, FastestVPN.WindowsService.exe, 0000002D.00000002.3041213432.0000000001570000.00000004.00000020.00020000.00000000.sdmp, FastestVPN.WindowsService.exe, 0000002D.00000002.3039966230.000000000118C000.00000004.00000020.00020000.00000000.sdmp, is-0B265.tmp.2.dr, is-DQ4HF.tmp.2.dr, is-80EU7.tmp.2.dr, is-NJH6K.tmp.2.dr, is-CVBBG.tmp.2.dr, is-17HNF.tmp.2.dr, is-EANN9.tmp.2.dr, is-Q6C5B.tmp.2.dr, is-NGC8I.tmp.2.dr, is-L0D1P.tmp.2.dr, is-AC86P.tmp.2.drString found in binary or memory: http://www.entrust.net/rpa0
      Source: OqAVRCkQ3T.tmp, 00000002.00000003.3069897606.0000000005580000.00000004.00001000.00020000.00000000.sdmp, OqAVRCkQ3T.tmp, 00000002.00000002.3098599633.000000000018C000.00000004.00000010.00020000.00000000.sdmp, ComDebug.exe, 00000006.00000002.4022885088.0000000004DCC000.00000004.00000020.00020000.00000000.sdmp, FastestVPN.WindowsService.exe, 0000002D.00000002.3044325400.00000000058C0000.00000004.00000020.00020000.00000000.sdmp, FastestVPN.WindowsService.exe, 0000002D.00000002.3041213432.0000000001570000.00000004.00000020.00020000.00000000.sdmp, FastestVPN.WindowsService.exe, 0000002D.00000002.3039966230.000000000118C000.00000004.00000020.00020000.00000000.sdmp, is-0B265.tmp.2.dr, is-DQ4HF.tmp.2.dr, is-80EU7.tmp.2.dr, is-NJH6K.tmp.2.dr, is-CVBBG.tmp.2.dr, is-17HNF.tmp.2.dr, is-EANN9.tmp.2.dr, is-Q6C5B.tmp.2.dr, is-NGC8I.tmp.2.dr, is-L0D1P.tmp.2.dr, is-AC86P.tmp.2.drString found in binary or memory: http://www.entrust.net/rpa03
      Source: ComDebug.exe, 00000006.00000002.4017666798.000000000287D000.00000004.00001000.00020000.00000000.sdmp, ComDebug.exe, 00000006.00000002.4022885088.0000000004DCC000.00000004.00000020.00020000.00000000.sdmp, ComDebug.exe, 00000006.00000002.4017666798.0000000002821000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://www.google.com/bot.html)
      Source: ComDebug.exe, 00000006.00000002.4015584548.0000000000E51000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.google.com/bot.html)Mozilla/5.0
      Source: FastestVPN.exe, FastestVPN.exe, 00000016.00000002.4059969196.0000000005AAA000.00000002.00000001.01000000.0000001D.sdmp, FastestVPN.exe, 00000016.00000002.4059523377.0000000005A92000.00000002.00000001.01000000.0000001D.sdmpString found in binary or memory: http://www.hardcodet.net/projects/wpf-notifyicon
      Source: FastestVPN.exe, 00000016.00000002.4059523377.0000000005A92000.00000002.00000001.01000000.0000001D.sdmp, FastestVPN.exe, 00000016.00000000.2625434306.00000000005AD000.00000002.00000001.01000000.0000000D.sdmpString found in binary or memory: http://www.hardcodet.net/taskbar
      Source: ComDebug.exe, 00000006.00000002.4017666798.0000000002850000.00000004.00001000.00020000.00000000.sdmp, ComDebug.exe, 00000006.00000000.2563954116.0000000000401000.00000020.00000001.01000000.00000008.sdmp, ComDebug.exe, 00000006.00000002.4022885088.00000000048BD000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.indyproject.org/
      Source: is-EANN9.tmp.2.drString found in binary or memory: http://www.openssl.org/V
      Source: is-EANN9.tmp.2.drString found in binary or memory: http://www.openssl.org/support/faq.html
      Source: is-EANN9.tmp.2.drString found in binary or memory: http://www.openssl.org/support/faq.htmlRAND
      Source: ComDebug.exe, 00000006.00000000.2563954116.0000000000401000.00000020.00000001.01000000.00000008.sdmp, ComDebug.exe, 00000006.00000002.4022885088.00000000048BD000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.somewhere.org
      Source: FastestVPN.WindowsService.exe, 0000002D.00000002.3041458929.0000000002EF5000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.w3.o
      Source: powershell.exe, 0000001D.00000002.2764855375.0000000004FA1000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://aka.ms/pscore6lB
      Source: is-3TGVV.tmp.2.drString found in binary or memory: https://aka.ms/signalr-core-differences
      Source: FastestVPN.exe, FastestVPN.exe, 00000016.00000002.4057691774.0000000005872000.00000002.00000001.01000000.00000017.sdmpString found in binary or memory: https://api.fastestvpn.com//v2/chat
      Source: FastestVPN.exe, FastestVPN.exe, 00000016.00000002.4058632607.00000000058D2000.00000002.00000001.01000000.0000001C.sdmpString found in binary or memory: https://api.fastestvpn.com/v2
      Source: powershell.exe, 0000001D.00000002.2773499593.0000000006008000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://contoso.com/
      Source: powershell.exe, 0000001D.00000002.2773499593.0000000006008000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://contoso.com/Icon
      Source: powershell.exe, 0000001D.00000002.2773499593.0000000006008000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://contoso.com/License
      Source: FastestVPN.exe, FastestVPN.exe, 00000016.00000002.4057691774.0000000005872000.00000002.00000001.01000000.00000017.sdmpString found in binary or memory: https://fastestvpn.com/
      Source: FastestVPN.exe, FastestVPN.exe, 00000016.00000002.4057691774.0000000005872000.00000002.00000001.01000000.00000017.sdmpString found in binary or memory: https://fastestvpn.com/about
      Source: FastestVPN.exe, FastestVPN.exe, 00000016.00000002.4057691774.0000000005872000.00000002.00000001.01000000.00000017.sdmpString found in binary or memory: https://fastestvpn.com/buy-vpn
      Source: FastestVPN.exe, FastestVPN.exe, 00000016.00000002.4057691774.0000000005872000.00000002.00000001.01000000.00000017.sdmpString found in binary or memory: https://fastestvpn.com/buy-vpn?device=windows
      Source: FastestVPN.exe, FastestVPN.exe, 00000016.00000002.4057691774.0000000005872000.00000002.00000001.01000000.00000017.sdmpString found in binary or memory: https://fastestvpn.com/faq?device=windows
      Source: FastestVPN.exe, FastestVPN.exe, 00000016.00000002.4057691774.0000000005872000.00000002.00000001.01000000.00000017.sdmpString found in binary or memory: https://fastestvpn.com/password/reset
      Source: FastestVPN.exe, FastestVPN.exe, 00000016.00000002.4057691774.0000000005872000.00000002.00000001.01000000.00000017.sdmpString found in binary or memory: https://fastestvpn.com/privacy-policy
      Source: FastestVPN.exe, FastestVPN.exe, 00000016.00000002.4057691774.0000000005872000.00000002.00000001.01000000.00000017.sdmpString found in binary or memory: https://fastestvpn.com/terms-of-service?device=windows
      Source: FastestVPN.exeString found in binary or memory: https://fastestvpn.com/upgrade?t=ndelyNN7yduAc
      Source: FastestVPN.exe, 00000016.00000002.4058237613.00000000058B2000.00000002.00000001.01000000.0000001A.sdmpString found in binary or memory: https://fastestvpn.com/upgrade?t=ndelyNN7yduAc5Enjoy
      Source: svchost.exe, 0000001F.00000003.2655239463.000001E6FF6BE000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://g.live.com/odclientsettings/Prod1C:
      Source: svchost.exe, 0000001F.00000003.2655239463.000001E6FF660000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://g.live.com/odclientsettings/ProdV21C:
      Source: FastestVPN.exe, 00000016.00000002.4060295521.0000000005C14000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.co
      Source: OqAVRCkQ3T.tmp, 00000002.00000003.3069897606.0000000005580000.00000004.00001000.00020000.00000000.sdmp, FastestVPN.WindowsService.exe, FastestVPN.WindowsService.exe, 00000032.00000002.4032701232.0000000004432000.00000002.00000001.01000000.0000003F.sdmpString found in binary or memory: https://github.com/JamesNK/Newtonsoft.Json
      Source: FastestVPN.WindowsService.exe, 00000032.00000002.4019346826.000000000183D000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://github.com/JamesNK/Newtonsoft.Jsond
      Source: FastestVPN.exe, 00000016.00000000.2625434306.00000000003E2000.00000002.00000001.01000000.0000000D.sdmp, FastestVPN.exe, 00000016.00000002.4079933992.0000000008A62000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://github.com/Outfitio/Outfit-Fonts)
      Source: FastestVPN.exe, 00000016.00000002.4060295521.0000000005C14000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/Outfitio/Outfit-Fonts)ntsL)
      Source: FastestVPN.exe, 00000016.00000002.4060295521.0000000005C14000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/Outfitio/Outfit-Fonts)on
      Source: FastestVPN.exe, 00000016.00000002.4060295521.0000000005C14000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/Outfitio/Outfit-Fonts)tVPT)c
      Source: powershell.exe, 0000001D.00000002.2764855375.00000000050F1000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://github.com/Pester/Pester
      Source: FastestVPN.WindowsService.exe, FastestVPN.WindowsService.exe, 00000027.00000002.3020164102.00000000050A2000.00000002.00000001.01000000.0000002A.sdmp, is-3TGVV.tmp.2.drString found in binary or memory: https://github.com/SignalR/SignalR/tree/7f53f266daf1aad3dabb1b6d7a71d4c1501ec8dc
      Source: FastestVPN.WindowsService.exe, 00000032.00000002.4019346826.000000000183D000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://github.com/SignalR/SignalR/tree/7f53f266daf1aad3dabb1b6d7a71d4c1501ec8dcd
      Source: FastestVPN.WindowsService.exe, FastestVPN.WindowsService.exe, 00000032.00000002.4029624292.0000000004322000.00000002.00000001.01000000.0000003D.sdmp, FastestVPN.WindowsService.exe, 00000032.00000002.4026934919.00000000041D2000.00000002.00000001.01000000.0000003A.sdmp, FastestVPN.WindowsService.exe, 00000032.00000002.4028217019.0000000004282000.00000002.00000001.01000000.0000003C.sdmp, FastestVPN.WindowsService.exe, 00000032.00000002.4030619936.0000000004352000.00000002.00000001.01000000.0000003E.sdmp, FastestVPN.WindowsService.exe, 00000032.00000002.4026203269.00000000041A2000.00000002.00000001.01000000.00000039.sdmp, FastestVPN.WindowsService.exe, 00000032.00000002.4025246226.0000000004152000.00000002.00000001.01000000.00000037.sdmpString found in binary or memory: https://github.com/aspnet/AspNetKatana
      Source: FastestVPN.WindowsService.exe, 00000032.00000002.4019346826.000000000183D000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://github.com/aspnet/AspNetKatanad
      Source: FastestVPN.exeString found in binary or memory: https://github.com/dotnet/corefx/tree/7601f4f6225089ff
      Source: FastestVPN.exe, FastestVPN.exe, 00000016.00000002.4056758757.00000000054D2000.00000002.00000001.01000000.00000016.sdmpString found in binary or memory: https://github.com/dotnet/corefx/tree/7601f4f6225089ffb291dc7d58293c7bbf5c5d4f
      Source: FastestVPN.exe, 00000016.00000002.4056758757.00000000054D2000.00000002.00000001.01000000.00000016.sdmp, FastestVPN.exe, 00000016.00000002.4102331799.000000000BE22000.00000002.00000001.01000000.00000034.sdmpString found in binary or memory: https://github.com/dotnet/corefx/tree/7601f4f6225089ffb291dc7d58293c7bbf5c5d4f8
      Source: FastestVPN.exeString found in binary or memory: https://github.com/dotnet/corefx/tree/c6cf790234e
      Source: FastestVPN.exe, FastestVPN.exe, 00000016.00000002.4101032372.000000000BDD2000.00000002.00000001.01000000.00000033.sdmpString found in binary or memory: https://github.com/dotnet/corefx/tree/c6cf790234e063b855fcdb50f3fb1b3cfac73275
      Source: FastestVPN.exe, 00000016.00000002.4101032372.000000000BDD2000.00000002.00000001.01000000.00000033.sdmpString found in binary or memory: https://github.com/dotnet/corefx/tree/c6cf790234e063b855fcdb50f3fb1b3cfac732758
      Source: FastestVPN.exe, FastestVPN.exe, 00000016.00000002.4056210634.00000000054A2000.00000002.00000001.01000000.00000014.sdmp, FastestVPN.exe, 00000016.00000002.4055392390.0000000005342000.00000002.00000001.01000000.00000013.sdmp, FastestVPN.exe, 00000016.00000002.4056338798.00000000054B2000.00000002.00000001.01000000.00000015.sdmp, is-RP1DP.tmp.2.drString found in binary or memory: https://github.com/dotnet/runtime
      Source: FastestVPN.exe, FastestVPN.exe, 00000016.00000002.4100328999.000000000BD62000.00000002.00000001.01000000.00000032.sdmp, FastestVPN.exe, 00000016.00000002.4099109913.000000000BCF2000.00000002.00000001.01000000.00000030.sdmp, FastestVPN.exe, 00000016.00000002.4100015977.000000000BD42000.00000002.00000001.01000000.00000031.sdmp, is-AC86P.tmp.2.drString found in binary or memory: https://github.com/ericsink/SQLitePCL.raw
      Source: FastestVPN.exe, 00000016.00000002.4100328999.000000000BD62000.00000002.00000001.01000000.00000032.sdmp, is-AC86P.tmp.2.drString found in binary or memory: https://github.com/ericsink/SQLitePCL.rawH
      Source: FastestVPN.exe, 00000016.00000002.4100015977.000000000BD42000.00000002.00000001.01000000.00000031.sdmpString found in binary or memory: https://github.com/ericsink/SQLitePCL.rawX
      Source: FastestVPN.exe, FastestVPN.exe, 00000016.00000002.4059523377.0000000005A92000.00000002.00000001.01000000.0000001D.sdmpString found in binary or memory: https://github.com/hardcodet/wpf-notifyicon
      Source: FastestVPN.exe, 00000016.00000002.4059523377.0000000005A92000.00000002.00000001.01000000.0000001D.sdmpString found in binary or memory: https://github.com/hardcodet/wpf-notifyicon.
      Source: is-CVBBG.tmp.2.drString found in binary or memory: https://github.com/tmenier/Flurl.git
      Source: is-CVBBG.tmp.2.drString found in binary or memory: https://github.com/tmenier/Flurl.git5
      Source: FastestVPN.exe, FastestVPN.exe, 00000016.00000002.4078599339.0000000008862000.00000002.00000001.01000000.0000002D.sdmpString found in binary or memory: https://in.appcenter.ms
      Source: FastestVPN.exe, 00000016.00000002.4078599339.0000000008862000.00000002.00000001.01000000.0000002D.sdmpString found in binary or memory: https://in.appcenter.ms./logs?api-version=1.0.0
      Source: OqAVRCkQ3T.exeString found in binary or memory: https://jrsoftware.org/ishelp/index.php?topic=setupcmdlineSetupU
      Source: powershell.exe, 0000001D.00000002.2773499593.0000000006008000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://nuget.org/nuget.exe
      Source: FastestVPN.exe, 00000016.00000002.4079933992.0000000008A62000.00000004.00000800.00020000.00000000.sdmp, FastestVPN.exe, 00000016.00000002.4060295521.0000000005C08000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://scripts.sil.org/OFL
      Source: FastestVPN.exe, 00000016.00000002.4060295521.0000000005C08000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://scripts.sil.org/OFLOFL
      Source: FastestVPN.exe, 00000016.00000000.2625434306.00000000003E2000.00000002.00000001.01000000.0000000D.sdmpString found in binary or memory: https://scripts.sil.org/OFLThis
      Source: FastestVPN.exe, 00000016.00000000.2625434306.00000000003E2000.00000002.00000001.01000000.0000000D.sdmpString found in binary or memory: https://scripts.sil.org/OFLwww.rfuenzalida.comwww.fragtypefoundry.xyzRodrigo
      Source: is-80EU7.tmp.2.dr, is-17HNF.tmp.2.dr, is-EANN9.tmp.2.drString found in binary or memory: https://sectigo.com/CPS0
      Source: ComDebug.exe, 00000006.00000002.4022885088.0000000004DCC000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://vovsoft.com
      Source: ComDebug.exe, 00000006.00000000.2563954116.0000000000401000.00000020.00000001.01000000.00000008.sdmp, ComDebug.exe, 00000006.00000002.4022885088.00000000048BD000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://vovsoft.com/blog/credits-and-acknowledgements/open
      Source: ComDebug.exe, 00000006.00000002.4022885088.0000000004DCC000.00000004.00000020.00020000.00000000.sdmp, ComDebug.exe, 00000006.00000002.4017666798.0000000002821000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://vovsoft.com/files/batch-url-downloader.exe
      Source: ComDebug.exe, 00000006.00000002.4022885088.0000000004DCC000.00000004.00000020.00020000.00000000.sdmp, ComDebug.exe, 00000006.00000002.4017666798.0000000002821000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://vovsoft.com/files/text-edit-plus.exe
      Source: ComDebug.exe, 00000006.00000002.4022885088.0000000004DCC000.00000004.00000020.00020000.00000000.sdmp, ComDebug.exe, 00000006.00000002.4017666798.0000000002821000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://vovsoft.com/files/vov-sticky-notes.exe
      Source: xcopy.exe, 00000022.00000002.2663759074.000001F775D11000.00000004.00000020.00020000.00000000.sdmp, is-ESUKM.tmp.2.dr, is-N7JEQ.tmp.2.dr, is-HM6P4.tmp.2.drString found in binary or memory: https://www.digicert.com/CPS0
      Source: OqAVRCkQ3T.tmp, 00000002.00000003.3069897606.0000000005580000.00000004.00001000.00020000.00000000.sdmp, OqAVRCkQ3T.tmp, 00000002.00000002.3098599633.000000000018C000.00000004.00000010.00020000.00000000.sdmp, ComDebug.exe, 00000006.00000002.4022885088.0000000004DCC000.00000004.00000020.00020000.00000000.sdmp, FastestVPN.exe, 00000016.00000002.4071204873.0000000008648000.00000004.00000020.00020000.00000000.sdmp, FastestVPN.WindowsService.exe, 0000002D.00000002.3044325400.00000000058C0000.00000004.00000020.00020000.00000000.sdmp, FastestVPN.WindowsService.exe, 0000002D.00000002.3041213432.0000000001570000.00000004.00000020.00020000.00000000.sdmp, is-0B265.tmp.2.dr, is-DQ4HF.tmp.2.dr, is-80EU7.tmp.2.dr, is-NJH6K.tmp.2.dr, is-CVBBG.tmp.2.dr, is-17HNF.tmp.2.dr, is-EANN9.tmp.2.dr, is-Q6C5B.tmp.2.dr, is-NGC8I.tmp.2.dr, is-L0D1P.tmp.2.dr, is-AC86P.tmp.2.drString found in binary or memory: https://www.entrust.net/rpa0
      Source: OqAVRCkQ3T.exe, 00000000.00000003.3102125657.0000000002336000.00000004.00001000.00020000.00000000.sdmp, OqAVRCkQ3T.exe, 00000000.00000003.2147099573.00000000027F0000.00000004.00001000.00020000.00000000.sdmp, OqAVRCkQ3T.tmp, 00000002.00000003.2152152914.00000000033B0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://www.fastestvpn.com/
      Source: OqAVRCkQ3T.exe, 00000000.00000003.2148424618.00000000027F0000.00000004.00001000.00020000.00000000.sdmp, OqAVRCkQ3T.exe, 00000000.00000003.2148872656.000000007FB7B000.00000004.00001000.00020000.00000000.sdmp, OqAVRCkQ3T.tmp, 00000002.00000000.2150644096.0000000000401000.00000020.00000001.01000000.00000004.sdmpString found in binary or memory: https://www.innosetup.com/
      Source: OqAVRCkQ3T.tmp, 00000002.00000003.3069897606.0000000005580000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://www.newtonsoft.com/json
      Source: FastestVPN.WindowsService.exe, 00000032.00000002.4032701232.0000000004432000.00000002.00000001.01000000.0000003F.sdmpString found in binary or memory: https://www.newtonsoft.com/jsonschema
      Source: OqAVRCkQ3T.tmp, 00000002.00000003.3069897606.0000000005580000.00000004.00001000.00020000.00000000.sdmp, FastestVPN.WindowsService.exe, FastestVPN.WindowsService.exe, 00000032.00000002.4032701232.0000000004432000.00000002.00000001.01000000.0000003F.sdmpString found in binary or memory: https://www.nuget.org/packages/Newtonsoft.Json.Bson
      Source: OqAVRCkQ3T.exe, 00000000.00000003.2148424618.00000000027F0000.00000004.00001000.00020000.00000000.sdmp, OqAVRCkQ3T.exe, 00000000.00000003.2148872656.000000007FB7B000.00000004.00001000.00020000.00000000.sdmp, OqAVRCkQ3T.tmp, 00000002.00000000.2150644096.0000000000401000.00000020.00000001.01000000.00000004.sdmpString found in binary or memory: https://www.remobjects.com/ps
      Source: OqAVRCkQ3T.tmp, 00000002.00000003.3069897606.0000000005580000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://www.wireguard.com/donations/key
      Source: OqAVRCkQ3T.tmp, 00000002.00000003.3069897606.0000000005580000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://www.wireguard.com/initSpan:
      Source: OqAVRCkQ3T.tmp, 00000002.00000003.3069897606.0000000005580000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: &Configuration:,M3.2.0,M11.1.0/managerservice476837158203125: cannot parse <invalid Value>ASCII_Hex_DigitAbout WireGuardAddDllDirectoryAddresses: NoneCLSIDFromStringCallWindowProcWCreateHardLinkWCreatePopupMenuCreateWindowExWDeviceIoControlDialogBoxParamWDragAcceptFilesDrawThemeTextExDuplicateHandleExcludeClipRectFailed to find Failed to load FindNextVolumeWFindVolumeCloseFlushViewOfFileFwpmuserOpen0FwpmFreeMemory0GdiplusShutdownGetActiveWindowGetAdaptersInfoGetCommTimeoutsGetCommandLineWGetDpiForWindowGetEnhMetaFileWGetModuleHandleGetMonitorInfoWGetProcessTimesGetRawInputDataGetSecurityInfoGetStartupInfoWGetTextMetricsWGetThreadLocaleHanifi_RohingyaImpersonateSelfInsertMenuItemWInvalid key: %vIsWindowEnabledIsWindowVisibleIsWow64Process2NTSTATUS 0x%08xNotTrueTypeFontOleUninitializeOpenThreadTokenOther_LowercaseOther_UppercasePlayEnhMetaFilePostQuitMessageProcess32FirstWProfileNotFoundPsalter_PahlaviPublicKey = %smemstr_91381287-d
      Source: C:\Windows\System32\drvinst.exeFile created: C:\Windows\System32\DriverStore\Temp\{eba04833-fdea-4f40-ac46-b79bff73f8ea}\tap0901.cat (copy)Jump to dropped file
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpFile created: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\is-63E5N.tmpJump to dropped file
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpFile created: C:\Program Files\FastestVPN\Resources\driver\windows10\i386\is-SJ7I7.tmpJump to dropped file
      Source: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exeFile created: C:\Users\user\AppData\Local\Temp\{4cb0eb0d-a103-7c4c-aedf-5caef9610c0c}\tap0901.cat (copy)Jump to dropped file
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpFile created: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tap0901.cat (copy)Jump to dropped file
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpFile created: C:\Program Files\FastestVPN\Resources\driver\windows10\i386\tap0901.cat (copy)Jump to dropped file
      Source: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exeFile created: C:\Users\user\AppData\Local\Temp\{4cb0eb0d-a103-7c4c-aedf-5caef9610c0c}\SETB0C2.tmpJump to dropped file
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpFile created: C:\Program Files\FastestVPN\Resources\driver\windows\i386\tap0901.cat (copy)Jump to dropped file
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpFile created: C:\Program Files\FastestVPN\Resources\driver\windows\amd64\is-PS4TM.tmpJump to dropped file
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpFile created: C:\Program Files\FastestVPN\Resources\driver\windows\amd64\tap0901.cat (copy)Jump to dropped file
      Source: C:\Windows\System32\drvinst.exeFile created: C:\Windows\System32\DriverStore\Temp\{eba04833-fdea-4f40-ac46-b79bff73f8ea}\SETB297.tmpJump to dropped file
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpFile created: C:\Program Files\FastestVPN\Resources\driver\windows\i386\is-ESUKM.tmpJump to dropped file
      Source: C:\Program Files\FastestVPN\FastestVPN.exeFile created: C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F2E248BEDDBB2D85122423C41028BFD4Jump to dropped file

      Spam, unwanted Advertisements and Ransom Demands

      barindex
      Reads the Security eventlog
      Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeKey opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\Security
      Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeKey opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\Security
      Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeKey opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\Security\FastestVPNService
      Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeKey opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\Security
      Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeKey opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\Security
      Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeKey opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\Security
      Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeKey opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\Security
      Reads the System eventlog
      Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeKey opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\System
      Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeKey opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\System
      Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeKey opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\System
      Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeKey opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\System
      Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeKey opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\System
      Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeKey opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\System\Service1
      Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeKey opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\System
      Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeKey opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\System\Service1

      System Summary

      barindex
      .NET source code contains very large strings
      Source: is-M7EC0.tmp.2.dr, WelcomePage.csLong String: Length: 14757
      Source: C:\Program Files\FastestVPN\Resources\ComDebug.exeCode function: 6_2_007A5076 NtQuerySystemInformation,6_2_007A5076
      Source: C:\Program Files\FastestVPN\Resources\sp\release\nfregdrv.exeCode function: 35_2_10014000: ?nf_getDriverType@nfapi@@YAKXZ,EnterCriticalSection,LeaveCriticalSection,DeviceIoControl,LeaveCriticalSection,LeaveCriticalSection,35_2_10014000
      Source: C:\Program Files\FastestVPN\Resources\sp\release\nfregdrv.exeCode function: 35_2_100134A0 ?nf_unRegisterDriver@nfapi@@YA?AW4_NF_STATUS@@PBD@Z,OpenSCManagerA,OpenServiceA,DeleteService,GetLastError,CloseServiceHandle,CloseServiceHandle,GetLastError,CloseServiceHandle,GetLastError,SetLastError,35_2_100134A0
      Source: C:\Windows\System32\xcopy.exeFile created: C:\Windows\system32\drivers\fastestvpndriver.sys
      Source: C:\Windows\System32\drvinst.exeFile created: C:\Windows\System32\DriverStore\Temp\{eba04833-fdea-4f40-ac46-b79bff73f8ea}Jump to behavior
      Source: C:\Windows\System32\drvinst.exeFile created: C:\Windows\System32\DriverStore\FileRepository\oemvista.inf_amd64_6d4bec28a2ef0cdfJump to behavior
      Source: C:\Windows\System32\drvinst.exeFile created: C:\Windows\System32\DriverStore\drvstore.tmpJump to behavior
      Source: C:\Windows\System32\drvinst.exeFile created: C:\Windows\inf\oem4.infJump to behavior
      Source: C:\Windows\System32\drvinst.exeFile created: C:\Windows\System32\drivers\SETBA95.tmpJump to behavior
      Source: C:\Windows\System32\drvinst.exeFile created: C:\Windows\System32\drivers\SETBA95.tmpJump to behavior
      Source: C:\Windows\System32\svchost.exeFile created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp
      Source: C:\Windows\System32\xcopy.exeFile created: C:\Windows\system32\drivers\fastestvpndriver.sys
      Source: C:\Windows\System32\drvinst.exeFile deleted: C:\Windows\System32\DriverStore\Temp\{eba04833-fdea-4f40-ac46-b79bff73f8ea}\SETB286.tmpJump to behavior
      Source: C:\Program Files\FastestVPN\Resources\ComDebug.exeCode function: 6_2_007A30006_2_007A3000
      Source: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exeCode function: 12_2_00007FF6EC4B41D012_2_00007FF6EC4B41D0
      Source: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exeCode function: 12_2_00007FF6EC4B52E012_2_00007FF6EC4B52E0
      Source: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exeCode function: 12_2_00007FF6EC4D4E5C12_2_00007FF6EC4D4E5C
      Source: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exeCode function: 12_2_00007FF6EC4B703012_2_00007FF6EC4B7030
      Source: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exeCode function: 12_2_00007FF6EC4D4B7C12_2_00007FF6EC4D4B7C
      Source: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exeCode function: 12_2_00007FF6EC4D469812_2_00007FF6EC4D4698
      Source: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exeCode function: 12_2_00007FF6EC4E264012_2_00007FF6EC4E2640
      Source: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exeCode function: 12_2_00007FF6EC4F66E812_2_00007FF6EC4F66E8
      Source: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exeCode function: 12_2_00007FF6EC4EC73812_2_00007FF6EC4EC738
      Source: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exeCode function: 12_2_00007FF6EC4EE81012_2_00007FF6EC4EE810
      Source: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exeCode function: 12_2_00007FF6EC4FA7C012_2_00007FF6EC4FA7C0
      Source: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exeCode function: 12_2_00007FF6EC4D491412_2_00007FF6EC4D4914
      Source: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exeCode function: 12_2_00007FF6EC4F292012_2_00007FF6EC4F2920
      Source: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exeCode function: 12_2_00007FF6EC4D41AC12_2_00007FF6EC4D41AC
      Source: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exeCode function: 12_2_00007FF6EC4F216012_2_00007FF6EC4F2160
      Source: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exeCode function: 12_2_00007FF6EC4EE0B012_2_00007FF6EC4EE0B0
      Source: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exeCode function: 12_2_00007FF6EC5022DC12_2_00007FF6EC5022DC
      Source: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exeCode function: 12_2_00007FF6EC4F434012_2_00007FF6EC4F4340
      Source: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exeCode function: 12_2_00007FF6EC4D443012_2_00007FF6EC4D4430
      Source: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exeCode function: 12_2_00007FF6EC4F83E412_2_00007FF6EC4F83E4
      Source: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exeCode function: 12_2_00007FF6EC4E3F1412_2_00007FF6EC4E3F14
      Source: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exeCode function: 12_2_00007FF6EC4D3F1012_2_00007FF6EC4D3F10
      Source: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exeCode function: 12_2_00007FF6EC4EE0B012_2_00007FF6EC4EE0B0
      Source: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exeCode function: 12_2_00007FF6EC4FA07012_2_00007FF6EC4FA070
      Source: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exeCode function: 12_2_00007FF6EC4D59DC12_2_00007FF6EC4D59DC
      Source: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exeCode function: 12_2_00007FF6EC4F9BC012_2_00007FF6EC4F9BC0
      Source: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exeCode function: 12_2_00007FF6EC4D3C8C12_2_00007FF6EC4D3C8C
      Source: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exeCode function: 12_2_00007FF6EC4EBD1812_2_00007FF6EC4EBD18
      Source: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exeCode function: 12_2_00007FF6EC4D56FC12_2_00007FF6EC4D56FC
      Source: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exeCode function: 12_2_00007FF6EC4F96F012_2_00007FF6EC4F96F0
      Source: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exeCode function: 12_2_00007FF6EC4F115412_2_00007FF6EC4F1154
      Source: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exeCode function: 12_2_00007FF6EC4D515012_2_00007FF6EC4D5150
      Source: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exeCode function: 12_2_00007FF6EC4FD16812_2_00007FF6EC4FD168
      Source: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exeCode function: 12_2_00007FF6EC4BB1FC12_2_00007FF6EC4BB1FC
      Source: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exeCode function: 12_2_00007FF6EC4D543012_2_00007FF6EC4D5430
      Source: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exeCode function: 12_2_00007FF6EC4B13E012_2_00007FF6EC4B13E0
      Source: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exeCode function: 12_2_00007FF6EC4F115412_2_00007FF6EC4F1154
      Source: C:\Program Files\FastestVPN\FastestVPN.exeCode function: 22_2_054B6E5822_2_054B6E58
      Source: C:\Program Files\FastestVPN\FastestVPN.exeCode function: 22_2_054B701A22_2_054B701A
      Source: C:\Program Files\FastestVPN\FastestVPN.exeCode function: 22_2_054B712E22_2_054B712E
      Source: C:\Program Files\FastestVPN\FastestVPN.exeCode function: 22_2_05873C1A22_2_05873C1A
      Source: C:\Program Files\FastestVPN\FastestVPN.exeCode function: 22_2_05872FE222_2_05872FE2
      Source: C:\Program Files\FastestVPN\FastestVPN.exeCode function: 22_2_05A9490022_2_05A94900
      Source: C:\Program Files\FastestVPN\FastestVPN.exeCode function: 22_2_05A95CD622_2_05A95CD6
      Source: C:\Program Files\FastestVPN\FastestVPN.exeCode function: 22_2_0BD4305A22_2_0BD4305A
      Source: C:\Program Files\FastestVPN\FastestVPN.exeCode function: 22_2_0BD4317E22_2_0BD4317E
      Source: C:\Program Files\FastestVPN\FastestVPN.exeCode function: 22_2_0BD4479922_2_0BD44799
      Source: C:\Program Files\FastestVPN\FastestVPN.exeCode function: 22_2_0BD6BB5922_2_0BD6BB59
      Source: C:\Program Files\FastestVPN\FastestVPN.exeCode function: 22_2_0BD65D0B22_2_0BD65D0B
      Source: C:\Program Files\FastestVPN\FastestVPN.exeCode function: 22_2_0BD62FF522_2_0BD62FF5
      Source: C:\Program Files\FastestVPN\FastestVPN.exeCode function: 22_2_0BD626E822_2_0BD626E8
      Source: C:\Program Files\FastestVPN\FastestVPN.exeCode function: 22_2_0BDD5C5222_2_0BDD5C52
      Source: C:\Program Files\FastestVPN\FastestVPN.exeCode function: 22_2_00CF383822_2_00CF3838
      Source: C:\Program Files\FastestVPN\FastestVPN.exeCode function: 22_2_00CF383022_2_00CF3830
      Source: C:\Program Files\FastestVPN\FastestVPN.exeCode function: 22_2_05E056C022_2_05E056C0
      Source: C:\Program Files\FastestVPN\FastestVPN.exeCode function: 22_2_05E07B3022_2_05E07B30
      Source: C:\Program Files\FastestVPN\FastestVPN.exeCode function: 22_2_05E0B07022_2_05E0B070
      Source: C:\Program Files\FastestVPN\FastestVPN.exeCode function: 22_2_05E00D2822_2_05E00D28
      Source: C:\Program Files\FastestVPN\FastestVPN.exeCode function: 22_2_05E00D1822_2_05E00D18
      Source: C:\Program Files\FastestVPN\FastestVPN.exeCode function: 22_2_05E0BA7722_2_05E0BA77
      Source: C:\Program Files\FastestVPN\FastestVPN.exeCode function: 22_2_0AA4722922_2_0AA47229
      Source: C:\Program Files\FastestVPN\FastestVPN.exeCode function: 22_2_0AA4720922_2_0AA47209
      Source: C:\Program Files\FastestVPN\FastestVPN.exeCode function: 22_2_0AA4680822_2_0AA46808
      Source: C:\Program Files\FastestVPN\FastestVPN.exeCode function: 22_2_0AA46FE822_2_0AA46FE8
      Source: C:\Program Files\FastestVPN\FastestVPN.exeCode function: 22_2_0AA46FF822_2_0AA46FF8
      Source: C:\Program Files\FastestVPN\FastestVPN.exeCode function: 22_2_0BDC424822_2_0BDC4248
      Source: C:\Program Files\FastestVPN\FastestVPN.exeCode function: 22_2_0BDCA8C022_2_0BDCA8C0
      Source: C:\Program Files\FastestVPN\FastestVPN.exeCode function: 22_2_0BDCB19022_2_0BDCB190
      Source: C:\Program Files\FastestVPN\FastestVPN.exeCode function: 22_2_0BDC655022_2_0BDC6550
      Source: C:\Program Files\FastestVPN\FastestVPN.exeCode function: 22_2_0BDCA57822_2_0BDCA578
      Source: C:\Program Files\FastestVPN\FastestVPN.exeCode function: 22_2_0C409C9822_2_0C409C98
      Source: C:\Program Files\FastestVPN\FastestVPN.exeCode function: 22_2_0C40936022_2_0C409360
      Source: C:\Program Files\FastestVPN\FastestVPN.exeCode function: 22_2_0C55E96022_2_0C55E960
      Source: C:\Program Files\FastestVPN\FastestVPN.exeCode function: 22_2_0C5512E022_2_0C5512E0
      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeCode function: 29_2_04E3A52029_2_04E3A520
      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeCode function: 29_2_04E3ADF029_2_04E3ADF0
      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeCode function: 29_2_04E3A1D829_2_04E3A1D8
      Source: C:\Program Files\FastestVPN\Resources\sp\release\nfregdrv.exeCode function: 35_2_0040292035_2_00402920
      Source: C:\Program Files\FastestVPN\Resources\sp\release\nfregdrv.exeCode function: 35_2_00404DDB35_2_00404DDB
      Source: C:\Program Files\FastestVPN\Resources\sp\release\nfregdrv.exeCode function: 35_2_1000206035_2_10002060
      Source: C:\Program Files\FastestVPN\Resources\sp\release\nfregdrv.exeCode function: 35_2_1000A0A035_2_1000A0A0
      Source: C:\Program Files\FastestVPN\Resources\sp\release\nfregdrv.exeCode function: 35_2_10009A8135_2_10009A81
      Source: C:\Program Files\FastestVPN\Resources\sp\release\nfregdrv.exeCode function: 35_2_10005C6035_2_10005C60
      Source: C:\Program Files\FastestVPN\Resources\sp\release\nfregdrv.exeCode function: 35_2_1000BD2135_2_1000BD21
      Source: C:\Program Files\FastestVPN\Resources\sp\release\nfregdrv.exeCode function: 35_2_1000162035_2_10001620
      Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeCode function: 39_2_050638B439_2_050638B4
      Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeCode function: 39_2_0506336639_2_05063366
      Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeCode function: 45_2_01535F4845_2_01535F48
      Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeCode function: 45_2_01535F3845_2_01535F38
      Source: C:\Program Files\FastestVPN\subinacl.exeCode function: 46_2_010383F646_2_010383F6
      Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeCode function: 50_2_04133D9F50_2_04133D9F
      Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeCode function: 50_2_0413699C50_2_0413699C
      Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeCode function: 50_2_041D5F9F50_2_041D5F9F
      Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeCode function: 50_2_041D598850_2_041D5988
      Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeCode function: 50_2_0432571D50_2_0432571D
      Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeCode function: 50_2_043576B750_2_043576B7
      Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeCode function: 50_2_043C398650_2_043C3986
      Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeCode function: 50_2_0443327650_2_04433276
      Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeCode function: 50_2_0443699850_2_04436998
      Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeCode function: 50_2_04435D9D50_2_04435D9D
      Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeCode function: 50_2_044333B950_2_044333B9
      Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeCode function: 50_2_0163D08F50_2_0163D08F
      Source: C:\Program Files\FastestVPN\FastestVPN.exeCode function: 52_2_04F7206352_2_04F72063
      Source: C:\Program Files\FastestVPN\FastestVPN.exeCode function: 52_2_04F720C052_2_04F720C0
      Source: C:\Program Files\FastestVPN\FastestVPN.exeCode function: 52_2_04F7208C52_2_04F7208C
      Source: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exeProcess token adjusted: Load DriverJump to behavior
      Source: C:\Windows\System32\svchost.exeProcess token adjusted: SecurityJump to behavior
      Source: C:\Program Files\FastestVPN\Resources\sp\release\nfregdrv.exeCode function: String function: 1000A044 appears 35 times
      Source: C:\Program Files\FastestVPN\subinacl.exeCode function: String function: 0103E03C appears 110 times
      Source: C:\Program Files\FastestVPN\subinacl.exeCode function: String function: 0103E368 appears 75 times
      Source: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exeCode function: String function: 00007FF6EC4E81A8 appears 48 times
      Source: C:\Windows\System32\svchost.exeProcess created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 2540 -ip 2540
      Source: OqAVRCkQ3T.tmp.0.drStatic PE information: Resource name: RT_RCDATA type: PE32+ executable (console) x86-64, for MS Windows
      Source: is-ABK95.tmp.2.drStatic PE information: Resource name: RT_VERSION type: COM executable for DOS
      Source: OqAVRCkQ3T.exe, 00000000.00000000.2146713893.00000000004B9000.00000002.00000001.01000000.00000003.sdmpBinary or memory string: OriginalFileName vs OqAVRCkQ3T.exe
      Source: OqAVRCkQ3T.exe, 00000000.00000003.2148424618.00000000028C2000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: OriginalFileName vs OqAVRCkQ3T.exe
      Source: OqAVRCkQ3T.exe, 00000000.00000003.2148872656.000000007FE2E000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: OriginalFileName vs OqAVRCkQ3T.exe
      Source: OqAVRCkQ3T.exeBinary or memory string: OriginalFileName vs OqAVRCkQ3T.exe
      Source: OqAVRCkQ3T.exeStatic PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE
      Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\reg.exe reg Query "HKLM\Hardware\Description\System\CentralProcessor\0"
      Source: is-2DBGR.tmp.2.drStatic PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
      Source: is-5GMR0.tmp.2.dr, NotFound.csTask registration methods: 'CreateCompletedTask'
      Source: is-0B265.tmp.2.drBinary string: Type the password for user :--- DEBUG NetDfsGetClientInfo Dfs path detected = --- DEBUG NetDfsGetClientInfo NetStatus = --- DEBUG NetDfsGetClientInfo DfsPath to check = \\%[^\]\%[^\]--- DEBUG NetDfsGetClientInfo exists in NetApi32.lib. DfsPath is checked = --- DEBUG NetDfsGetClientInfo not existing in NetApi32.lib. DfsPath not checked = NetDfsGetClientInfoNetApi32.dll--- DEBUG FileFullPathName Default Sam Server will be = --- DEBUG FileFullPathName ShareName is = --- DEBUG FileFullPathName Server is = \Device\LanmanRedirector\;%[^\]\%[^\]\%s\Device\LanmanRedirector\\Device\WinDfs\ privileges to run this tool successfullyYou may need privilege. This privilege may be required. WARNING :Unable to set SeDebugPrivilegeSeChangeNotifyPrivilegeSeTakeOwnershipPrivilegeSeBackupPrivilegeSeSecurityPrivilegeSeRestorePrivilegeCheckPriv : Memory ExhaustedParsing registry key error :Could not open Sam Server :Error OpenSCManager : will not be processed. Dfs path is not supported--- DEBUG ObjCreateInstance - Error FileFullPathName = Remote access is not allowed for kernelobject or process--- DEBUG ObjCreateInstance - Default Sam Server will be = - DfsPath is not supported
      Source: is-N7JEQ.tmp.2.drBinary string: \Device\CtrlSM
      Source: is-SUSF8.tmp.2.drBinary string: \Device\.tap\DosDevices\Global\.tapdiagTAP-Windows Adapter V9
      Source: is-HM6P4.tmp.2.drBinary string: \Device\
      Source: classification engineClassification label: mal44.troj.spyw.expl.evad.winEXE@77/324@0/1
      Source: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exeCode function: 12_2_00007FF6EC4B52E0 CharNextW,CharNextW,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,CloseHandle,InitiateSystemShutdownExW,12_2_00007FF6EC4B52E0
      Source: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exeCode function: 12_2_00007FF6EC4B4D80 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,CloseHandle,InitiateSystemShutdownExW,12_2_00007FF6EC4B4D80
      Source: C:\Program Files\FastestVPN\Resources\sp\release\nfregdrv.exeCode function: 35_2_100139D0 ?nf_adjustProcessPriviledges@nfapi@@YAXXZ,GetCurrentProcessId,OpenProcess,OpenProcessToken,CloseHandle,LookupPrivilegeValueA,CloseHandle,CloseHandle,AdjustTokenPrivileges,CloseHandle,CloseHandle,CloseHandle,35_2_100139D0
      Source: C:\Program Files\FastestVPN\subinacl.exeCode function: 46_2_0101CA79 LookupPrivilegeValueW,AdjustTokenPrivileges,PrivilegeCheck,GetLastError,_CxxThrowException,46_2_0101CA79
      Source: C:\Program Files\FastestVPN\Resources\sp\release\nfregdrv.exeCode function: OpenSCManagerA,CreateServiceW,CloseServiceHandle,GetLastError,GetLastError,OpenServiceA,QueryServiceStatus,StartServiceA,GetLastError,CloseServiceHandle,GetLastError,CloseServiceHandle,SetLastError,35_2_10013540
      Source: C:\Program Files\FastestVPN\Resources\sp\release\nfregdrv.exeCode function: 35_2_10013540 OpenSCManagerA,CreateServiceW,CloseServiceHandle,GetLastError,GetLastError,OpenServiceA,QueryServiceStatus,StartServiceA,GetLastError,CloseServiceHandle,GetLastError,CloseServiceHandle,SetLastError,35_2_10013540
      Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeCode function: 50_2_016313E8 StartServiceCtrlDispatcherW,50_2_016313E8
      Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeCode function: 50_2_016313E3 StartServiceCtrlDispatcherW,50_2_016313E3
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpFile created: C:\Program Files\FastestVPNJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpFile created: C:\Users\Public\Desktop\FastestVPN.lnkJump to behavior
      Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1456:120:WilError_03
      Source: C:\Windows\System32\drvinst.exeMutant created: \BaseNamedObjects\DrvInst.exe_mutex_{5B10AC83-4F13-4fde-8C0B-B85681BA8D73}
      Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2220:120:WilError_03
      Source: C:\Program Files\FastestVPN\FastestVPN.exeMutant created: NULL
      Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeMutant created: \Sessions\1\BaseNamedObjects\Global\netfxeventlog.1.0
      Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2992:120:WilError_03
      Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3780:120:WilError_03
      Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2096:120:WilError_03
      Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2884:120:WilError_03
      Source: C:\Program Files\FastestVPN\FastestVPN.exeMutant created: \Sessions\1\BaseNamedObjects\Global\8C9EED5B-604B-4700-866A-6A9606527CC6
      Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6912:120:WilError_03
      Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1656:120:WilError_03
      Source: C:\Program Files\FastestVPN\FastestVPN.exeMutant created: \Sessions\1\BaseNamedObjects\F7ADS2TDE9SFT7VCP4NAF2A1S4TAE7S8TBVDPEN5FAA3S0T3EFS6T1V4PDN4F8user
      Source: C:\Program Files\FastestVPN\Resources\ComDebug.exeMutant created: \Sessions\1\BaseNamedObjects\VOVSOFT_Batch_URL_Downloader
      Source: C:\Windows\SysWOW64\WerFault.exeMutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess2540
      Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeMutant created: \BaseNamedObjects\Global\netfxeventlog.1.0
      Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5920:120:WilError_03
      Source: C:\Users\user\Desktop\OqAVRCkQ3T.exeFile created: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmpJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpProcess created: C:\Windows\System32\cmd.exe "C:\Windows\system32\cmd.exe" /C ""C:\Program Files\FastestVPN\Resources\driver\install_tap.bat""
      Source: C:\Program Files\FastestVPN\Resources\sp\release\nfregdrv.exeCommand line argument: nfregdvr35_2_00401050
      Source: C:\Users\user\Desktop\OqAVRCkQ3T.exeKey opened: HKEY_CURRENT_USER\Software\Borland\Delphi\LocalesJump to behavior
      Source: C:\Users\user\Desktop\OqAVRCkQ3T.exeKey opened: HKEY_CURRENT_USER\Software\Borland\Delphi\LocalesJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpKey opened: HKEY_CURRENT_USER\Software\Borland\Delphi\LocalesJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpKey opened: HKEY_CURRENT_USER\Software\Borland\Delphi\LocalesJump to behavior
      Source: C:\Program Files\FastestVPN\Resources\ComDebug.exeKey opened: HKEY_CURRENT_USER\Software\Borland\Delphi\LocalesJump to behavior
      Source: C:\Program Files\FastestVPN\Resources\ComDebug.exeKey opened: HKEY_CURRENT_USER\Software\Borland\Delphi\LocalesJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpFile read: C:\Program Files\desktop.iniJump to behavior
      Source: C:\Users\user\Desktop\OqAVRCkQ3T.exeKey opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiersJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpKey value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion RegisteredOrganizationJump to behavior
      Source: tapinstall.exeString found in binary or memory: itioned on the newly-added filter. ! Deletes the next occurrence of the specified filter. When the subcommand
      Source: tapinstall.exeString found in binary or memory: of the list. When the subcommand completes, the cursor is positioned on the newly-added filter. + Add after. I
      Source: FastestVPN.WindowsService.exeString found in binary or memory: registerHubProxies(proxies, true); this._registerSubscribedHubs(); }).disconnected(function () { // Unsubscribe all hub proxies when we "disconnect". This is to ensure that we do not re-add functional call backs.
      Source: FastestVPN.WindowsService.exeString found in binary or memory: /installtunnelservice "
      Source: OqAVRCkQ3T.exeString found in binary or memory: /LOADINF="filename"
      Source: C:\Users\user\Desktop\OqAVRCkQ3T.exeFile read: C:\Users\user\Desktop\OqAVRCkQ3T.exeJump to behavior
      Source: unknownProcess created: C:\Users\user\Desktop\OqAVRCkQ3T.exe "C:\Users\user\Desktop\OqAVRCkQ3T.exe"
      Source: C:\Users\user\Desktop\OqAVRCkQ3T.exeProcess created: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmp "C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmp" /SL5="$203F6,29832184,735744,C:\Users\user\Desktop\OqAVRCkQ3T.exe"
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpProcess created: C:\Program Files\FastestVPN\Resources\ComDebug.exe "C:\Program Files\FastestVPN\Resources\ComDebug.exe"
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpProcess created: C:\Windows\System32\cmd.exe "C:\Windows\system32\cmd.exe" /C ""C:\Program Files\FastestVPN\Resources\driver\install_tap.bat""
      Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\reg.exe reg Query "HKLM\Hardware\Description\System\CentralProcessor\0"
      Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\find.exe find /i "x86"
      Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c ver
      Source: C:\Windows\System32\cmd.exeProcess created: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exe tapinstall.exe remove tap0901
      Source: C:\Windows\System32\cmd.exeProcess created: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exe tapinstall.exe install OemVista.inf tap0901
      Source: C:\Program Files\FastestVPN\Resources\ComDebug.exeProcess created: C:\Windows\SysWOW64\more.com C:\Windows\SysWOW64\more.com
      Source: C:\Windows\SysWOW64\more.comProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      Source: unknownProcess created: C:\Windows\System32\svchost.exe C:\Windows\system32\svchost.exe -k DcomLaunch -p -s DeviceInstall
      Source: C:\Windows\System32\svchost.exeProcess created: C:\Windows\System32\drvinst.exe DrvInst.exe "4" "0" "C:\Users\user\AppData\Local\Temp\{4cb0eb0d-a103-7c4c-aedf-5caef9610c0c}\oemvista.inf" "9" "4d14a44ff" "0000000000000154" "WinSta0\Default" "0000000000000168" "208" "c:\program files\fastestvpn\resources\driver\windows10\amd64"
      Source: C:\Windows\System32\svchost.exeProcess created: C:\Windows\System32\drvinst.exe DrvInst.exe "2" "211" "ROOT\NET\0000" "C:\Windows\INF\oem4.inf" "oem4.inf:3beb73aff103cc24:tap0901.ndi:9.24.2.601:tap0901," "4d14a44ff" "0000000000000154"
      Source: unknownProcess created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s NetSetupSvc
      Source: unknownProcess created: C:\Program Files\FastestVPN\FastestVPN.exe "C:\Program Files\FastestVPN\FastestVPN.exe" -autorun
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpProcess created: C:\Windows\System32\cmd.exe "C:\Windows\system32\cmd.exe" /C ""C:\Program Files\FastestVPN\Resources\sp\install_sp.bat""
      Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\sc.exe sc stop fastestvpndriver
      Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\reg.exe reg Query "HKLM\Hardware\Description\System\CentralProcessor\0"
      Source: C:\Windows\System32\sc.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\find.exe find /i "x86"
      Source: C:\Program Files\FastestVPN\FastestVPN.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "powershell" -windowstyle hidden get-wmiobject Win32_ComputerSystemProduct | Select-Object -ExpandProperty UUID
      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      Source: unknownProcess created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
      Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\reg.exe reg QUERY "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion"
      Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\find.exe find /i "Windows 7"
      Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\xcopy.exe xcopy /y driver\windows8\amd64\fastestvpndriver.sys C:\Windows\system32\drivers
      Source: C:\Windows\System32\cmd.exeProcess created: C:\Program Files\FastestVPN\Resources\sp\release\nfregdrv.exe release\nfregdrv.exe -u fastestvpndriver
      Source: C:\Windows\System32\cmd.exeProcess created: C:\Program Files\FastestVPN\Resources\sp\release\nfregdrv.exe release\nfregdrv.exe fastestvpndriver
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpProcess created: C:\Windows\System32\sc.exe "C:\Windows\system32\sc.exe" stop FastestVPNService
      Source: C:\Windows\System32\sc.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpProcess created: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe "C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe" --uninstall
      Source: unknownProcess created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k WerSvcGroup
      Source: C:\Windows\System32\svchost.exeProcess created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 2540 -ip 2540
      Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeProcess created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 2540 -s 1076
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpProcess created: C:\Windows\System32\sc.exe "C:\Windows\system32\sc.exe" delete FastestVPNService
      Source: C:\Windows\System32\sc.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpProcess created: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe "C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe" --install
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpProcess created: C:\Program Files\FastestVPN\subinacl.exe "C:\Program Files\FastestVPN\subinacl.exe" /service FastestVPNService /GRANT=everyone=TO
      Source: C:\Program Files\FastestVPN\subinacl.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpProcess created: C:\Windows\System32\sc.exe "C:\Windows\system32\sc.exe" start FastestVPNService
      Source: C:\Windows\System32\sc.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      Source: unknownProcess created: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe "C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe"
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpProcess created: C:\Program Files\FastestVPN\FastestVPN.exe "C:\Program Files\FastestVPN\FastestVPN.exe"
      Source: C:\Users\user\Desktop\OqAVRCkQ3T.exeProcess created: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmp "C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmp" /SL5="$203F6,29832184,735744,C:\Users\user\Desktop\OqAVRCkQ3T.exe" Jump to behavior
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpProcess created: C:\Program Files\FastestVPN\Resources\ComDebug.exe "C:\Program Files\FastestVPN\Resources\ComDebug.exe" Jump to behavior
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpProcess created: C:\Windows\System32\cmd.exe "C:\Windows\system32\cmd.exe" /C ""C:\Program Files\FastestVPN\Resources\driver\install_tap.bat""Jump to behavior
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpProcess created: C:\Windows\System32\cmd.exe "C:\Windows\system32\cmd.exe" /C ""C:\Program Files\FastestVPN\Resources\sp\install_sp.bat""Jump to behavior
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpProcess created: C:\Windows\System32\sc.exe "C:\Windows\system32\sc.exe" stop FastestVPNServiceJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpProcess created: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe "C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe" --uninstallJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpProcess created: C:\Windows\System32\sc.exe "C:\Windows\system32\sc.exe" delete FastestVPNServiceJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpProcess created: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe "C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe" --installJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpProcess created: C:\Program Files\FastestVPN\subinacl.exe "C:\Program Files\FastestVPN\subinacl.exe" /service FastestVPNService /GRANT=everyone=TOJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpProcess created: C:\Windows\System32\sc.exe "C:\Windows\system32\sc.exe" start FastestVPNServiceJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpProcess created: C:\Program Files\FastestVPN\FastestVPN.exe "C:\Program Files\FastestVPN\FastestVPN.exe"Jump to behavior
      Source: C:\Program Files\FastestVPN\Resources\ComDebug.exeProcess created: C:\Windows\SysWOW64\more.com C:\Windows\SysWOW64\more.comJump to behavior
      Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\reg.exe reg Query "HKLM\Hardware\Description\System\CentralProcessor\0" Jump to behavior
      Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\find.exe find /i "x86" Jump to behavior
      Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c verJump to behavior
      Source: C:\Windows\System32\cmd.exeProcess created: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exe tapinstall.exe remove tap0901Jump to behavior
      Source: C:\Windows\System32\cmd.exeProcess created: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exe tapinstall.exe install OemVista.inf tap0901Jump to behavior
      Source: C:\Windows\System32\svchost.exeProcess created: C:\Windows\System32\drvinst.exe DrvInst.exe "4" "0" "C:\Users\user\AppData\Local\Temp\{4cb0eb0d-a103-7c4c-aedf-5caef9610c0c}\oemvista.inf" "9" "4d14a44ff" "0000000000000154" "WinSta0\Default" "0000000000000168" "208" "c:\program files\fastestvpn\resources\driver\windows10\amd64"Jump to behavior
      Source: C:\Windows\System32\svchost.exeProcess created: C:\Windows\System32\drvinst.exe DrvInst.exe "2" "211" "ROOT\NET\0000" "C:\Windows\INF\oem4.inf" "oem4.inf:3beb73aff103cc24:tap0901.ndi:9.24.2.601:tap0901," "4d14a44ff" "0000000000000154"Jump to behavior
      Source: C:\Program Files\FastestVPN\FastestVPN.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "powershell" -windowstyle hidden get-wmiobject Win32_ComputerSystemProduct | Select-Object -ExpandProperty UUID
      Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\sc.exe sc stop fastestvpndriver
      Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\reg.exe reg Query "HKLM\Hardware\Description\System\CentralProcessor\0"
      Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\find.exe find /i "x86"
      Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\reg.exe reg QUERY "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion"
      Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\find.exe find /i "Windows 7"
      Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\xcopy.exe xcopy /y driver\windows8\amd64\fastestvpndriver.sys C:\Windows\system32\drivers
      Source: C:\Windows\System32\cmd.exeProcess created: C:\Program Files\FastestVPN\Resources\sp\release\nfregdrv.exe release\nfregdrv.exe -u fastestvpndriver
      Source: C:\Windows\System32\cmd.exeProcess created: C:\Program Files\FastestVPN\Resources\sp\release\nfregdrv.exe release\nfregdrv.exe fastestvpndriver
      Source: C:\Windows\System32\svchost.exeProcess created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 2540 -ip 2540
      Source: C:\Windows\System32\svchost.exeProcess created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 2540 -s 1076
      Source: C:\Windows\SysWOW64\WerFault.exeProcess created: unknown unknown
      Source: C:\Users\user\Desktop\OqAVRCkQ3T.exeSection loaded: uxtheme.dllJump to behavior
      Source: C:\Users\user\Desktop\OqAVRCkQ3T.exeSection loaded: apphelp.dllJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpSection loaded: mpr.dllJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpSection loaded: version.dllJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpSection loaded: winhttp.dllJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpSection loaded: uxtheme.dllJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpSection loaded: kernel.appcore.dllJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpSection loaded: wtsapi32.dllJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpSection loaded: winsta.dllJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpSection loaded: textinputframework.dllJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpSection loaded: coreuicomponents.dllJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpSection loaded: coremessaging.dllJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpSection loaded: ntmarta.dllJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpSection loaded: coremessaging.dllJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpSection loaded: wintypes.dllJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpSection loaded: wintypes.dllJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpSection loaded: wintypes.dllJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpSection loaded: shfolder.dllJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpSection loaded: rstrtmgr.dllJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpSection loaded: ncrypt.dllJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpSection loaded: ntasn1.dllJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpSection loaded: textshaping.dllJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpSection loaded: msftedit.dllJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpSection loaded: windows.globalization.dllJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpSection loaded: bcp47langs.dllJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpSection loaded: bcp47mrm.dllJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpSection loaded: globinputhost.dllJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpSection loaded: windows.ui.dllJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpSection loaded: windowmanagementapi.dllJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpSection loaded: inputhost.dllJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpSection loaded: twinapi.appcore.dllJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpSection loaded: twinapi.appcore.dllJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpSection loaded: propsys.dllJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpSection loaded: dwmapi.dllJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpSection loaded: windows.storage.dllJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpSection loaded: wldp.dllJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpSection loaded: sspicli.dllJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpSection loaded: explorerframe.dllJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpSection loaded: sfc.dllJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpSection loaded: sfc_os.dllJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpSection loaded: profapi.dllJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpSection loaded: linkinfo.dllJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpSection loaded: ntshrui.dllJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpSection loaded: srvcli.dllJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpSection loaded: cscapi.dllJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpSection loaded: edputil.dllJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpSection loaded: urlmon.dllJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpSection loaded: iertutil.dllJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpSection loaded: netutils.dllJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpSection loaded: windows.staterepositoryps.dllJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpSection loaded: appresolver.dllJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpSection loaded: slc.dllJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpSection loaded: userenv.dllJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpSection loaded: sppc.dllJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpSection loaded: onecorecommonproxystub.dllJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpSection loaded: onecoreuapcommonproxystub.dllJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpSection loaded: apphelp.dllJump to behavior
      Source: C:\Program Files\FastestVPN\Resources\ComDebug.exeSection loaded: winmm.dllJump to behavior
      Source: C:\Program Files\FastestVPN\Resources\ComDebug.exeSection loaded: oleacc.dllJump to behavior
      Source: C:\Program Files\FastestVPN\Resources\ComDebug.exeSection loaded: version.dllJump to behavior
      Source: C:\Program Files\FastestVPN\Resources\ComDebug.exeSection loaded: netapi32.dllJump to behavior
      Source: C:\Program Files\FastestVPN\Resources\ComDebug.exeSection loaded: winhttp.dllJump to behavior
      Source: C:\Program Files\FastestVPN\Resources\ComDebug.exeSection loaded: shfolder.dllJump to behavior
      Source: C:\Program Files\FastestVPN\Resources\ComDebug.exeSection loaded: netutils.dllJump to behavior
      Source: C:\Program Files\FastestVPN\Resources\ComDebug.exeSection loaded: uxtheme.dllJump to behavior
      Source: C:\Program Files\FastestVPN\Resources\ComDebug.exeSection loaded: kernel.appcore.dllJump to behavior
      Source: C:\Program Files\FastestVPN\Resources\ComDebug.exeSection loaded: wtsapi32.dllJump to behavior
      Source: C:\Program Files\FastestVPN\Resources\ComDebug.exeSection loaded: winsta.dllJump to behavior
      Source: C:\Program Files\FastestVPN\Resources\ComDebug.exeSection loaded: security.dllJump to behavior
      Source: C:\Program Files\FastestVPN\Resources\ComDebug.exeSection loaded: secur32.dllJump to behavior
      Source: C:\Program Files\FastestVPN\Resources\ComDebug.exeSection loaded: sspicli.dllJump to behavior
      Source: C:\Program Files\FastestVPN\Resources\ComDebug.exeSection loaded: textshaping.dllJump to behavior
      Source: C:\Program Files\FastestVPN\Resources\ComDebug.exeSection loaded: windowscodecs.dllJump to behavior
      Source: C:\Program Files\FastestVPN\Resources\ComDebug.exeSection loaded: shdocvw.dllJump to behavior
      Source: C:\Windows\System32\cmd.exeSection loaded: cmdext.dllJump to behavior
      Source: C:\Windows\System32\cmd.exeSection loaded: apphelp.dllJump to behavior
      Source: C:\Windows\System32\find.exeSection loaded: ulib.dllJump to behavior
      Source: C:\Windows\System32\find.exeSection loaded: fsutilext.dllJump to behavior
      Source: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exeSection loaded: apphelp.dllJump to behavior
      Source: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exeSection loaded: devobj.dllJump to behavior
      Source: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exeSection loaded: msasn1.dllJump to behavior
      Source: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exeSection loaded: kernel.appcore.dllJump to behavior
      Source: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exeSection loaded: devrtl.dllJump to behavior
      Source: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exeSection loaded: spinf.dllJump to behavior
      Source: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exeSection loaded: drvstore.dllJump to behavior
      Source: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exeSection loaded: devobj.dllJump to behavior
      Source: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exeSection loaded: newdev.dllJump to behavior
      Source: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exeSection loaded: msasn1.dllJump to behavior
      Source: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exeSection loaded: cryptsp.dllJump to behavior
      Source: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exeSection loaded: rsaenh.dllJump to behavior
      Source: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exeSection loaded: cryptbase.dllJump to behavior
      Source: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exeSection loaded: gpapi.dllJump to behavior
      Source: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exeSection loaded: cabinet.dllJump to behavior
      Source: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exeSection loaded: ntmarta.dllJump to behavior
      Source: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exeSection loaded: kernel.appcore.dllJump to behavior
      Source: C:\Windows\SysWOW64\more.comSection loaded: ulib.dllJump to behavior
      Source: C:\Windows\SysWOW64\more.comSection loaded: fsutilext.dllJump to behavior
      Source: C:\Windows\System32\svchost.exeSection loaded: umpnpmgr.dllJump to behavior
      Source: C:\Windows\System32\svchost.exeSection loaded: wldp.dllJump to behavior
      Source: C:\Windows\System32\svchost.exeSection loaded: devrtl.dllJump to behavior
      Source: C:\Windows\System32\drvinst.exeSection loaded: ntmarta.dllJump to behavior
      Source: C:\Windows\System32\drvinst.exeSection loaded: devrtl.dllJump to behavior
      Source: C:\Windows\System32\drvinst.exeSection loaded: drvstore.dllJump to behavior
      Source: C:\Windows\System32\drvinst.exeSection loaded: cabinet.dllJump to behavior
      Source: C:\Windows\System32\drvinst.exeSection loaded: msasn1.dllJump to behavior
      Source: C:\Windows\System32\drvinst.exeSection loaded: cryptsp.dllJump to behavior
      Source: C:\Windows\System32\drvinst.exeSection loaded: rsaenh.dllJump to behavior
      Source: C:\Windows\System32\drvinst.exeSection loaded: cryptbase.dllJump to behavior
      Source: C:\Windows\System32\drvinst.exeSection loaded: gpapi.dllJump to behavior
      Source: C:\Windows\System32\drvinst.exeSection loaded: ntmarta.dllJump to behavior
      Source: C:\Windows\System32\drvinst.exeSection loaded: devrtl.dllJump to behavior
      Source: C:\Windows\System32\drvinst.exeSection loaded: drvstore.dllJump to behavior
      Source: C:\Windows\System32\drvinst.exeSection loaded: devobj.dllJump to behavior
      Source: C:\Windows\System32\drvinst.exeSection loaded: cabinet.dllJump to behavior
      Source: C:\Windows\System32\svchost.exeSection loaded: kernel.appcore.dll
      Source: C:\Windows\System32\svchost.exeSection loaded: netsetupsvc.dll
      Source: C:\Windows\System32\svchost.exeSection loaded: powrprof.dll
      Source: C:\Windows\System32\svchost.exeSection loaded: netsetupapi.dll
      Source: C:\Windows\System32\svchost.exeSection loaded: umpdc.dll
      Source: C:\Windows\System32\svchost.exeSection loaded: wldp.dll
      Source: C:\Windows\System32\svchost.exeSection loaded: netsetupuser.dll
      Source: C:\Windows\System32\svchost.exeSection loaded: winnsi.dll
      Source: C:\Windows\System32\svchost.exeSection loaded: implatsetup.dll
      Source: C:\Windows\System32\svchost.exeSection loaded: devrtl.dll
      Source: C:\Windows\System32\svchost.exeSection loaded: spinf.dll
      Source: C:\Windows\System32\svchost.exeSection loaded: drvstore.dll
      Source: C:\Program Files\FastestVPN\FastestVPN.exeSection loaded: mscoree.dll
      Source: C:\Program Files\FastestVPN\FastestVPN.exeSection loaded: apphelp.dll
      Source: C:\Program Files\FastestVPN\FastestVPN.exeSection loaded: kernel.appcore.dll
      Source: C:\Program Files\FastestVPN\FastestVPN.exeSection loaded: version.dll
      Source: C:\Program Files\FastestVPN\FastestVPN.exeSection loaded: vcruntime140_clr0400.dll
      Source: C:\Program Files\FastestVPN\FastestVPN.exeSection loaded: ucrtbase_clr0400.dll
      Source: C:\Program Files\FastestVPN\FastestVPN.exeSection loaded: ucrtbase_clr0400.dll
      Source: C:\Program Files\FastestVPN\FastestVPN.exeSection loaded: uxtheme.dll
      Source: C:\Program Files\FastestVPN\FastestVPN.exeSection loaded: cryptsp.dll
      Source: C:\Program Files\FastestVPN\FastestVPN.exeSection loaded: rsaenh.dll
      Source: C:\Program Files\FastestVPN\FastestVPN.exeSection loaded: cryptbase.dll
      Source: C:\Program Files\FastestVPN\FastestVPN.exeSection loaded: dwrite.dll
      Source: C:\Program Files\FastestVPN\FastestVPN.exeSection loaded: msvcp140_clr0400.dll
      Source: C:\Program Files\FastestVPN\FastestVPN.exeSection loaded: sspicli.dll
      Source: C:\Program Files\FastestVPN\FastestVPN.exeSection loaded: mswsock.dll
      Source: C:\Program Files\FastestVPN\FastestVPN.exeSection loaded: windows.storage.dll
      Source: C:\Program Files\FastestVPN\FastestVPN.exeSection loaded: wldp.dll
      Source: C:\Program Files\FastestVPN\FastestVPN.exeSection loaded: profapi.dll
      Source: C:\Program Files\FastestVPN\FastestVPN.exeSection loaded: dwmapi.dll
      Source: C:\Program Files\FastestVPN\FastestVPN.exeSection loaded: d3d9.dll
      Source: C:\Program Files\FastestVPN\FastestVPN.exeSection loaded: d3d10warp.dll
      Source: C:\Program Files\FastestVPN\FastestVPN.exeSection loaded: urlmon.dll
      Source: C:\Program Files\FastestVPN\FastestVPN.exeSection loaded: iertutil.dll
      Source: C:\Program Files\FastestVPN\FastestVPN.exeSection loaded: srvcli.dll
      Source: C:\Program Files\FastestVPN\FastestVPN.exeSection loaded: netutils.dll
      Source: C:\Program Files\FastestVPN\FastestVPN.exeSection loaded: windowscodecs.dll
      Source: C:\Program Files\FastestVPN\FastestVPN.exeSection loaded: wtsapi32.dll
      Source: C:\Program Files\FastestVPN\FastestVPN.exeSection loaded: winsta.dll
      Source: C:\Program Files\FastestVPN\FastestVPN.exeSection loaded: powrprof.dll
      Source: C:\Program Files\FastestVPN\FastestVPN.exeSection loaded: umpdc.dll
      Source: C:\Program Files\FastestVPN\FastestVPN.exeSection loaded: dataexchange.dll
      Source: C:\Program Files\FastestVPN\FastestVPN.exeSection loaded: d3d11.dll
      Source: C:\Program Files\FastestVPN\FastestVPN.exeSection loaded: dcomp.dll
      Source: C:\Program Files\FastestVPN\FastestVPN.exeSection loaded: dxgi.dll
      Source: C:\Program Files\FastestVPN\FastestVPN.exeSection loaded: twinapi.appcore.dll
      Source: C:\Program Files\FastestVPN\FastestVPN.exeSection loaded: resourcepolicyclient.dll
      Source: C:\Program Files\FastestVPN\FastestVPN.exeSection loaded: dxcore.dll
      Source: C:\Program Files\FastestVPN\FastestVPN.exeSection loaded: textshaping.dll
      Source: C:\Program Files\FastestVPN\FastestVPN.exeSection loaded: textinputframework.dll
      Source: C:\Program Files\FastestVPN\FastestVPN.exeSection loaded: coreuicomponents.dll
      Source: C:\Program Files\FastestVPN\FastestVPN.exeSection loaded: coremessaging.dll
      Source: C:\Program Files\FastestVPN\FastestVPN.exeSection loaded: ntmarta.dll
      Source: C:\Program Files\FastestVPN\FastestVPN.exeSection loaded: coremessaging.dll
      Source: C:\Program Files\FastestVPN\FastestVPN.exeSection loaded: wintypes.dll
      Source: C:\Program Files\FastestVPN\FastestVPN.exeSection loaded: wintypes.dll
      Source: C:\Program Files\FastestVPN\FastestVPN.exeSection loaded: wintypes.dll
      Source: C:\Program Files\FastestVPN\FastestVPN.exeSection loaded: msctfui.dll
      Source: C:\Program Files\FastestVPN\FastestVPN.exeSection loaded: uiautomationcore.dll
      Source: C:\Program Files\FastestVPN\FastestVPN.exeSection loaded: propsys.dll
      Source: C:\Program Files\FastestVPN\FastestVPN.exeSection loaded: d3dcompiler_47.dll
      Source: C:\Program Files\FastestVPN\FastestVPN.exeSection loaded: winmm.dll
      Source: C:\Program Files\FastestVPN\FastestVPN.exeSection loaded: msasn1.dll
      Source: C:\Program Files\FastestVPN\FastestVPN.exeSection loaded: riched20.dll
      Source: C:\Program Files\FastestVPN\FastestVPN.exeSection loaded: usp10.dll
      Source: C:\Program Files\FastestVPN\FastestVPN.exeSection loaded: msls31.dll
      Source: C:\Program Files\FastestVPN\FastestVPN.exeSection loaded: gpapi.dll
      Source: C:\Program Files\FastestVPN\FastestVPN.exeSection loaded: cryptnet.dll
      Source: C:\Program Files\FastestVPN\FastestVPN.exeSection loaded: iphlpapi.dll
      Source: C:\Program Files\FastestVPN\FastestVPN.exeSection loaded: winnsi.dll
      Source: C:\Program Files\FastestVPN\FastestVPN.exeSection loaded: winhttp.dll
      Source: C:\Program Files\FastestVPN\FastestVPN.exeSection loaded: ondemandconnroutehelper.dll
      Source: C:\Program Files\FastestVPN\FastestVPN.exeSection loaded: dhcpcsvc6.dll
      Source: C:\Program Files\FastestVPN\FastestVPN.exeSection loaded: dhcpcsvc.dll
      Source: C:\Program Files\FastestVPN\FastestVPN.exeSection loaded: webio.dll
      Source: C:\Program Files\FastestVPN\FastestVPN.exeSection loaded: dnsapi.dll
      Source: C:\Program Files\FastestVPN\FastestVPN.exeSection loaded: rasadhlp.dll
      Source: C:\Program Files\FastestVPN\FastestVPN.exeSection loaded: fwpuclnt.dll
      Source: C:\Program Files\FastestVPN\FastestVPN.exeSection loaded: wbemcomn.dll
      Source: C:\Program Files\FastestVPN\FastestVPN.exeSection loaded: amsi.dll
      Source: C:\Program Files\FastestVPN\FastestVPN.exeSection loaded: userenv.dll
      Source: C:\Windows\System32\cmd.exeSection loaded: cmdext.dll
      Source: C:\Windows\System32\cmd.exeSection loaded: apphelp.dll
      Source: C:\Windows\System32\find.exeSection loaded: ulib.dll
      Source: C:\Windows\System32\find.exeSection loaded: fsutilext.dll
      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: atl.dll
      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: mscoree.dll
      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: kernel.appcore.dll
      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: version.dll
      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: vcruntime140_clr0400.dll
      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dll
      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dll
      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptsp.dll
      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: rsaenh.dll
      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptbase.dll
      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: windows.storage.dll
      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: wldp.dll
      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: msasn1.dll
      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: amsi.dll
      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: userenv.dll
      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: profapi.dll
      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: msisip.dll
      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: wshext.dll
      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: gpapi.dll
      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: appxsip.dll
      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: opcservices.dll
      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: secur32.dll
      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: sspicli.dll
      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: uxtheme.dll
      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: wbemcomn.dll
      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: napinsp.dll
      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: pnrpnsp.dll
      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: wshbth.dll
      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: nlaapi.dll
      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: iphlpapi.dll
      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: mswsock.dll
      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: dnsapi.dll
      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: winrnr.dll
      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: fwpuclnt.dll
      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: rasadhlp.dll
      Source: C:\Windows\System32\svchost.exeSection loaded: kernel.appcore.dll
      Source: C:\Windows\System32\svchost.exeSection loaded: qmgr.dll
      Source: C:\Windows\System32\svchost.exeSection loaded: bitsperf.dll
      Source: C:\Windows\System32\svchost.exeSection loaded: powrprof.dll
      Source: C:\Windows\System32\svchost.exeSection loaded: xmllite.dll
      Source: C:\Windows\System32\svchost.exeSection loaded: firewallapi.dll
      Source: C:\Windows\System32\svchost.exeSection loaded: esent.dll
      Source: C:\Windows\System32\svchost.exeSection loaded: umpdc.dll
      Source: C:\Windows\System32\svchost.exeSection loaded: dnsapi.dll
      Source: C:\Windows\System32\svchost.exeSection loaded: iphlpapi.dll
      Source: C:\Windows\System32\svchost.exeSection loaded: fwbase.dll
      Source: C:\Windows\System32\svchost.exeSection loaded: wldp.dll
      Source: C:\Windows\System32\svchost.exeSection loaded: ntmarta.dll
      Source: C:\Windows\System32\svchost.exeSection loaded: profapi.dll
      Source: C:\Windows\System32\svchost.exeSection loaded: flightsettings.dll
      Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dll
      Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dll
      Source: C:\Windows\System32\svchost.exeSection loaded: netprofm.dll
      Source: C:\Windows\System32\svchost.exeSection loaded: npmproxy.dll
      Source: C:\Windows\System32\svchost.exeSection loaded: bitsigd.dll
      Source: C:\Windows\System32\svchost.exeSection loaded: upnp.dll
      Source: C:\Windows\System32\svchost.exeSection loaded: winhttp.dll
      Source: C:\Windows\System32\svchost.exeSection loaded: ssdpapi.dll
      Source: C:\Windows\System32\svchost.exeSection loaded: urlmon.dll
      Source: C:\Windows\System32\svchost.exeSection loaded: iertutil.dll
      Source: C:\Windows\System32\svchost.exeSection loaded: srvcli.dll
      Source: C:\Windows\System32\svchost.exeSection loaded: netutils.dll
      Source: C:\Windows\System32\svchost.exeSection loaded: appxdeploymentclient.dll
      Source: C:\Windows\System32\svchost.exeSection loaded: cryptbase.dll
      Source: C:\Windows\System32\svchost.exeSection loaded: wsmauto.dll
      Source: C:\Windows\System32\svchost.exeSection loaded: miutils.dll
      Source: C:\Windows\System32\svchost.exeSection loaded: wsmsvc.dll
      Source: C:\Windows\System32\svchost.exeSection loaded: dsrole.dll
      Source: C:\Windows\System32\svchost.exeSection loaded: pcwum.dll
      Source: C:\Windows\System32\svchost.exeSection loaded: mi.dll
      Source: C:\Windows\System32\svchost.exeSection loaded: userenv.dll
      Source: C:\Windows\System32\svchost.exeSection loaded: gpapi.dll
      Source: C:\Windows\System32\svchost.exeSection loaded: wkscli.dll
      Source: C:\Windows\System32\svchost.exeSection loaded: sspicli.dll
      Source: C:\Windows\System32\svchost.exeSection loaded: ondemandconnroutehelper.dll
      Source: C:\Windows\System32\svchost.exeSection loaded: msv1_0.dll
      Source: C:\Windows\System32\svchost.exeSection loaded: ntlmshared.dll
      Source: C:\Windows\System32\svchost.exeSection loaded: cryptdll.dll
      Source: C:\Windows\System32\svchost.exeSection loaded: webio.dll
      Source: C:\Windows\System32\svchost.exeSection loaded: mswsock.dll
      Source: C:\Windows\System32\svchost.exeSection loaded: winnsi.dll
      Source: C:\Windows\System32\svchost.exeSection loaded: fwpuclnt.dll
      Source: C:\Windows\System32\svchost.exeSection loaded: rasadhlp.dll
      Source: C:\Windows\System32\svchost.exeSection loaded: rmclient.dll
      Source: C:\Windows\System32\svchost.exeSection loaded: usermgrcli.dll
      Source: C:\Windows\System32\svchost.exeSection loaded: execmodelclient.dll
      Source: C:\Windows\System32\svchost.exeSection loaded: propsys.dll
      Source: C:\Windows\System32\svchost.exeSection loaded: coremessaging.dll
      Source: C:\Windows\System32\svchost.exeSection loaded: twinapi.appcore.dll
      Source: C:\Windows\System32\svchost.exeSection loaded: onecorecommonproxystub.dll
      Source: C:\Windows\System32\svchost.exeSection loaded: execmodelproxy.dll
      Source: C:\Windows\System32\svchost.exeSection loaded: resourcepolicyclient.dll
      Source: C:\Windows\System32\svchost.exeSection loaded: vssapi.dll
      Source: C:\Windows\System32\svchost.exeSection loaded: vsstrace.dll
      Source: C:\Windows\System32\svchost.exeSection loaded: samcli.dll
      Source: C:\Windows\System32\svchost.exeSection loaded: samlib.dll
      Source: C:\Windows\System32\svchost.exeSection loaded: es.dll
      Source: C:\Windows\System32\svchost.exeSection loaded: bitsproxy.dll
      Source: C:\Windows\System32\svchost.exeSection loaded: ondemandconnroutehelper.dll
      Source: C:\Windows\System32\svchost.exeSection loaded: dhcpcsvc6.dll
      Source: C:\Windows\System32\svchost.exeSection loaded: dhcpcsvc.dll
      Source: C:\Windows\System32\svchost.exeSection loaded: schannel.dll
      Source: C:\Windows\System32\svchost.exeSection loaded: mskeyprotect.dll
      Source: C:\Windows\System32\svchost.exeSection loaded: ntasn1.dll
      Source: C:\Windows\System32\svchost.exeSection loaded: ncrypt.dll
      Source: C:\Windows\System32\svchost.exeSection loaded: ncryptsslp.dll
      Source: C:\Windows\System32\svchost.exeSection loaded: msasn1.dll
      Source: C:\Windows\System32\svchost.exeSection loaded: cryptsp.dll
      Source: C:\Windows\System32\svchost.exeSection loaded: rsaenh.dll
      Source: C:\Windows\System32\svchost.exeSection loaded: dpapi.dll
      Source: C:\Windows\System32\svchost.exeSection loaded: mpr.dll
      Source: C:\Windows\System32\find.exeSection loaded: ulib.dll
      Source: C:\Windows\System32\find.exeSection loaded: fsutilext.dll
      Source: C:\Windows\System32\xcopy.exeSection loaded: ulib.dll
      Source: C:\Windows\System32\xcopy.exeSection loaded: ifsutil.dll
      Source: C:\Windows\System32\xcopy.exeSection loaded: devobj.dll
      Source: C:\Windows\System32\xcopy.exeSection loaded: fsutilext.dll
      Source: C:\Windows\System32\xcopy.exeSection loaded: ntmarta.dll
      Source: C:\Program Files\FastestVPN\Resources\sp\release\nfregdrv.exeSection loaded: apphelp.dll
      Source: C:\Program Files\FastestVPN\Resources\sp\release\nfregdrv.exeSection loaded: nfapi.dll
      Source: C:\Program Files\FastestVPN\Resources\sp\release\nfregdrv.exeSection loaded: nfapi.dll
      Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeSection loaded: mscoree.dll
      Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeSection loaded: apphelp.dll
      Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeSection loaded: kernel.appcore.dll
      Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeSection loaded: version.dll
      Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeSection loaded: vcruntime140_clr0400.dll
      Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeSection loaded: ucrtbase_clr0400.dll
      Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeSection loaded: ucrtbase_clr0400.dll
      Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeSection loaded: windows.storage.dll
      Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeSection loaded: wldp.dll
      Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeSection loaded: profapi.dll
      Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeSection loaded: cryptsp.dll
      Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeSection loaded: rsaenh.dll
      Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeSection loaded: cryptbase.dll
      Source: C:\Windows\System32\svchost.exeSection loaded: wersvc.dll
      Source: C:\Windows\System32\svchost.exeSection loaded: windowsperformancerecordercontrol.dll
      Source: C:\Windows\System32\svchost.exeSection loaded: weretw.dll
      Source: C:\Windows\System32\svchost.exeSection loaded: xmllite.dll
      Source: C:\Windows\System32\svchost.exeSection loaded: wldp.dll
      Source: C:\Windows\System32\svchost.exeSection loaded: wer.dll
      Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dll
      Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dll
      Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dll
      Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dll
      Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dll
      Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dll
      Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dll
      Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dll
      Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dll
      Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dll
      Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dll
      Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dll
      Source: C:\Windows\System32\svchost.exeSection loaded: faultrep.dll
      Source: C:\Windows\System32\svchost.exeSection loaded: dbghelp.dll
      Source: C:\Windows\System32\svchost.exeSection loaded: dbgcore.dll
      Source: C:\Windows\System32\svchost.exeSection loaded: wer.dll
      Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dll
      Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dll
      Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dll
      Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dll
      Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dll
      Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dll
      Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dll
      Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dll
      Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dll
      Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dll
      Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dll
      Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dll
      Source: C:\Windows\System32\svchost.exeSection loaded: userenv.dll
      Source: C:\Windows\System32\svchost.exeSection loaded: profapi.dll
      Source: C:\Windows\System32\svchost.exeSection loaded: sspicli.dll
      Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dll
      Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dll
      Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dll
      Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dll
      Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dll
      Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dll
      Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dll
      Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dll
      Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dll
      Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dll
      Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dll
      Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dll
      Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeSection loaded: mscoree.dll
      Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeSection loaded: kernel.appcore.dll
      Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeSection loaded: version.dll
      Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeSection loaded: vcruntime140_clr0400.dll
      Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeSection loaded: ucrtbase_clr0400.dll
      Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeSection loaded: ucrtbase_clr0400.dll
      Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeSection loaded: windows.storage.dll
      Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeSection loaded: wldp.dll
      Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeSection loaded: profapi.dll
      Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeSection loaded: cryptsp.dll
      Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeSection loaded: rsaenh.dll
      Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeSection loaded: cryptbase.dll
      Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeSection loaded: urlmon.dll
      Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeSection loaded: iertutil.dll
      Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeSection loaded: srvcli.dll
      Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeSection loaded: netutils.dll
      Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeSection loaded: sspicli.dll
      Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeSection loaded: propsys.dll
      Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeSection loaded: msasn1.dll
      Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeSection loaded: riched20.dll
      Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeSection loaded: usp10.dll
      Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeSection loaded: msls31.dll
      Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeSection loaded: gpapi.dll
      Source: C:\Program Files\FastestVPN\subinacl.exeSection loaded: apphelp.dll
      Source: C:\Program Files\FastestVPN\subinacl.exeSection loaded: mfc42u.dll
      Source: C:\Program Files\FastestVPN\subinacl.exeSection loaded: msvcirt.dll
      Source: C:\Program Files\FastestVPN\subinacl.exeSection loaded: msvcp60.dll
      Source: C:\Program Files\FastestVPN\subinacl.exeSection loaded: version.dll
      Source: C:\Program Files\FastestVPN\subinacl.exeSection loaded: netapi32.dll
      Source: C:\Program Files\FastestVPN\subinacl.exeSection loaded: mpr.dll
      Source: C:\Program Files\FastestVPN\subinacl.exeSection loaded: clusapi.dll
      Source: C:\Program Files\FastestVPN\subinacl.exeSection loaded: samlib.dll
      Source: C:\Program Files\FastestVPN\subinacl.exeSection loaded: dnsapi.dll
      Source: C:\Program Files\FastestVPN\subinacl.exeSection loaded: srvcli.dll
      Source: C:\Program Files\FastestVPN\subinacl.exeSection loaded: netutils.dll
      Source: C:\Program Files\FastestVPN\subinacl.exeSection loaded: logoncli.dll
      Source: C:\Program Files\FastestVPN\subinacl.exeSection loaded: samcli.dll
      Source: C:\Program Files\FastestVPN\subinacl.exeSection loaded: iphlpapi.dll
      Source: C:\Program Files\FastestVPN\subinacl.exeSection loaded: kernel.appcore.dll
      Source: C:\Program Files\FastestVPN\subinacl.exeSection loaded: uxtheme.dll
      Source: C:\Program Files\FastestVPN\subinacl.exeSection loaded: ntmarta.dll
      Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeSection loaded: mscoree.dll
      Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeSection loaded: kernel.appcore.dll
      Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeSection loaded: version.dll
      Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeSection loaded: vcruntime140_clr0400.dll
      Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeSection loaded: ucrtbase_clr0400.dll
      Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeSection loaded: ucrtbase_clr0400.dll
      Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeSection loaded: windows.storage.dll
      Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeSection loaded: wldp.dll
      Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeSection loaded: profapi.dll
      Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeSection loaded: mswsock.dll
      Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeSection loaded: cryptsp.dll
      Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeSection loaded: rsaenh.dll
      Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeSection loaded: cryptbase.dll
      Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeSection loaded: iphlpapi.dll
      Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeSection loaded: httpapi.dll
      Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeSection loaded: urlmon.dll
      Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeSection loaded: iertutil.dll
      Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeSection loaded: srvcli.dll
      Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeSection loaded: netutils.dll
      Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeSection loaded: sspicli.dll
      Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeSection loaded: propsys.dll
      Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeSection loaded: dnsapi.dll
      Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeSection loaded: rasadhlp.dll
      Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeSection loaded: fwpuclnt.dll
      Source: C:\Program Files\FastestVPN\FastestVPN.exeSection loaded: mscoree.dll
      Source: C:\Program Files\FastestVPN\FastestVPN.exeSection loaded: kernel.appcore.dll
      Source: C:\Program Files\FastestVPN\FastestVPN.exeSection loaded: version.dll
      Source: C:\Program Files\FastestVPN\FastestVPN.exeSection loaded: vcruntime140_clr0400.dll
      Source: C:\Program Files\FastestVPN\FastestVPN.exeSection loaded: ucrtbase_clr0400.dll
      Source: C:\Program Files\FastestVPN\FastestVPN.exeSection loaded: ucrtbase_clr0400.dll
      Source: C:\Program Files\FastestVPN\FastestVPN.exeSection loaded: uxtheme.dll
      Source: C:\Program Files\FastestVPN\FastestVPN.exeSection loaded: cryptsp.dll
      Source: C:\Program Files\FastestVPN\FastestVPN.exeSection loaded: rsaenh.dll
      Source: C:\Program Files\FastestVPN\FastestVPN.exeSection loaded: cryptbase.dll
      Source: C:\Program Files\FastestVPN\FastestVPN.exeSection loaded: dwrite.dll
      Source: C:\Program Files\FastestVPN\FastestVPN.exeSection loaded: msvcp140_clr0400.dll
      Source: C:\Program Files\FastestVPN\FastestVPN.exeSection loaded: sspicli.dll
      Source: C:\Program Files\FastestVPN\FastestVPN.exeSection loaded: mswsock.dll
      Source: C:\Program Files\FastestVPN\FastestVPN.exeSection loaded: windows.storage.dll
      Source: C:\Program Files\FastestVPN\FastestVPN.exeSection loaded: wldp.dll
      Source: C:\Program Files\FastestVPN\FastestVPN.exeSection loaded: profapi.dll
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00BB2765-6A77-11D0-A535-00C04FD7D062}\InProcServer32Jump to behavior
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpKey value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion RegisteredOwnerJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpWindow found: window name: TMainFormJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpAutomated click: I accept the agreement
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpAutomated click: Next
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpAutomated click: I accept the agreement
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpAutomated click: Next
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpAutomated click: Next
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpAutomated click: I accept the agreement
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpAutomated click: Next
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpAutomated click: I accept the agreement
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpAutomated click: Install
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpAutomated click: I accept the agreement
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpAutomated click: Next
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpAutomated click: I accept the agreement
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpAutomated click: Next
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpAutomated click: I accept the agreement
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpAutomated click: Next
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpAutomated click: I accept the agreement
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpAutomated click: Next
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpAutomated click: I accept the agreement
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpAutomated click: Next
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpAutomated click: I accept the agreement
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpAutomated click: Next
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpAutomated click: I accept the agreement
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpAutomated click: Next
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpAutomated click: I accept the agreement
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpAutomated click: Next
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpAutomated click: I accept the agreement
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpAutomated click: Next
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpAutomated click: I accept the agreement
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpAutomated click: Next
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpFile opened: C:\Windows\SysWOW64\MSFTEDIT.DLLJump to behavior
      Source: Window RecorderWindow detected: More than 3 window changes detected
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpWindow detected: License AgreementPlease read the following important information before continuing.Please read the following License Agreement. You must accept the terms of this agreement before continuing with the installation.Terms of ServiceThis is an agreement between you and FastestVPN.com for virtual private network communications services related services and features. It is NOT a service for the commission of criminal acts. It is an anonymity and privacy service. You agree not to violate any laws of any jurisdiction you are originating from or terminating into.You agree to protect your user id/password and our system from unauthorized use. You are responsible for all actions that occur on our servers where the login uses your user id/password.You agree not to use the system for sending spam port scanning scanning for open proxies or open relays sending opt-in email unsolicited email or any type or version of email sent in large quantities even if the email is ultimately sent off of another server. You agree not to launch any pop-ups from our service. You agree not to attack in any way shape or form any other computer or network while on our service.Actual service coverage speeds locations and quality may vary. The Service will attempt to be available at all times except for limited periods for maintenance and repair. However the Service may be subject to unavailability for a variety of factors beyond our control including emergencies third party service failures transmission equipment or network problems or limitations interference signal strength and may be interrupted refused limited or curtailed. We are not responsible for data messages or pages lost not delivered delayed or misdirected because of interruptions or performance issues with the Service or communications services or networks (e.g. T-1 lines or the Internet). We may impose usage or Service limits suspend Service or block certain kinds of usage in our sole discretion to protect users or the Service. Network speed is an estimate and is no indication of the speed at which your or the Service sends or receives data. Actual network speed will vary based on configuration compression network congestion and other factors. The accuracy and timeliness of data received is not guaranteed; delays or omissions may occur.We do not log any user activity (sites visited DNS lookups emails etc.) We only log access attempts to our servers (for security and troubleshooting). We do not get involved in any form of censorship. We do not give your personal info to any third parties. We do not cooperate with any requests for information unless we are ordered by a court of competent jurisdiction and the vast majority of these requests would not be from a court of competent jurisdiction. We will protect you to the max and our system is setup to automatically do so. There are hundreds of good reasons for being anonymous and we respect them fully.Hacking cracking distribution of viruses fraudulent activities network sa
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpWindow detected: License AgreementPlease read the following important information before continuing.Please read the following License Agreement. You must accept the terms of this agreement before continuing with the installation.Terms of ServiceThis is an agreement between you and FastestVPN.com for virtual private network communications services related services and features. It is NOT a service for the commission of criminal acts. It is an anonymity and privacy service. You agree not to violate any laws of any jurisdiction you are originating from or terminating into.You agree to protect your user id/password and our system from unauthorized use. You are responsible for all actions that occur on our servers where the login uses your user id/password.You agree not to use the system for sending spam port scanning scanning for open proxies or open relays sending opt-in email unsolicited email or any type or version of email sent in large quantities even if the email is ultimately sent off of another server. You agree not to launch any pop-ups from our service. You agree not to attack in any way shape or form any other computer or network while on our service.Actual service coverage speeds locations and quality may vary. The Service will attempt to be available at all times except for limited periods for maintenance and repair. However the Service may be subject to unavailability for a variety of factors beyond our control including emergencies third party service failures transmission equipment or network problems or limitations interference signal strength and may be interrupted refused limited or curtailed. We are not responsible for data messages or pages lost not delivered delayed or misdirected because of interruptions or performance issues with the Service or communications services or networks (e.g. T-1 lines or the Internet). We may impose usage or Service limits suspend Service or block certain kinds of usage in our sole discretion to protect users or the Service. Network speed is an estimate and is no indication of the speed at which your or the Service sends or receives data. Actual network speed will vary based on configuration compression network congestion and other factors. The accuracy and timeliness of data received is not guaranteed; delays or omissions may occur.We do not log any user activity (sites visited DNS lookups emails etc.) We only log access attempts to our servers (for security and troubleshooting). We do not get involved in any form of censorship. We do not give your personal info to any third parties. We do not cooperate with any requests for information unless we are ordered by a court of competent jurisdiction and the vast majority of these requests would not be from a court of competent jurisdiction. We will protect you to the max and our system is setup to automatically do so. There are hundreds of good reasons for being anonymous and we respect them fully.Hacking cracking distribution of viruses fraudulent activities network sa
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpWindow detected: License AgreementPlease read the following important information before continuing.Please read the following License Agreement. You must accept the terms of this agreement before continuing with the installation.Terms of ServiceThis is an agreement between you and FastestVPN.com for virtual private network communications services related services and features. It is NOT a service for the commission of criminal acts. It is an anonymity and privacy service. You agree not to violate any laws of any jurisdiction you are originating from or terminating into.You agree to protect your user id/password and our system from unauthorized use. You are responsible for all actions that occur on our servers where the login uses your user id/password.You agree not to use the system for sending spam port scanning scanning for open proxies or open relays sending opt-in email unsolicited email or any type or version of email sent in large quantities even if the email is ultimately sent off of another server. You agree not to launch any pop-ups from our service. You agree not to attack in any way shape or form any other computer or network while on our service.Actual service coverage speeds locations and quality may vary. The Service will attempt to be available at all times except for limited periods for maintenance and repair. However the Service may be subject to unavailability for a variety of factors beyond our control including emergencies third party service failures transmission equipment or network problems or limitations interference signal strength and may be interrupted refused limited or curtailed. We are not responsible for data messages or pages lost not delivered delayed or misdirected because of interruptions or performance issues with the Service or communications services or networks (e.g. T-1 lines or the Internet). We may impose usage or Service limits suspend Service or block certain kinds of usage in our sole discretion to protect users or the Service. Network speed is an estimate and is no indication of the speed at which your or the Service sends or receives data. Actual network speed will vary based on configuration compression network congestion and other factors. The accuracy and timeliness of data received is not guaranteed; delays or omissions may occur.We do not log any user activity (sites visited DNS lookups emails etc.) We only log access attempts to our servers (for security and troubleshooting). We do not get involved in any form of censorship. We do not give your personal info to any third parties. We do not cooperate with any requests for information unless we are ordered by a court of competent jurisdiction and the vast majority of these requests would not be from a court of competent jurisdiction. We will protect you to the max and our system is setup to automatically do so. There are hundreds of good reasons for being anonymous and we respect them fully.Hacking cracking distribution of viruses fraudulent activities network sa
      Source: C:\Program Files\FastestVPN\FastestVPN.exeFile opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpDirectory created: C:\Program Files\FastestVPNJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpDirectory created: C:\Program Files\FastestVPN\unins000.datJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpDirectory created: C:\Program Files\FastestVPN\is-RRCOJ.tmpJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpDirectory created: C:\Program Files\FastestVPN\is-ALQ73.tmpJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpDirectory created: C:\Program Files\FastestVPN\is-U1J8U.tmpJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpDirectory created: C:\Program Files\FastestVPN\is-G45GB.tmpJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpDirectory created: C:\Program Files\FastestVPN\is-NTHCN.tmpJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpDirectory created: C:\Program Files\FastestVPN\is-TQ8EO.tmpJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpDirectory created: C:\Program Files\FastestVPN\is-9RDU4.tmpJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpDirectory created: C:\Program Files\FastestVPN\is-Q6C5B.tmpJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpDirectory created: C:\Program Files\FastestVPN\is-HOPCL.tmpJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpDirectory created: C:\Program Files\FastestVPN\is-IAI1H.tmpJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpDirectory created: C:\Program Files\FastestVPN\is-L85R1.tmpJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpDirectory created: C:\Program Files\FastestVPN\is-2DBGR.tmpJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpDirectory created: C:\Program Files\FastestVPN\is-PQTD6.tmpJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpDirectory created: C:\Program Files\FastestVPN\is-JOA76.tmpJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpDirectory created: C:\Program Files\FastestVPN\is-GVJ6C.tmpJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpDirectory created: C:\Program Files\FastestVPN\is-7EKKK.tmpJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpDirectory created: C:\Program Files\FastestVPN\is-O9AN2.tmpJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpDirectory created: C:\Program Files\FastestVPN\is-CVBBG.tmpJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpDirectory created: C:\Program Files\FastestVPN\is-LGHQU.tmpJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpDirectory created: C:\Program Files\FastestVPN\is-67AMD.tmpJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpDirectory created: C:\Program Files\FastestVPN\is-2J970.tmpJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpDirectory created: C:\Program Files\FastestVPN\is-Q0KU7.tmpJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpDirectory created: C:\Program Files\FastestVPN\is-Q7N7F.tmpJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpDirectory created: C:\Program Files\FastestVPN\is-3TGVV.tmpJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpDirectory created: C:\Program Files\FastestVPN\is-RP1DP.tmpJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpDirectory created: C:\Program Files\FastestVPN\is-F69J1.tmpJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpDirectory created: C:\Program Files\FastestVPN\is-N38EL.tmpJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpDirectory created: C:\Program Files\FastestVPN\is-C2OV1.tmpJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpDirectory created: C:\Program Files\FastestVPN\is-OO2G4.tmpJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpDirectory created: C:\Program Files\FastestVPN\is-L0D1P.tmpJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpDirectory created: C:\Program Files\FastestVPN\is-E3G7B.tmpJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpDirectory created: C:\Program Files\FastestVPN\is-M7G5C.tmpJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpDirectory created: C:\Program Files\FastestVPN\is-AC86P.tmpJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpDirectory created: C:\Program Files\FastestVPN\is-0B265.tmpJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpDirectory created: C:\Program Files\FastestVPN\is-28KS7.tmpJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpDirectory created: C:\Program Files\FastestVPN\is-EFE8N.tmpJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpDirectory created: C:\Program Files\FastestVPN\is-MM0UH.tmpJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpDirectory created: C:\Program Files\FastestVPN\is-MD8VT.tmpJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpDirectory created: C:\Program Files\FastestVPN\is-9DEC1.tmpJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpDirectory created: C:\Program Files\FastestVPN\is-4N32R.tmpJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpDirectory created: C:\Program Files\FastestVPN\is-ILJO4.tmpJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpDirectory created: C:\Program Files\FastestVPN\is-K0SIQ.tmpJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpDirectory created: C:\Program Files\FastestVPN\is-EES9I.tmpJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpDirectory created: C:\Program Files\FastestVPN\is-DQ4HF.tmpJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpDirectory created: C:\Program Files\FastestVPN\is-MB689.tmpJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpDirectory created: C:\Program Files\FastestVPN\is-NJH6K.tmpJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpDirectory created: C:\Program Files\FastestVPN\is-1GRRH.tmpJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpDirectory created: C:\Program Files\FastestVPN\is-AASMC.tmpJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpDirectory created: C:\Program Files\FastestVPN\ResourcesJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpDirectory created: C:\Program Files\FastestVPN\Resources\is-CC2NP.tmpJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpDirectory created: C:\Program Files\FastestVPN\Resources\is-LGI72.tmpJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpDirectory created: C:\Program Files\FastestVPN\Resources\is-RFTSN.tmpJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpDirectory created: C:\Program Files\FastestVPN\Resources\is-EANN9.tmpJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpDirectory created: C:\Program Files\FastestVPN\Resources\is-6SU3B.tmpJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpDirectory created: C:\Program Files\FastestVPN\Resources\is-6403S.tmpJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpDirectory created: C:\Program Files\FastestVPN\Resources\is-2FSRR.tmpJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpDirectory created: C:\Program Files\FastestVPN\Resources\is-DJHTV.tmpJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpDirectory created: C:\Program Files\FastestVPN\Resources\is-B0TRN.tmpJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpDirectory created: C:\Program Files\FastestVPN\Resources\is-56EGR.tmpJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpDirectory created: C:\Program Files\FastestVPN\Resources\is-4NIRM.tmpJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpDirectory created: C:\Program Files\FastestVPN\Resources\is-O25O5.tmpJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpDirectory created: C:\Program Files\FastestVPN\Resources\is-CDU5N.tmpJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpDirectory created: C:\Program Files\FastestVPN\Resources\is-2225N.tmpJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpDirectory created: C:\Program Files\FastestVPN\Resources\is-79FJ0.tmpJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpDirectory created: C:\Program Files\FastestVPN\Resources\is-PHPNK.tmpJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpDirectory created: C:\Program Files\FastestVPN\Resources\is-QLNQ0.tmpJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpDirectory created: C:\Program Files\FastestVPN\Resources\is-80EU7.tmpJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpDirectory created: C:\Program Files\FastestVPN\Resources\is-E9ECF.tmpJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpDirectory created: C:\Program Files\FastestVPN\Resources\is-OOEI3.tmpJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpDirectory created: C:\Program Files\FastestVPN\Resources\is-9K65C.tmpJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpDirectory created: C:\Program Files\FastestVPN\Resources\is-EHLQ3.tmpJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpDirectory created: C:\Program Files\FastestVPN\Resources\dataJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpDirectory created: C:\Program Files\FastestVPN\Resources\data\is-BVC6U.tmpJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpDirectory created: C:\Program Files\FastestVPN\Resources\data\is-OKD1B.tmpJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpDirectory created: C:\Program Files\FastestVPN\Resources\data\is-6ID8J.tmpJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpDirectory created: C:\Program Files\FastestVPN\Resources\data\is-8S2T4.tmpJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpDirectory created: C:\Program Files\FastestVPN\Resources\driverJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpDirectory created: C:\Program Files\FastestVPN\Resources\driver\is-C6TL3.tmpJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpDirectory created: C:\Program Files\FastestVPN\Resources\driver\is-7QK33.tmpJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpDirectory created: C:\Program Files\FastestVPN\Resources\driver\windowsJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpDirectory created: C:\Program Files\FastestVPN\Resources\driver\windows\amd64Jump to behavior
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpDirectory created: C:\Program Files\FastestVPN\Resources\driver\windows\amd64\is-JEVOC.tmpJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpDirectory created: C:\Program Files\FastestVPN\Resources\driver\windows\amd64\is-K5BF2.tmpJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpDirectory created: C:\Program Files\FastestVPN\Resources\driver\windows\amd64\is-PS4TM.tmpJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpDirectory created: C:\Program Files\FastestVPN\Resources\driver\windows\amd64\is-HM6P4.tmpJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpDirectory created: C:\Program Files\FastestVPN\Resources\driver\windows\amd64\is-9R4TG.tmpJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpDirectory created: C:\Program Files\FastestVPN\Resources\driver\windows\amd64\is-C4BRK.tmpJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpDirectory created: C:\Program Files\FastestVPN\Resources\driver\windows\i386Jump to behavior
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpDirectory created: C:\Program Files\FastestVPN\Resources\driver\windows\i386\is-3L7RG.tmpJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpDirectory created: C:\Program Files\FastestVPN\Resources\driver\windows\i386\is-C8Q95.tmpJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpDirectory created: C:\Program Files\FastestVPN\Resources\driver\windows\i386\is-ESUKM.tmpJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpDirectory created: C:\Program Files\FastestVPN\Resources\driver\windows\i386\is-LC5II.tmpJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpDirectory created: C:\Program Files\FastestVPN\Resources\driver\windows\i386\is-DP5T8.tmpJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpDirectory created: C:\Program Files\FastestVPN\Resources\driver\windows\i386\is-6S3SU.tmpJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpDirectory created: C:\Program Files\FastestVPN\Resources\driver\windows10Jump to behavior
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpDirectory created: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64Jump to behavior
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpDirectory created: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\is-A6FEM.tmpJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpDirectory created: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\is-KVT7L.tmpJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpDirectory created: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\is-63E5N.tmpJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpDirectory created: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\is-4K729.tmpJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpDirectory created: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\is-OI0G9.tmpJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpDirectory created: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\is-KVOIK.tmpJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpDirectory created: C:\Program Files\FastestVPN\Resources\driver\windows10\i386Jump to behavior
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpDirectory created: C:\Program Files\FastestVPN\Resources\driver\windows10\i386\is-O4LBK.tmpJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpDirectory created: C:\Program Files\FastestVPN\Resources\driver\windows10\i386\is-MJ3AR.tmpJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpDirectory created: C:\Program Files\FastestVPN\Resources\driver\windows10\i386\is-SJ7I7.tmpJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpDirectory created: C:\Program Files\FastestVPN\Resources\driver\windows10\i386\is-SUSF8.tmpJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpDirectory created: C:\Program Files\FastestVPN\Resources\driver\windows10\i386\is-6GBPO.tmpJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpDirectory created: C:\Program Files\FastestVPN\Resources\driver\windows10\i386\is-GT2CF.tmpJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpDirectory created: C:\Program Files\FastestVPN\Resources\spJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpDirectory created: C:\Program Files\FastestVPN\Resources\sp\is-MDD17.tmpJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpDirectory created: C:\Program Files\FastestVPN\Resources\sp\is-EIAT9.tmpJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpDirectory created: C:\Program Files\FastestVPN\Resources\sp\driverJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpDirectory created: C:\Program Files\FastestVPN\Resources\sp\driver\windows7Jump to behavior
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpDirectory created: C:\Program Files\FastestVPN\Resources\sp\driver\windows7\amd64Jump to behavior
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpDirectory created: C:\Program Files\FastestVPN\Resources\sp\driver\windows7\amd64\is-N7JEQ.tmpJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpDirectory created: C:\Program Files\FastestVPN\Resources\sp\driver\windows7\i386Jump to behavior
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpDirectory created: C:\Program Files\FastestVPN\Resources\sp\driver\windows7\i386\is-UE60Q.tmpJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpDirectory created: C:\Program Files\FastestVPN\Resources\sp\driver\windows8Jump to behavior
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpDirectory created: C:\Program Files\FastestVPN\Resources\sp\driver\windows8\amd64Jump to behavior
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpDirectory created: C:\Program Files\FastestVPN\Resources\sp\driver\windows8\amd64\is-JUHU2.tmpJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpDirectory created: C:\Program Files\FastestVPN\Resources\sp\driver\windows8\i386Jump to behavior
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpDirectory created: C:\Program Files\FastestVPN\Resources\sp\driver\windows8\i386\is-T910E.tmpJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpDirectory created: C:\Program Files\FastestVPN\Resources\sp\releaseJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpDirectory created: C:\Program Files\FastestVPN\Resources\sp\release\is-8GLTJ.tmpJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpDirectory created: C:\Program Files\FastestVPN\Resources\sp\release\is-UGM5N.tmpJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpDirectory created: C:\Program Files\FastestVPN\ServiceJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpDirectory created: C:\Program Files\FastestVPN\Service\is-JFLTF.tmpJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpDirectory created: C:\Program Files\FastestVPN\Service\is-0SL0F.tmpJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpDirectory created: C:\Program Files\FastestVPN\Service\is-BBQCR.tmpJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpDirectory created: C:\Program Files\FastestVPN\Service\is-04ESR.tmpJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpDirectory created: C:\Program Files\FastestVPN\Service\is-PPT86.tmpJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpDirectory created: C:\Program Files\FastestVPN\Service\is-ABK95.tmpJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpDirectory created: C:\Program Files\FastestVPN\Service\is-9KRN8.tmpJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpDirectory created: C:\Program Files\FastestVPN\Service\is-M7EC0.tmpJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpDirectory created: C:\Program Files\FastestVPN\Service\is-5GMR0.tmpJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpDirectory created: C:\Program Files\FastestVPN\Service\is-AC1A8.tmpJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpDirectory created: C:\Program Files\FastestVPN\Service\is-51UBL.tmpJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpDirectory created: C:\Program Files\FastestVPN\Service\is-8F2SU.tmpJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpDirectory created: C:\Program Files\FastestVPN\Service\is-H126L.tmpJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpDirectory created: C:\Program Files\FastestVPN\Service\is-17HNF.tmpJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpDirectory created: C:\Program Files\FastestVPN\Service\is-4F6CO.tmpJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpDirectory created: C:\Program Files\FastestVPN\Service\is-C2OTC.tmpJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpDirectory created: C:\Program Files\FastestVPN\Service\is-SLLFS.tmpJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpDirectory created: C:\Program Files\FastestVPN\Service\is-NGC8I.tmpJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpDirectory created: C:\Program Files\FastestVPN\Service\is-D7DH9.tmpJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpDirectory created: C:\Program Files\FastestVPN\Service\is-O78V3.tmpJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpDirectory created: C:\Program Files\FastestVPN\Service\is-2G3FE.tmpJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpDirectory created: C:\Program Files\FastestVPN\Service\is-6V6PA.tmpJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpDirectory created: C:\Program Files\FastestVPN\Service\is-DPP41.tmpJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpDirectory created: C:\Program Files\FastestVPN\is-HB5NQ.tmpJump to behavior
      Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeDirectory created: C:\Program Files\FastestVPN\Service\InstallUtil.InstallLog
      Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeDirectory created: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.InstallLog
      Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeDirectory created: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.InstallState
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpRegistry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\FastestVPN_is1Jump to behavior
      Source: OqAVRCkQ3T.exeStatic PE information: certificate valid
      Source: OqAVRCkQ3T.exeStatic file information: File size 30699768 > 1048576
      Source: OqAVRCkQ3T.exeStatic PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
      Source: Binary string: System.Configuration.Install.pdb source: FastestVPN.WindowsService.exe, 00000027.00000002.3018526379.00000000026E6000.00000004.00000800.00020000.00000000.sdmp
      Source: Binary string: D:\a\SQLitePCL.raw\SQLitePCL.raw\SQLitePCL.raw\src\SQLitePCLRaw.core\obj\Release\netstandard2.0\SQLitePCLRaw.core.pdb source: FastestVPN.exe, FastestVPN.exe, 00000016.00000002.4016598487.0000000000D43000.00000004.00000020.00020000.00000000.sdmp, FastestVPN.exe, 00000016.00000002.4100015977.000000000BD42000.00000002.00000001.01000000.00000031.sdmp
      Source: Binary string: C:\Users\samuli\source\repos\tap-windows6\devcon\x64\Release\devcon.pdb source: tapinstall.exe, 0000000C.00000000.2573049272.00007FF6EC504000.00000002.00000001.01000000.00000009.sdmp, tapinstall.exe, 0000000C.00000002.2574132408.00007FF6EC504000.00000002.00000001.01000000.00000009.sdmp, tapinstall.exe, 0000000D.00000002.2641262515.00007FF6EC504000.00000002.00000001.01000000.00000009.sdmp, tapinstall.exe, 0000000D.00000000.2574430578.00007FF6EC504000.00000002.00000001.01000000.00000009.sdmp
      Source: Binary string: mTC:\Windows\FastestVPN.WindowsService.pdb source: FastestVPN.WindowsService.exe, 00000027.00000002.3016279133.00000000008F9000.00000004.00000010.00020000.00000000.sdmp
      Source: Binary string: C:\BuildAgent\work\da2c3d9512902c54\Tooling\obj\Release\System.Web.Cors\System.Web.Cors.pdb source: FastestVPN.WindowsService.exe, FastestVPN.WindowsService.exe, 00000032.00000002.4028919891.00000000042A2000.00000002.00000001.01000000.00000040.sdmp
      Source: Binary string: D:\Sagar Work FastestVPN\FastestVPN-Windows-App\FastestVPN.WindowsService\obj\Release\FastestVPN.WindowsService.pdbe\FastestVPN.WindowsServic source: FastestVPN.WindowsService.exe, 00000027.00000002.3016279133.00000000008F9000.00000004.00000010.00020000.00000000.sdmp
      Source: Binary string: /_/artifacts/obj/Microsoft.AspNet.SignalR.Client/Release/net45/Microsoft.AspNet.SignalR.Client.pdb source: is-3TGVV.tmp.2.dr
      Source: Binary string: D:\VPN core\FastestVPN-Windows-Core\VPN\obj\Debug\VPN.pdbB3\3 N3_CorDllMainmscoree.dll source: FastestVPN.WindowsService.exe, 00000032.00000002.4031178164.0000000004372000.00000002.00000001.01000000.00000042.sdmp, is-DQ4HF.tmp.2.dr
      Source: Binary string: D:\VPN core\FastestVPN-Windows-Core\VPN.Common\obj\Debug\VPN.Common.pdb source: OqAVRCkQ3T.tmp, 00000002.00000003.3069897606.0000000005580000.00000004.00001000.00020000.00000000.sdmp, FastestVPN.WindowsService.exe, FastestVPN.WindowsService.exe, 00000027.00000002.3020037971.0000000005062000.00000002.00000001.01000000.0000002B.sdmp
      Source: Binary string: D:\a\SQLitePCL.raw\SQLitePCL.raw\SQLitePCL.raw\src\SQLitePCLRaw.provider.dynamic_cdecl\obj\Release\netstandard2.0\SQLitePCLRaw.provider.dynamic_cdecl.pdb source: FastestVPN.exe, FastestVPN.exe, 00000016.00000002.4100328999.000000000BD62000.00000002.00000001.01000000.00000032.sdmp, is-AC86P.tmp.2.dr
      Source: Binary string: /_/artifacts/obj/Microsoft.AspNet.SignalR.Core/Release/net45/Microsoft.AspNet.SignalR.Core.pdbSHA256Z source: FastestVPN.WindowsService.exe, 00000027.00000002.3020164102.00000000050A2000.00000002.00000001.01000000.0000002A.sdmp, FastestVPN.WindowsService.exe, 00000032.00000002.4013372056.0000000000C66000.00000004.00000020.00020000.00000000.sdmp, FastestVPN.WindowsService.exe, 00000032.00000002.4019346826.000000000183D000.00000004.00000800.00020000.00000000.sdmp
      Source: Binary string: q!Microsoft.AspNet.SignalR.Core.pdb source: FastestVPN.WindowsService.exe, 00000032.00000002.4019346826.000000000183D000.00000004.00000800.00020000.00000000.sdmp
      Source: Binary string: c:\users\samuli\opt\tap-windows6-mattock\tapinstall\7600\objfre_wlh_amd64\amd64\tapinstall.pdb source: is-80EU7.tmp.2.dr
      Source: Binary string: Microsoft.Owin.Cors.pdbSHA256 source: FastestVPN.WindowsService.exe, 00000032.00000002.4028217019.0000000004282000.00000002.00000001.01000000.0000003C.sdmp
      Source: Binary string: \??\C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.PDBgz~ source: FastestVPN.WindowsService.exe, 00000027.00000002.3016856876.0000000000AE0000.00000004.00000020.00020000.00000000.sdmp
      Source: Binary string: E:\nt\dnsrv\sdktools\reskit\content\subinacl\source\obj\i386\subinacl.pdb source: OqAVRCkQ3T.tmp, 00000002.00000003.3069897606.0000000005580000.00000004.00001000.00020000.00000000.sdmp, subinacl.exe, subinacl.exe, 0000002E.00000002.3048569979.0000000001001000.00000020.00000001.01000000.00000035.sdmp, subinacl.exe, 0000002E.00000000.3045272953.0000000001001000.00000020.00000001.01000000.00000035.sdmp, is-0B265.tmp.2.dr
      Source: Binary string: qEC:\Program Files\FastestVPN\Service\Microsoft.AspNet.SignalR.Core.pdb source: FastestVPN.WindowsService.exe, 00000032.00000002.4019346826.000000000183D000.00000004.00000800.00020000.00000000.sdmp
      Source: Binary string: Microsoft.Owin.Cors.pdb source: FastestVPN.WindowsService.exe, FastestVPN.WindowsService.exe, 00000032.00000002.4028217019.0000000004282000.00000002.00000001.01000000.0000003C.sdmp
      Source: Binary string: \??\C:\Windows\symbols\dll\System.Configuration.Install.pdb source: FastestVPN.WindowsService.exe, 00000027.00000002.3016856876.0000000000AE0000.00000004.00000020.00020000.00000000.sdmp
      Source: Binary string: D:\Sagar Work FastestVPN\FastestVPN-Windows-App\FastestVPN.Common\obj\Release\FastestVPN.Common.pdb source: FastestVPN.WindowsService.exe, FastestVPN.WindowsService.exe, 00000032.00000002.4024676130.0000000004132000.00000002.00000001.01000000.00000036.sdmp
      Source: Binary string: Microsoft.Owin.Diagnostics.pdbSHA256 source: FastestVPN.WindowsService.exe, 00000032.00000002.4029624292.0000000004322000.00000002.00000001.01000000.0000003D.sdmp
      Source: Binary string: /_/artifacts/obj/Microsoft.AspNet.SignalR.Core/Release/net45/Microsoft.AspNet.SignalR.Core.pdb@\ source: FastestVPN.WindowsService.exe, 00000032.00000002.4019346826.000000000183D000.00000004.00000800.00020000.00000000.sdmp
      Source: Binary string: D:\VPN core\FastestVPN-Windows-Core\VPN\obj\Debug\VPN.pdb source: FastestVPN.WindowsService.exe, FastestVPN.WindowsService.exe, 00000032.00000002.4031178164.0000000004372000.00000002.00000001.01000000.00000042.sdmp, is-DQ4HF.tmp.2.dr
      Source: Binary string: C:\Users\samuli\source\repos\tap-windows6\src\Release\tap0901.pdb source: is-SUSF8.tmp.2.dr
      Source: Binary string: c:\Users\Junaid AK\Desktop\New folder (2)\SingleInstanceApplication\SingleInstanceApplication\obj\Release\SingleInstanceApplication.pdb source: FastestVPN.exe, FastestVPN.exe, 00000034.00000002.3092111478.0000000004F72000.00000002.00000001.01000000.00000010.sdmp, is-L0D1P.tmp.2.dr
      Source: Binary string: Microsoft.Owin.Hosting.pdbSHA256d"M! source: FastestVPN.WindowsService.exe, 00000032.00000002.4025246226.0000000004152000.00000002.00000001.01000000.00000037.sdmp
      Source: Binary string: D:\a\SQLitePCL.raw\SQLitePCL.raw\SQLitePCL.raw\src\SQLitePCLRaw.provider.dynamic_cdecl\obj\Release\netstandard2.0\SQLitePCLRaw.provider.dynamic_cdecl.pdbSHA256 source: FastestVPN.exe, 00000016.00000002.4100328999.000000000BD62000.00000002.00000001.01000000.00000032.sdmp, is-AC86P.tmp.2.dr
      Source: Binary string: C:\Windows\Microsoft.NET\Framework\v4.0.30319\spNet.SignalR.Core.pdb561934e089\System.dlllO~SZ source: FastestVPN.WindowsService.exe, 00000032.00000002.4013372056.0000000000BF7000.00000004.00000020.00020000.00000000.sdmp
      Source: Binary string: \??\C:\Windows\dll\Microsoft.AspNet.SignalR.Core.pdb source: FastestVPN.WindowsService.exe, 00000032.00000002.4013372056.0000000000BF7000.00000004.00000020.00020000.00000000.sdmp
      Source: Binary string: D:\VPN core\FastestVPN-Windows-Core\VPN.OpenVpn\obj\Debug\VPN.OpenVpn.pdbRhlh ^h_CorDllMainmscoree.dll source: FastestVPN.WindowsService.exe, 00000032.00000002.4031311191.0000000004382000.00000002.00000001.01000000.00000043.sdmp
      Source: Binary string: D:\a\1\s\SDK\AppCenterAnalytics\Microsoft.AppCenter.Analytics.WindowsDesktop\obj\Microsoft.AppCenter.Analytics.WindowsDesktop\Release\net472\Microsoft.AppCenter.Analytics.pdb source: FastestVPN.exe, FastestVPN.exe, 00000016.00000002.4069583912.00000000060B2000.00000002.00000001.01000000.0000002E.sdmp
      Source: Binary string: /_/artifacts/obj/Microsoft.AspNet.SignalR.Core/Release/net45/Microsoft.AspNet.SignalR.Core.pdb source: FastestVPN.WindowsService.exe, FastestVPN.WindowsService.exe, 00000027.00000002.3020164102.00000000050A2000.00000002.00000001.01000000.0000002A.sdmp, FastestVPN.WindowsService.exe, 00000032.00000002.4013372056.0000000000C66000.00000004.00000020.00020000.00000000.sdmp, FastestVPN.WindowsService.exe, 00000032.00000002.4013372056.0000000000BF7000.00000004.00000020.00020000.00000000.sdmp, FastestVPN.WindowsService.exe, 00000032.00000002.4019346826.000000000183D000.00000004.00000800.00020000.00000000.sdmp
      Source: Binary string: c:\projects\projectsJ\nfsdk2_1.6\bin\release\win32\nfapi.pdb< source: nfregdrv.exe, 00000023.00000002.2673541932.0000000010019000.00000002.00000001.01000000.00000028.sdmp, nfregdrv.exe, 00000024.00000002.2674794145.0000000010019000.00000002.00000001.01000000.00000028.sdmp
      Source: Binary string: D:\a\1\s\SDK\AppCenterCrashes\Microsoft.AppCenter.Crashes.WindowsDesktop\obj\Microsoft.AppCenter.Crashes.WindowsDesktop\Release\net472\Microsoft.AppCenter.Crashes.pdbSHA256 source: FastestVPN.exe, 00000016.00000002.4069804140.00000000060C2000.00000002.00000001.01000000.0000002F.sdmp
      Source: Binary string: Hardcodet.NotifyIcon.Wpf.pdbSHA256[ source: FastestVPN.exe, 00000016.00000002.4059523377.0000000005A92000.00000002.00000001.01000000.0000001D.sdmp
      Source: Binary string: h:\projects\netfilter3\bin\Release\Win32\nfregdrv.pdb )0THi source: nfregdrv.exe, 00000023.00000000.2664840496.0000000000408000.00000002.00000001.01000000.00000027.sdmp, nfregdrv.exe, 00000023.00000002.2671884603.0000000000408000.00000002.00000001.01000000.00000027.sdmp, nfregdrv.exe, 00000024.00000000.2673854725.0000000000408000.00000002.00000001.01000000.00000027.sdmp, nfregdrv.exe, 00000024.00000002.2674392034.0000000000408000.00000002.00000001.01000000.00000027.sdmp
      Source: Binary string: D:\a\SQLitePCL.raw\SQLitePCL.raw\SQLitePCL.raw\src\SQLitePCLRaw.bundle_green\obj\Release\net461\SQLitePCLRaw.batteries_v2.pdbSHA256x source: FastestVPN.exe, 00000016.00000002.4099109913.000000000BCF2000.00000002.00000001.01000000.00000030.sdmp
      Source: Binary string: /_/artifacts/obj/Microsoft.AspNet.SignalR.Client/Release/net45/Microsoft.AspNet.SignalR.Client.pdbSHA256 source: is-3TGVV.tmp.2.dr
      Source: Binary string: \??\C:\Windows\symbols\dll\System.ServiceProcess.pdb source: FastestVPN.WindowsService.exe, 00000027.00000002.3016856876.0000000000AE0000.00000004.00000020.00020000.00000000.sdmp
      Source: Binary string: C:\projects\projectsJ\nfsdk2_1.6\driver_wfp\Win8\Win8Release\x64\netfilter2.pdb source: xcopy.exe, 00000022.00000002.2663759074.000001F775D11000.00000004.00000020.00020000.00000000.sdmp
      Source: Binary string: h:\projects\netfilter3\bin\Release\Win32\nfregdrv.pdb source: nfregdrv.exe, 00000023.00000000.2664840496.0000000000408000.00000002.00000001.01000000.00000027.sdmp, nfregdrv.exe, 00000023.00000002.2671884603.0000000000408000.00000002.00000001.01000000.00000027.sdmp, nfregdrv.exe, 00000024.00000000.2673854725.0000000000408000.00000002.00000001.01000000.00000027.sdmp, nfregdrv.exe, 00000024.00000002.2674392034.0000000000408000.00000002.00000001.01000000.00000027.sdmp
      Source: Binary string: C:\Windows\System.Configuration.Install.pdbpdball.pdb source: FastestVPN.WindowsService.exe, 00000027.00000002.3016856876.0000000000AE0000.00000004.00000020.00020000.00000000.sdmp
      Source: Binary string: agar Work FastestVPN\FastestVPN-Windows-App\FastestVPN.WindowsService\obj\Release\FastestVPN.WindowsService.pdb source: FastestVPN.WindowsService.exe, 00000027.00000002.3016856876.0000000000AE0000.00000004.00000020.00020000.00000000.sdmp
      Source: Binary string: D:\VPN core\FastestVPN-Windows-Core\VPN.Common\obj\Debug\VPN.Common.pdbH source: OqAVRCkQ3T.tmp, 00000002.00000003.3069897606.0000000005580000.00000004.00001000.00020000.00000000.sdmp, FastestVPN.WindowsService.exe, 00000027.00000002.3020037971.0000000005062000.00000002.00000001.01000000.0000002B.sdmp
      Source: Binary string: D:\VPN core\FastestVPN-Windows-Core\VPN.WireGuard\obj\Debug\VPN.WireGuard.pdb source: FastestVPN.WindowsService.exe, FastestVPN.WindowsService.exe, 00000032.00000002.4032342359.00000000043D2000.00000002.00000001.01000000.00000045.sdmp
      Source: Binary string: /_/artifacts/obj/Microsoft.Extensions.DependencyInjection.Abstractions/Release/net462/Microsoft.Extensions.DependencyInjection.Abstractions.pdbSHA256 source: FastestVPN.exe, 00000016.00000002.4055392390.0000000005342000.00000002.00000001.01000000.00000013.sdmp
      Source: Binary string: D:\Sagar Work FastestVPN\FastestVPN-Windows-App\FastestVPN.Data.Local\obj\Release\FastestVPN.Data.Local.pdb source: FastestVPN.exe, FastestVPN.exe, 00000016.00000002.4058466848.00000000058C2000.00000002.00000001.01000000.0000001B.sdmp
      Source: Binary string: D:\Sagar Work FastestVPN\FastestVPN-Windows-App\FastestVPN.WindowsService\obj\Release\FastestVPN.WindowsService.pdb source: FastestVPN.WindowsService.exe, 00000027.00000000.2677169939.0000000000472000.00000002.00000001.01000000.00000029.sdmp, FastestVPN.WindowsService.exe, 00000027.00000002.3018526379.00000000026E6000.00000004.00000800.00020000.00000000.sdmp, FastestVPN.WindowsService.exe, 00000027.00000002.3016279133.00000000008F9000.00000004.00000010.00020000.00000000.sdmp
      Source: Binary string: E:\A\_work\89\s\corefx\bin\obj\AnyOS.AnyCPU.Release\System.Memory\netstandard\System.Memory.pdbSHA256HXhZm source: FastestVPN.exe, 00000016.00000002.4101032372.000000000BDD2000.00000002.00000001.01000000.00000033.sdmp
      Source: Binary string: Microsoft.Owin.pdbSHA256 source: FastestVPN.WindowsService.exe, 00000032.00000002.4026203269.00000000041A2000.00000002.00000001.01000000.00000039.sdmp
      Source: Binary string: mscorlib.pdb source: FastestVPN.exe, 00000016.00000002.4016598487.0000000000D43000.00000004.00000020.00020000.00000000.sdmp
      Source: Binary string: D:\VPN core\FastestVPN-Windows-Core\VPN.RAS\obj\Debug\VPN.RAS.pdb source: OqAVRCkQ3T.tmp, 00000002.00000003.3069897606.0000000005580000.00000004.00001000.00020000.00000000.sdmp, OqAVRCkQ3T.tmp, 00000002.00000002.3098599633.000000000018C000.00000004.00000010.00020000.00000000.sdmp, FastestVPN.WindowsService.exe, FastestVPN.WindowsService.exe, 00000032.00000002.4032058607.00000000043C2000.00000002.00000001.01000000.00000044.sdmp, is-NJH6K.tmp.2.dr
      Source: Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\System.pdb source: FastestVPN.WindowsService.exe, 00000032.00000002.4013372056.0000000000BF7000.00000004.00000020.00020000.00000000.sdmp
      Source: Binary string: c:\projects\projectsj\nfsdk2_1.6\driver_wfp\std\objfre_win7_amd64\amd64\netfilter2.pdb source: is-N7JEQ.tmp.2.dr
      Source: Binary string: \??\C:\Windows\Microsoft.AspNet.SignalR.Core.pdbi4hn source: FastestVPN.WindowsService.exe, 00000032.00000002.4013372056.0000000000BF7000.00000004.00000020.00020000.00000000.sdmp
      Source: Binary string: /_/artifacts/obj/Microsoft.Extensions.DependencyInjection.Abstractions/Release/net462/Microsoft.Extensions.DependencyInjection.Abstractions.pdb source: FastestVPN.exe, FastestVPN.exe, 00000016.00000002.4055392390.0000000005342000.00000002.00000001.01000000.00000013.sdmp
      Source: Binary string: C:\projects\wpfanimatedgif\WpfAnimatedGif\obj\Release\net40\WpfAnimatedGif.pdbSHA256 source: FastestVPN.exe, 00000016.00000002.4067532678.0000000005DF2000.00000002.00000001.01000000.0000001E.sdmp
      Source: Binary string: D:\a\1\s\SDK\AppCenter\Microsoft.AppCenter.WindowsDesktop\obj\Microsoft.AppCenter.WindowsDesktop\Release\net472\Microsoft.AppCenter.pdb source: FastestVPN.exe, FastestVPN.exe, 00000016.00000002.4078599339.0000000008862000.00000002.00000001.01000000.0000002D.sdmp, FastestVPN.exe, 00000016.00000002.4016598487.0000000000D43000.00000004.00000020.00020000.00000000.sdmp
      Source: Binary string: D:\Sagar Work FastestVPN\FastestVPN-Windows-App\FastestVPN.ViewModel\obj\Release\FastestVPN.ViewModel.pdb source: FastestVPN.exe, FastestVPN.exe, 00000016.00000002.4057691774.0000000005872000.00000002.00000001.01000000.00000017.sdmp
      Source: Binary string: Microsoft.Owin.Host.HttpListener.pdbSHA256-( source: FastestVPN.WindowsService.exe, 00000032.00000002.4026934919.00000000041D2000.00000002.00000001.01000000.0000003A.sdmp
      Source: Binary string: \??\C:\Windows\symbols\exe\FastestVPN.WindowsService.pdbL source: FastestVPN.WindowsService.exe, 00000027.00000002.3016856876.0000000000AE0000.00000004.00000020.00020000.00000000.sdmp
      Source: Binary string: Microsoft.Owin.Security.pdbSHA256U source: FastestVPN.WindowsService.exe, 00000032.00000002.4030619936.0000000004352000.00000002.00000001.01000000.0000003E.sdmp
      Source: Binary string: System.pdbN|2h|2 Z|2_CorDllMainmscoree.dll source: FastestVPN.WindowsService.exe, 00000032.00000002.4013372056.0000000000BF7000.00000004.00000020.00020000.00000000.sdmp, FastestVPN.WindowsService.exe, 00000032.00000002.4019346826.000000000183D000.00000004.00000800.00020000.00000000.sdmp
      Source: Binary string: \??\C:\Windows\symbols\exe\FastestVPN.WindowsService.pdb? source: FastestVPN.WindowsService.exe, 00000027.00000002.3016856876.0000000000AE0000.00000004.00000020.00020000.00000000.sdmp
      Source: Binary string: D:\Sagar Work FastestVPN\FastestVPN-Windows-App\FastestVPN.Data.Remote\obj\Release\FastestVPN.Data.Remote.pdb source: FastestVPN.exe, FastestVPN.exe, 00000016.00000002.4058632607.00000000058D2000.00000002.00000001.01000000.0000001C.sdmp
      Source: Binary string: D:\Sagar Work FastestVPN\FastestVPN-Windows-App\FastestVPN.BLL\obj\Release\FastestVPN.BLL.pdbVepe be_CorDllMainmscoree.dll source: FastestVPN.exe, 00000016.00000002.4058237613.00000000058B2000.00000002.00000001.01000000.0000001A.sdmp
      Source: Binary string: symbols\exe\FastestVPN.WindowsService.pdb source: FastestVPN.WindowsService.exe, 00000027.00000002.3016279133.00000000008F9000.00000004.00000010.00020000.00000000.sdmp
      Source: Binary string: /_/src/Flurl.Http/obj/Release/net472/Flurl.Http.pdbSHA256 source: is-CVBBG.tmp.2.dr
      Source: Binary string: D:\VPN core\FastestVPN-Windows-Core\VPN.OpenVpn\obj\Debug\VPN.OpenVpn.pdb source: FastestVPN.WindowsService.exe, FastestVPN.WindowsService.exe, 00000032.00000002.4031311191.0000000004382000.00000002.00000001.01000000.00000043.sdmp
      Source: Binary string: /_/artifacts/obj/Microsoft.Bcl.AsyncInterfaces/Release/net462/Microsoft.Bcl.AsyncInterfaces.pdbSHA256 source: FastestVPN.exe, 00000016.00000002.4056210634.00000000054A2000.00000002.00000001.01000000.00000014.sdmp, is-RP1DP.tmp.2.dr
      Source: Binary string: q^/_/artifacts/obj/Microsoft.AspNet.SignalR.Core/Release/net45/Microsoft.AspNet.SignalR.Core.pdb source: FastestVPN.WindowsService.exe, 00000032.00000002.4019346826.000000000183D000.00000004.00000800.00020000.00000000.sdmp
      Source: Binary string: Microsoft.Owin.Diagnostics.pdb source: FastestVPN.WindowsService.exe, FastestVPN.WindowsService.exe, 00000032.00000002.4029624292.0000000004322000.00000002.00000001.01000000.0000003D.sdmp
      Source: Binary string: mscorlib.pdb^ source: FastestVPN.exe, 00000016.00000002.4070565606.00000000085E3000.00000004.00000020.00020000.00000000.sdmp
      Source: Binary string: System.ServiceProcess.pdb source: FastestVPN.WindowsService.exe, 00000027.00000002.3018526379.00000000026E6000.00000004.00000800.00020000.00000000.sdmp
      Source: Binary string: c:\projects\projectsJ\nfsdk2_1.5.5\bin\release_c_api\win32\nfapi.pdb source: is-17HNF.tmp.2.dr
      Source: Binary string: /_/artifacts/obj/Microsoft.Extensions.DependencyInjection/Release/net462/Microsoft.Extensions.DependencyInjection.pdbSHA256 source: FastestVPN.exe, 00000016.00000002.4056338798.00000000054B2000.00000002.00000001.01000000.00000015.sdmp
      Source: Binary string: System.Configuration.Install.pdbxF source: FastestVPN.WindowsService.exe, 00000027.00000002.3018526379.00000000026E6000.00000004.00000800.00020000.00000000.sdmp
      Source: Binary string: D:\VPN core\FastestVPN-Windows-Core\VPN.WireGuard\obj\Debug\VPN.WireGuard.pdb2;L; >;_CorDllMainmscoree.dll source: FastestVPN.WindowsService.exe, 00000032.00000002.4032342359.00000000043D2000.00000002.00000001.01000000.00000045.sdmp
      Source: Binary string: E:\nt\dnsrv\sdktools\reskit\content\subinacl\source\obj\i386\subinacl.pdbPa source: OqAVRCkQ3T.tmp, 00000002.00000003.3069897606.0000000005580000.00000004.00001000.00020000.00000000.sdmp, subinacl.exe, 0000002E.00000002.3048569979.0000000001001000.00000020.00000001.01000000.00000035.sdmp, subinacl.exe, 0000002E.00000000.3045272953.0000000001001000.00000020.00000001.01000000.00000035.sdmp, is-0B265.tmp.2.dr
      Source: Binary string: C:\projects\projectsJ\nfsdk2_1.6\driver_wfp\Win8\Win8Release\x64\netfilter2.pdb source: xcopy.exe, 00000022.00000002.2663759074.000001F775D11000.00000004.00000020.00020000.00000000.sdmp
      Source: Binary string: D:\a\1\s\SDK\AppCenterAnalytics\Microsoft.AppCenter.Analytics.WindowsDesktop\obj\Microsoft.AppCenter.Analytics.WindowsDesktop\Release\net472\Microsoft.AppCenter.Analytics.pdbSHA256 source: FastestVPN.exe, 00000016.00000002.4069583912.00000000060B2000.00000002.00000001.01000000.0000002E.sdmp
      Source: Binary string: E:\A\_work\156\s\corefx\bin\obj\AnyOS.AnyCPU.Release\System.Threading.Tasks.Extensions\netfx\System.Threading.Tasks.Extensions.pdb source: FastestVPN.exe, FastestVPN.exe, 00000016.00000002.4056758757.00000000054D2000.00000002.00000001.01000000.00000016.sdmp
      Source: Binary string: D:\Sagar Work FastestVPN\FastestVPN-Windows-App\FastestVPN.Diagnostics\obj\Release\FastestVPN.Diagnostics.pdb source: FastestVPN.exe, FastestVPN.exe, 00000016.00000002.4056893733.00000000054E2000.00000002.00000001.01000000.00000019.sdmp
      Source: Binary string: c:\projects\projectsJ\nfsdk2_1.6\bin\release\win32\nfapi.pdb source: nfregdrv.exe, 00000023.00000002.2673541932.0000000010019000.00000002.00000001.01000000.00000028.sdmp, nfregdrv.exe, 00000024.00000002.2674794145.0000000010019000.00000002.00000001.01000000.00000028.sdmp
      Source: Binary string: /_/artifacts/obj/Microsoft.Bcl.AsyncInterfaces/Release/net462/Microsoft.Bcl.AsyncInterfaces.pdb source: FastestVPN.exe, FastestVPN.exe, 00000016.00000002.4056210634.00000000054A2000.00000002.00000001.01000000.00000014.sdmp, is-RP1DP.tmp.2.dr
      Source: Binary string: c:\Users\lodejard\Projects\owin-hosting\src\main\Owin.Startup\obj\Release\Owin.pdb source: FastestVPN.WindowsService.exe, FastestVPN.WindowsService.exe, 00000032.00000002.4025763037.0000000004172000.00000002.00000001.01000000.00000038.sdmp
      Source: Binary string: Microsoft.Owin.Hosting.pdb source: FastestVPN.WindowsService.exe, FastestVPN.WindowsService.exe, 00000032.00000002.4025246226.0000000004152000.00000002.00000001.01000000.00000037.sdmp
      Source: Binary string: D:\Sagar Work FastestVPN\FastestVPN-Windows-App\FastestVPN.DependencyInjection\obj\Release\FastestVPN.DI.pdb source: FastestVPN.exe, FastestVPN.exe, 00000016.00000002.4055277483.0000000005332000.00000002.00000001.01000000.00000012.sdmp, is-Q6C5B.tmp.2.dr
      Source: Binary string: D:\a\1\s\SDK\AppCenterCrashes\Microsoft.AppCenter.Crashes.WindowsDesktop\obj\Microsoft.AppCenter.Crashes.WindowsDesktop\Release\net472\Microsoft.AppCenter.Crashes.pdb source: FastestVPN.exe, FastestVPN.exe, 00000016.00000002.4069804140.00000000060C2000.00000002.00000001.01000000.0000002F.sdmp
      Source: Binary string: \??\C:\Windows\FastestVPN.WindowsService.pdbdb source: FastestVPN.WindowsService.exe, 00000027.00000002.3016856876.0000000000AE0000.00000004.00000020.00020000.00000000.sdmp
      Source: Binary string: /_/artifacts/obj/Microsoft.Extensions.DependencyInjection/Release/net462/Microsoft.Extensions.DependencyInjection.pdb source: FastestVPN.exe, FastestVPN.exe, 00000016.00000002.4056338798.00000000054B2000.00000002.00000001.01000000.00000015.sdmp
      Source: Binary string: C:\Windows\System.ServiceProcess.pdbpdbess.pdb source: FastestVPN.WindowsService.exe, 00000027.00000002.3016856876.0000000000AE0000.00000004.00000020.00020000.00000000.sdmp
      Source: Binary string: c:\Users\Junaid AK\Desktop\New folder (2)\SingleInstanceApplication\SingleInstanceApplication\obj\Release\SingleInstanceApplication.pdb@:^: P:_CorDllMainmscoree.dll source: FastestVPN.exe, 00000034.00000002.3092111478.0000000004F72000.00000002.00000001.01000000.00000010.sdmp, is-L0D1P.tmp.2.dr
      Source: Binary string: /_/Src/Newtonsoft.Json/obj/Release/net45/Newtonsoft.Json.pdbSHA256 source: OqAVRCkQ3T.tmp, 00000002.00000003.3069897606.0000000005580000.00000004.00001000.00020000.00000000.sdmp, FastestVPN.WindowsService.exe, 00000032.00000002.4032701232.0000000004432000.00000002.00000001.01000000.0000003F.sdmp
      Source: Binary string: E:\A\_work\89\s\corefx\bin\obj\AnyOS.AnyCPU.Release\System.Memory\netstandard\System.Memory.pdb source: FastestVPN.exe, FastestVPN.exe, 00000016.00000002.4101032372.000000000BDD2000.00000002.00000001.01000000.00000033.sdmp
      Source: Binary string: C:\projects\wpfanimatedgif\WpfAnimatedGif\obj\Release\net40\WpfAnimatedGif.pdb source: FastestVPN.exe, FastestVPN.exe, 00000016.00000002.4067532678.0000000005DF2000.00000002.00000001.01000000.0000001E.sdmp
      Source: Binary string: D:\Sagar Work FastestVPN\FastestVPN-Windows-App\FastestVPN.BLL\obj\Release\FastestVPN.BLL.pdb source: FastestVPN.exe, FastestVPN.exe, 00000016.00000002.4058237613.00000000058B2000.00000002.00000001.01000000.0000001A.sdmp
      Source: Binary string: D:\a\SQLitePCL.raw\SQLitePCL.raw\SQLitePCL.raw\src\SQLitePCLRaw.bundle_green\obj\Release\net461\SQLitePCLRaw.batteries_v2.pdb source: FastestVPN.exe, FastestVPN.exe, 00000016.00000002.4099109913.000000000BCF2000.00000002.00000001.01000000.00000030.sdmp
      Source: Binary string: Microsoft.Owin.Security.pdb source: FastestVPN.WindowsService.exe, FastestVPN.WindowsService.exe, 00000032.00000002.4030619936.0000000004352000.00000002.00000001.01000000.0000003E.sdmp
      Source: Binary string: D:\Sagar Work FastestVPN\FastestVPN-Windows-App\FastestVPN.Common\obj\Release\FastestVPN.Common.pdb source: FastestVPN.WindowsService.exe, 00000032.00000002.4024676130.0000000004132000.00000002.00000001.01000000.00000036.sdmp
      Source: Binary string: /_/Src/Newtonsoft.Json/obj/Release/net45/Newtonsoft.Json.pdb source: OqAVRCkQ3T.tmp, 00000002.00000003.3069897606.0000000005580000.00000004.00001000.00020000.00000000.sdmp, FastestVPN.WindowsService.exe, FastestVPN.WindowsService.exe, 00000032.00000002.4032701232.0000000004432000.00000002.00000001.01000000.0000003F.sdmp
      Source: Binary string: \??\C:\Windows\dll\System.ServiceProcess.pdb* source: FastestVPN.WindowsService.exe, 00000027.00000002.3016856876.0000000000AE0000.00000004.00000020.00020000.00000000.sdmp
      Source: Binary string: D:\VPN core\FastestVPN-Windows-Core\VPN.AdvancedNetwork\obj\Debug\VPN.AdvancedNetwork.pdb source: FastestVPN.WindowsService.exe, FastestVPN.WindowsService.exe, 00000032.00000002.4029086350.00000000042B2000.00000002.00000001.01000000.00000041.sdmp, is-NGC8I.tmp.2.dr
      Source: Binary string: D:\Sagar Work FastestVPN\FastestVPN-Windows-App\FastestVPN\obj\Release\FastestVPN.pdb source: FastestVPN.exe, 00000016.00000000.2625434306.00000000005AD000.00000002.00000001.01000000.0000000D.sdmp
      Source: Binary string: mC:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.pdbY source: FastestVPN.WindowsService.exe, 00000027.00000002.3016279133.00000000008F9000.00000004.00000010.00020000.00000000.sdmp
      Source: Binary string: \??\C:\Windows\exe\FastestVPN.WindowsService.pdb source: FastestVPN.WindowsService.exe, 00000027.00000002.3016856876.0000000000AE0000.00000004.00000020.00020000.00000000.sdmp
      Source: Binary string: \??\C:\Windows\dll\System.ServiceProcess.pdbLw source: FastestVPN.WindowsService.exe, 00000027.00000002.3016856876.0000000000AE0000.00000004.00000020.00020000.00000000.sdmp
      Source: Binary string: System.pdb source: FastestVPN.WindowsService.exe, 00000032.00000002.4013372056.0000000000BF7000.00000004.00000020.00020000.00000000.sdmp, FastestVPN.WindowsService.exe, 00000032.00000002.4019346826.000000000183D000.00000004.00000800.00020000.00000000.sdmp
      Source: Binary string: b77a5c561934e089.pdbj source: FastestVPN.WindowsService.exe, 00000027.00000002.3016856876.0000000000AE0000.00000004.00000020.00020000.00000000.sdmp
      Source: Binary string: Microsoft.Owin.Host.HttpListener.pdb source: FastestVPN.WindowsService.exe, FastestVPN.WindowsService.exe, 00000032.00000002.4026934919.00000000041D2000.00000002.00000001.01000000.0000003A.sdmp
      Source: Binary string: D:\a\1\s\SDK\AppCenter\Microsoft.AppCenter.WindowsDesktop\obj\Microsoft.AppCenter.WindowsDesktop\Release\net472\Microsoft.AppCenter.pdbSHA256 source: FastestVPN.exe, 00000016.00000002.4078599339.0000000008862000.00000002.00000001.01000000.0000002D.sdmp, FastestVPN.exe, 00000016.00000002.4016598487.0000000000D43000.00000004.00000020.00020000.00000000.sdmp
      Source: Binary string: D:\Sagar Work FastestVPN\FastestVPN-Windows-App\FastestVPN.Data.Remote\obj\Release\FastestVPN.Data.Remote.pdbb^|^ n^_CorDllMainmscoree.dll source: FastestVPN.exe, 00000016.00000002.4058632607.00000000058D2000.00000002.00000001.01000000.0000001C.sdmp
      Source: Binary string: D:\Sagar Work FastestVPN\FastestVPN-Windows-App\FastestVPN.DependencyInjection\obj\Release\FastestVPN.DI.pdbY6s6 e6_CorDllMainmscoree.dll source: FastestVPN.exe, 00000016.00000002.4055277483.0000000005332000.00000002.00000001.01000000.00000012.sdmp, is-Q6C5B.tmp.2.dr
      Source: Binary string: c:\users\samuli\opt\tap-windows6-mattock\tapinstall\7600\objfre_wlh_amd64\amd64\tapinstall.pdbH source: is-80EU7.tmp.2.dr
      Source: Binary string: C:\Users\samuli\source\repos\tap-windows6\src\x64\Release\tap0901.pdb source: drvinst.exe, 00000013.00000003.2602533419.000002520D746000.00000004.00000020.00020000.00000000.sdmp, drvinst.exe, 00000013.00000003.2600241743.000002520D6FB000.00000004.00000020.00020000.00000000.sdmp, is-HM6P4.tmp.2.dr
      Source: Binary string: \??\C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.pdb7q source: FastestVPN.WindowsService.exe, 00000027.00000002.3016856876.0000000000AE0000.00000004.00000020.00020000.00000000.sdmp
      Source: Binary string: D:\a\SQLitePCL.raw\SQLitePCL.raw\SQLitePCL.raw\src\SQLitePCLRaw.core\obj\Release\netstandard2.0\SQLitePCLRaw.core.pdbSHA256Ci\ source: FastestVPN.exe, 00000016.00000002.4016598487.0000000000D43000.00000004.00000020.00020000.00000000.sdmp, FastestVPN.exe, 00000016.00000002.4100015977.000000000BD42000.00000002.00000001.01000000.00000031.sdmp
      Source: Binary string: /_/src/Flurl.Http/obj/Release/net472/Flurl.Http.pdb source: is-CVBBG.tmp.2.dr
      Source: Binary string: Microsoft.Owin.pdb source: FastestVPN.WindowsService.exe, FastestVPN.WindowsService.exe, 00000032.00000002.4026203269.00000000041A2000.00000002.00000001.01000000.00000039.sdmp
      Source: Binary string: \??\C:\Windows\dll\System.Configuration.Install.pdb source: FastestVPN.WindowsService.exe, 00000027.00000002.3016856876.0000000000AE0000.00000004.00000020.00020000.00000000.sdmp
      Source: Binary string: \??\C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.pdb source: FastestVPN.WindowsService.exe, 00000027.00000002.3016856876.0000000000AE0000.00000004.00000020.00020000.00000000.sdmp
      Source: Binary string: C:\Windows\FastestVPN.WindowsService.pdbpdbice.pdb* source: FastestVPN.WindowsService.exe, 00000027.00000002.3016856876.0000000000AE0000.00000004.00000020.00020000.00000000.sdmp
      Source: Binary string: Hardcodet.NotifyIcon.Wpf.pdb source: FastestVPN.exe, FastestVPN.exe, 00000016.00000002.4059523377.0000000005A92000.00000002.00000001.01000000.0000001D.sdmp
      Source: Binary string: m.pdb source: FastestVPN.WindowsService.exe, 00000027.00000002.3016279133.00000000008F9000.00000004.00000010.00020000.00000000.sdmp

      Data Obfuscation

      barindex
      Suspicious powershell command line found
      Source: C:\Program Files\FastestVPN\FastestVPN.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "powershell" -windowstyle hidden get-wmiobject Win32_ComputerSystemProduct | Select-Object -ExpandProperty UUID
      Source: C:\Program Files\FastestVPN\FastestVPN.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "powershell" -windowstyle hidden get-wmiobject Win32_ComputerSystemProduct | Select-Object -ExpandProperty UUID
      Source: is-JFLTF.tmp.2.drStatic PE information: 0xAB462008 [Fri Jan 21 02:20:56 2061 UTC]
      Source: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exeCode function: 12_2_00007FF6EC4B6C90 SetupOpenInfFileW,GetLastError,SetupFindFirstLineW,SetupGetStringFieldW,SetupFindFirstLineW,SetupGetStringFieldW,CLSIDFromString,SetupDiGetClassDescriptionExW,LoadLibraryW,GetProcAddress,GetLastError,GetLastError,SetupFindFirstLineW,SetupGetStringFieldW,SetupGetStringFieldW,SetupCloseInfFile,FreeLibrary,12_2_00007FF6EC4B6C90
      Source: OqAVRCkQ3T.exeStatic PE information: section name: .didata
      Source: OqAVRCkQ3T.tmp.0.drStatic PE information: section name: .didata
      Source: C:\Program Files\FastestVPN\Resources\ComDebug.exeCode function: 6_2_007A7256 push 00000078h; ret 6_2_007A7259
      Source: C:\Program Files\FastestVPN\Resources\ComDebug.exeCode function: 6_2_007A8FA5 push 00000078h; ret 6_2_007A8FA9
      Source: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exeCode function: 12_2_00007FF6EC4FC576 push rsi; ret 12_2_00007FF6EC4FC579
      Source: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exeCode function: 12_2_00007FF6EC4FC52C push rsp; retn 0004h12_2_00007FF6EC4FC52D
      Source: C:\Program Files\FastestVPN\FastestVPN.exeCode function: 22_2_0534437F push es; retf 22_2_0534445C
      Source: C:\Program Files\FastestVPN\FastestVPN.exeCode function: 22_2_0534435D push es; retf 22_2_0534437E
      Source: C:\Program Files\FastestVPN\FastestVPN.exeCode function: 22_2_054BADC0 push cs; ret 22_2_054BAE10
      Source: C:\Program Files\FastestVPN\FastestVPN.exeCode function: 22_2_054B82C7 push ss; ret 22_2_054B82CA
      Source: C:\Program Files\FastestVPN\FastestVPN.exeCode function: 22_2_054B79DF push es; retf 22_2_054B7A7E
      Source: C:\Program Files\FastestVPN\FastestVPN.exeCode function: 22_2_054BAEF2 push cs; retf 22_2_054BAEF6
      Source: C:\Program Files\FastestVPN\FastestVPN.exeCode function: 22_2_054BAF04 push cs; retf 22_2_054BAF0E
      Source: C:\Program Files\FastestVPN\FastestVPN.exeCode function: 22_2_054BAF10 push cs; retf 22_2_054BAF1A
      Source: C:\Program Files\FastestVPN\FastestVPN.exeCode function: 22_2_054BAD3F push cs; ret 22_2_054BADBC
      Source: C:\Program Files\FastestVPN\FastestVPN.exeCode function: 22_2_05873564 push es; ret 22_2_05873585
      Source: C:\Program Files\FastestVPN\FastestVPN.exeCode function: 22_2_05872FE2 push es; ret 22_2_05873585
      Source: C:\Program Files\FastestVPN\FastestVPN.exeCode function: 22_2_060C5883 push cs; ret 22_2_060C58CC
      Source: C:\Program Files\FastestVPN\FastestVPN.exeCode function: 22_2_0BD67F11 push cs; ret 22_2_0BD67F12
      Source: C:\Program Files\FastestVPN\FastestVPN.exeCode function: 22_2_0BD656FA push ss; iretd 22_2_0BD65702
      Source: C:\Program Files\FastestVPN\FastestVPN.exeCode function: 22_2_0BDD5A5F push 00000028h; retf 0000h22_2_0BDD5A62
      Source: C:\Program Files\FastestVPN\FastestVPN.exeCode function: 22_2_00CFEFCB pushfd ; iretd 22_2_00CFEFF9
      Source: C:\Program Files\FastestVPN\FastestVPN.exeCode function: 22_2_00CFB438 pushfd ; iretd 22_2_00CFB4F9
      Source: C:\Program Files\FastestVPN\FastestVPN.exeCode function: 22_2_05E09F49 pushad ; iretd 22_2_05E09F55
      Source: C:\Program Files\FastestVPN\FastestVPN.exeCode function: 22_2_05E00148 push esp; iretd 22_2_05E001F1
      Source: C:\Program Files\FastestVPN\FastestVPN.exeCode function: 22_2_05E09EEF push esp; iretd 22_2_05E09EFD
      Source: C:\Program Files\FastestVPN\FastestVPN.exeCode function: 22_2_0AA43B4F push dword ptr [esp+ecx*2-75h]; ret 22_2_0AA43B53
      Source: C:\Program Files\FastestVPN\FastestVPN.exeCode function: 22_2_0BDC5520 pushad ; iretd 22_2_0BDC5521
      Source: C:\Program Files\FastestVPN\FastestVPN.exeCode function: 22_2_0BDC54A7 pushad ; iretd 22_2_0BDC5521
      Source: C:\Program Files\FastestVPN\Resources\sp\release\nfregdrv.exeCode function: 35_2_004028FD push ecx; ret 35_2_00402910
      Source: C:\Program Files\FastestVPN\Resources\sp\release\nfregdrv.exeCode function: 35_2_1000A089 push ecx; ret 35_2_1000A09C
      Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeCode function: 39_2_0506569F push ss; retf 39_2_0506573E
      Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeCode function: 39_2_050654A6 push cs; retf 39_2_05065546
      Source: is-2DBGR.tmp.2.drStatic PE information: section name: .text entropy: 7.662424467871785

      Persistence and Installation Behavior

      barindex
      Uses cmd line tools excessively to alter registry or file data
      Source: C:\Windows\System32\cmd.exeProcess created: reg.exe
      Source: C:\Windows\System32\cmd.exeProcess created: reg.exe
      Source: C:\Windows\System32\cmd.exeProcess created: reg.exe
      Source: C:\Windows\System32\cmd.exeProcess created: reg.exeJump to behavior
      Source: C:\Windows\System32\cmd.exeProcess created: reg.exe
      Source: C:\Windows\System32\cmd.exeProcess created: reg.exe
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpFile created: C:\Program Files\FastestVPN\Resources\driver\windows10\i386\tapinstall.exe (copy)Jump to dropped file
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpFile created: C:\Program Files\FastestVPN\Service\is-SLLFS.tmpJump to dropped file
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpFile created: C:\Program Files\FastestVPN\is-M7G5C.tmpJump to dropped file
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpFile created: C:\Program Files\FastestVPN\Microsoft.Extensions.DependencyInjection.Abstractions.dll (copy)Jump to dropped file
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpFile created: C:\Program Files\FastestVPN\Resources\is-E9ECF.tmpJump to dropped file
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpFile created: C:\Program Files\FastestVPN\Resources\is-6SU3B.tmpJump to dropped file
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpFile created: C:\Program Files\FastestVPN\Resources\is-DJHTV.tmpJump to dropped file
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpFile created: C:\Program Files\FastestVPN\Resources\libssl-1_1-x64.dll (copy)Jump to dropped file
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpFile created: C:\Program Files\FastestVPN\Resources\driver\windows\amd64\tap0901.sys (copy)Jump to dropped file
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpFile created: C:\Program Files\FastestVPN\Resources\is-QLNQ0.tmpJump to dropped file
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpFile created: C:\Program Files\FastestVPN\iphelperclose.dll (copy)Jump to dropped file
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpFile created: C:\Program Files\FastestVPN\Microsoft.AppCenter.Crashes.dll (copy)Jump to dropped file
      Source: C:\Windows\System32\drvinst.exeFile created: C:\Windows\System32\DriverStore\Temp\{eba04833-fdea-4f40-ac46-b79bff73f8ea}\SETB2A8.tmpJump to dropped file
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpFile created: C:\Program Files\FastestVPN\Service\iphelperclose.dll (copy)Jump to dropped file
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpFile created: C:\Program Files\FastestVPN\Service\is-6V6PA.tmpJump to dropped file
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpFile created: C:\Program Files\FastestVPN\Resources\is-CDU5N.tmpJump to dropped file
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpFile created: C:\Program Files\FastestVPN\is-MM0UH.tmpJump to dropped file
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpFile created: C:\Program Files\FastestVPN\Service\Microsoft.Owin.Hosting.dll (copy)Jump to dropped file
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpFile created: C:\Program Files\FastestVPN\Service\nfapi.dll (copy)Jump to dropped file
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpFile created: C:\Program Files\FastestVPN\Resources\sp\driver\windows8\i386\fastestvpndriver.sys (copy)Jump to dropped file
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpFile created: C:\Users\user\AppData\Local\Temp\is-28AK4.tmp\_isetup\_setup64.tmpJump to dropped file
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpFile created: C:\Program Files\FastestVPN\Service\is-PPT86.tmpJump to dropped file
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpFile created: C:\Program Files\FastestVPN\subinacl.exe (copy)Jump to dropped file
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpFile created: C:\Program Files\FastestVPN\Resources\libssl32.dll (copy)Jump to dropped file
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpFile created: C:\Program Files\FastestVPN\unins000.exe (copy)Jump to dropped file
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpFile created: C:\Program Files\FastestVPN\Resources\sp\driver\windows8\amd64\is-JUHU2.tmpJump to dropped file
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpFile created: C:\Program Files\FastestVPN\Resources\openvpnserv.exe (copy)Jump to dropped file
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpFile created: C:\Program Files\FastestVPN\Resources\driver\windows\amd64\tapinstall.exe (copy)Jump to dropped file
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpFile created: C:\Program Files\FastestVPN\Resources\is-CC2NP.tmpJump to dropped file
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpFile created: C:\Program Files\FastestVPN\FastestVPN.Data.Remote.dll (copy)Jump to dropped file
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpFile created: C:\Program Files\FastestVPN\Resources\openssl.exe (copy)Jump to dropped file
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpFile created: C:\Program Files\FastestVPN\Resources\is-80EU7.tmpJump to dropped file
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpFile created: C:\Program Files\FastestVPN\SQLitePCLRaw.batteries_v2.dll (copy)Jump to dropped file
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpFile created: C:\Program Files\FastestVPN\Resources\sp\release\nfapi.dll (copy)Jump to dropped file
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpFile created: C:\Program Files\FastestVPN\Service\is-9KRN8.tmpJump to dropped file
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpFile created: C:\Program Files\FastestVPN\is-U1J8U.tmpJump to dropped file
      Source: C:\Windows\System32\drvinst.exeFile created: C:\Windows\System32\drivers\SETBA95.tmpJump to dropped file
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpFile created: C:\Program Files\FastestVPN\Resources\is-56EGR.tmpJump to dropped file
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpFile created: C:\Program Files\FastestVPN\Microsoft.AppCenter.Analytics.dll (copy)Jump to dropped file
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpFile created: C:\Program Files\FastestVPN\Service\subinacl.exe (copy)Jump to dropped file
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpFile created: C:\Program Files\FastestVPN\Resources\is-RFTSN.tmpJump to dropped file
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpFile created: C:\Program Files\FastestVPN\Resources\liblzo2-2.dll (copy)Jump to dropped file
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpFile created: C:\Program Files\FastestVPN\is-F69J1.tmpJump to dropped file
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpFile created: C:\Program Files\FastestVPN\System.Threading.Tasks.Extensions.dll (copy)Jump to dropped file
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpFile created: C:\Program Files\FastestVPN\System.Memory.dll (copy)Jump to dropped file
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpFile created: C:\Program Files\FastestVPN\is-TQ8EO.tmpJump to dropped file
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpFile created: C:\Program Files\FastestVPN\is-DQ4HF.tmpJump to dropped file
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpFile created: C:\Program Files\FastestVPN\is-AC86P.tmpJump to dropped file
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpFile created: C:\Program Files\FastestVPN\Resources\sp\driver\windows7\i386\is-UE60Q.tmpJump to dropped file
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpFile created: C:\Program Files\FastestVPN\Resources\ComDebug.exe (copy)Jump to dropped file
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpFile created: C:\Program Files\FastestVPN\is-L0D1P.tmpJump to dropped file
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpFile created: C:\Program Files\FastestVPN\Service\is-5GMR0.tmpJump to dropped file
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpFile created: C:\Program Files\FastestVPN\Resources\driver\windows10\i386\tap0901.sys (copy)Jump to dropped file
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpFile created: C:\Program Files\FastestVPN\Service\is-DPP41.tmpJump to dropped file
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpFile created: C:\Program Files\FastestVPN\is-2DBGR.tmpJump to dropped file
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpFile created: C:\Program Files\FastestVPN\VPN.RAS.dll (copy)Jump to dropped file
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpFile created: C:\Program Files\FastestVPN\BouncyCastle.Crypto.dll (copy)Jump to dropped file
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpFile created: C:\Program Files\FastestVPN\Microsoft.AspNet.SignalR.Client.dll (copy)Jump to dropped file
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpFile created: C:\Program Files\FastestVPN\is-JOA76.tmpJump to dropped file
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpFile created: C:\Program Files\FastestVPN\is-E3G7B.tmpJump to dropped file
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpFile created: C:\Program Files\FastestVPN\is-67AMD.tmpJump to dropped file
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpFile created: C:\Program Files\FastestVPN\FastestVPN.BLL.dll (copy)Jump to dropped file
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpFile created: C:\Program Files\FastestVPN\fix-dns-leak-32.dll (copy)Jump to dropped file
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpFile created: C:\Program Files\FastestVPN\Service\is-O78V3.tmpJump to dropped file
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpFile created: C:\Program Files\FastestVPN\Service\is-04ESR.tmpJump to dropped file
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpFile created: C:\Program Files\FastestVPN\is-OO2G4.tmpJump to dropped file
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpFile created: C:\Program Files\FastestVPN\Resources\vcruntime140.dll (copy)Jump to dropped file
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpFile created: C:\Program Files\FastestVPN\Service\Microsoft.Owin.Diagnostics.dll (copy)Jump to dropped file
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpFile created: C:\Program Files\FastestVPN\Resources\openvpn.exe (copy)Jump to dropped file
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpFile created: C:\Program Files\FastestVPN\Service\VPN.RAS.dll (copy)Jump to dropped file
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpFile created: C:\Program Files\FastestVPN\Microsoft.AppCenter.dll (copy)Jump to dropped file
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpFile created: C:\Program Files\FastestVPN\Resources\sp\release\is-UGM5N.tmpJump to dropped file
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpFile created: C:\Program Files\FastestVPN\VPN.OpenVpn.dll (copy)Jump to dropped file
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpFile created: C:\Program Files\FastestVPN\Resources\sp\driver\windows8\amd64\fastestvpndriver.sys (copy)Jump to dropped file
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpFile created: C:\Program Files\FastestVPN\Flurl.Http.dll (copy)Jump to dropped file
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpFile created: C:\Program Files\FastestVPN\Newtonsoft.Json.dll (copy)Jump to dropped file
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpFile created: C:\Program Files\FastestVPN\Service\Microsoft.Owin.Security.dll (copy)Jump to dropped file
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpFile created: C:\Program Files\FastestVPN\FastestVPN.ViewModel.dll (copy)Jump to dropped file
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpFile created: C:\Program Files\FastestVPN\is-ALQ73.tmpJump to dropped file
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpFile created: C:\Program Files\FastestVPN\Service\Newtonsoft.Json.dll (copy)Jump to dropped file
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpFile created: C:\Program Files\FastestVPN\Service\VPN.Common.dll (copy)Jump to dropped file
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpFile created: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe (copy)Jump to dropped file
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpFile created: C:\Program Files\FastestVPN\Service\fix-dns-leak-32.dll (copy)Jump to dropped file
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpFile created: C:\Program Files\FastestVPN\is-G45GB.tmpJump to dropped file
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpFile created: C:\Program Files\FastestVPN\VPN.WireGuard.dll (copy)Jump to dropped file
      Source: C:\Windows\System32\drvinst.exeFile created: C:\Windows\System32\drivers\tap0901.sys (copy)Jump to dropped file
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpFile created: C:\Program Files\FastestVPN\Resources\driver\windows\amd64\is-HM6P4.tmpJump to dropped file
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpFile created: C:\Program Files\FastestVPN\is-C2OV1.tmpJump to dropped file
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpFile created: C:\Program Files\FastestVPN\Updater.exe (copy)Jump to dropped file
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpFile created: C:\Program Files\FastestVPN\is-Q7N7F.tmpJump to dropped file
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpFile created: C:\Program Files\FastestVPN\SQLitePCLRaw.core.dll (copy)Jump to dropped file
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpFile created: C:\Program Files\FastestVPN\Resources\driver\windows10\i386\is-SUSF8.tmpJump to dropped file
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpFile created: C:\Program Files\FastestVPN\Service\Microsoft.Owin.Cors.dll (copy)Jump to dropped file
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpFile created: C:\Program Files\FastestVPN\Service\is-0SL0F.tmpJump to dropped file
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpFile created: C:\Program Files\FastestVPN\Hardcodet.NotifyIcon.Wpf.dll (copy)Jump to dropped file
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpFile created: C:\Program Files\FastestVPN\Resources\tapinstallWin64.exe (copy)Jump to dropped file
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpFile created: C:\Program Files\FastestVPN\Service\VPN.AdvancedNetwork.dll (copy)Jump to dropped file
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpFile created: C:\Program Files\FastestVPN\is-RRCOJ.tmpJump to dropped file
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpFile created: C:\Program Files\FastestVPN\Resources\is-2FSRR.tmpJump to dropped file
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpFile created: C:\Program Files\FastestVPN\Service\Microsoft.AspNet.SignalR.Core.dll (copy)Jump to dropped file
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpFile created: C:\Program Files\FastestVPN\VPN.AdvancedNetwork.dll (copy)Jump to dropped file
      Source: C:\Users\user\Desktop\OqAVRCkQ3T.exeFile created: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpJump to dropped file
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpFile created: C:\Program Files\FastestVPN\Resources\tapinstall.exe (copy)Jump to dropped file
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpFile created: C:\Program Files\FastestVPN\Service\Owin.dll (copy)Jump to dropped file
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpFile created: C:\Program Files\FastestVPN\Resources\wireguard.exe (copy)Jump to dropped file
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpFile created: C:\Program Files\FastestVPN\is-1GRRH.tmpJump to dropped file
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpFile created: C:\Program Files\FastestVPN\Service\is-ABK95.tmpJump to dropped file
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpFile created: C:\Program Files\FastestVPN\Service\Microsoft.Owin.dll (copy)Jump to dropped file
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpFile created: C:\Program Files\FastestVPN\FastestVPN.Data.Local.dll (copy)Jump to dropped file
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpFile created: C:\Program Files\FastestVPN\is-EFE8N.tmpJump to dropped file
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpFile created: C:\Program Files\FastestVPN\Flurl.dll (copy)Jump to dropped file
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpFile created: C:\Program Files\FastestVPN\Service\is-H126L.tmpJump to dropped file
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpFile created: C:\Program Files\FastestVPN\System.Buffers.dll (copy)Jump to dropped file
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpFile created: C:\Program Files\FastestVPN\Service\is-4F6CO.tmpJump to dropped file
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpFile created: C:\Program Files\FastestVPN\VPN.Common.dll (copy)Jump to dropped file
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpFile created: C:\Program Files\FastestVPN\is-N38EL.tmpJump to dropped file
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpFile created: C:\Program Files\FastestVPN\SingleInstanceApplication.dll (copy)Jump to dropped file
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpFile created: C:\Program Files\FastestVPN\Service\is-M7EC0.tmpJump to dropped file
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpFile created: C:\Program Files\FastestVPN\is-7EKKK.tmpJump to dropped file
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpFile created: C:\Program Files\FastestVPN\Service\System.Web.Cors.dll (copy)Jump to dropped file
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpFile created: C:\Program Files\FastestVPN\Resources\is-OOEI3.tmpJump to dropped file
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpFile created: C:\Program Files\FastestVPN\Resources\ssleay32.dll (copy)Jump to dropped file
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpFile created: C:\Program Files\FastestVPN\Resources\sp\driver\windows8\i386\is-T910E.tmpJump to dropped file
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpFile created: C:\Program Files\FastestVPN\is-LGHQU.tmpJump to dropped file
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpFile created: C:\Program Files\FastestVPN\nfapi.dll (copy)Jump to dropped file
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpFile created: C:\Program Files\FastestVPN\is-AASMC.tmpJump to dropped file
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpFile created: C:\Program Files\FastestVPN\is-IAI1H.tmpJump to dropped file
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpFile created: C:\Program Files\FastestVPN\Resources\sp\driver\windows7\amd64\is-N7JEQ.tmpJump to dropped file
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpFile created: C:\Program Files\FastestVPN\Resources\is-O25O5.tmpJump to dropped file
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpFile created: C:\Program Files\FastestVPN\Resources\devcon.exe (copy)Jump to dropped file
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpFile created: C:\Program Files\FastestVPN\Resources\driver\windows\i386\tap0901.sys (copy)Jump to dropped file
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpFile created: C:\Program Files\FastestVPN\is-RP1DP.tmpJump to dropped file
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpFile created: C:\Program Files\FastestVPN\FastestVPN.exe (copy)Jump to dropped file
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpFile created: C:\Program Files\FastestVPN\Resources\openvpnserv2.exe (copy)Jump to dropped file
      Source: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exeFile created: C:\Users\user\AppData\Local\Temp\{4cb0eb0d-a103-7c4c-aedf-5caef9610c0c}\tap0901.sys (copy)Jump to dropped file
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpFile created: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exe (copy)Jump to dropped file
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpFile created: C:\Program Files\FastestVPN\Resources\is-79FJ0.tmpJump to dropped file
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpFile created: C:\Program Files\FastestVPN\is-Q6C5B.tmpJump to dropped file
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpFile created: C:\Program Files\FastestVPN\is-28KS7.tmpJump to dropped file
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpFile created: C:\Program Files\FastestVPN\VPN.dll (copy)Jump to dropped file
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpFile created: C:\Program Files\FastestVPN\is-3TGVV.tmpJump to dropped file
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpFile created: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\is-OI0G9.tmpJump to dropped file
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpFile created: C:\Program Files\FastestVPN\Service\VPN.dll (copy)Jump to dropped file
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpFile created: C:\Program Files\FastestVPN\Resources\tapctl.exe (copy)Jump to dropped file
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpFile created: C:\Program Files\FastestVPN\SQLitePCLRaw.provider.dynamic_cdecl.dll (copy)Jump to dropped file
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpFile created: C:\Program Files\FastestVPN\Service\is-17HNF.tmpJump to dropped file
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpFile created: C:\Program Files\FastestVPN\Resources\is-EHLQ3.tmpJump to dropped file
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpFile created: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tap0901.sys (copy)Jump to dropped file
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpFile created: C:\Program Files\FastestVPN\Resources\driver\windows\i386\is-DP5T8.tmpJump to dropped file
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpFile created: C:\Program Files\FastestVPN\is-MB689.tmpJump to dropped file
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpFile created: C:\Program Files\FastestVPN\FastestVPN.Common.dll (copy)Jump to dropped file
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpFile created: C:\Program Files\FastestVPN\Service\is-51UBL.tmpJump to dropped file
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpFile created: C:\Program Files\FastestVPN\Microsoft.Bcl.AsyncInterfaces.dll (copy)Jump to dropped file
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpFile created: C:\Program Files\FastestVPN\Service\is-AC1A8.tmpJump to dropped file
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpFile created: C:\Program Files\FastestVPN\is-NJH6K.tmpJump to dropped file
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpFile created: C:\Program Files\FastestVPN\Resources\driver\windows\i386\is-LC5II.tmpJump to dropped file
      Source: C:\Windows\System32\xcopy.exeFile created: C:\Windows\System32\drivers\fastestvpndriver.sysJump to dropped file
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpFile created: C:\Program Files\FastestVPN\Resources\is-LGI72.tmpJump to dropped file
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpFile created: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\is-4K729.tmpJump to dropped file
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpFile created: C:\Program Files\FastestVPN\Service\is-2G3FE.tmpJump to dropped file
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpFile created: C:\Program Files\FastestVPN\Resources\is-9K65C.tmpJump to dropped file
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpFile created: C:\Program Files\FastestVPN\Resources\is-EANN9.tmpJump to dropped file
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpFile created: C:\Program Files\FastestVPN\is-K0SIQ.tmpJump to dropped file
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpFile created: C:\Program Files\FastestVPN\is-NTHCN.tmpJump to dropped file
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpFile created: C:\Program Files\FastestVPN\is-EES9I.tmpJump to dropped file
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpFile created: C:\Program Files\FastestVPN\Resources\sp\driver\windows7\amd64\fastestvpndriver.sys (copy)Jump to dropped file
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpFile created: C:\Program Files\FastestVPN\is-Q0KU7.tmpJump to dropped file
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpFile created: C:\Program Files\FastestVPN\Resources\msvcr100.dll (copy)Jump to dropped file
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpFile created: C:\Program Files\FastestVPN\WpfAnimatedGif.dll (copy)Jump to dropped file
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpFile created: C:\Program Files\FastestVPN\Resources\sp\release\is-8GLTJ.tmpJump to dropped file
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpFile created: C:\Program Files\FastestVPN\is-4N32R.tmpJump to dropped file
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpFile created: C:\Program Files\FastestVPN\is-CVBBG.tmpJump to dropped file
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpFile created: C:\Program Files\FastestVPN\Resources\driver\windows\i386\tapinstall.exe (copy)Jump to dropped file
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpFile created: C:\Program Files\FastestVPN\Service\VPN.OpenVpn.dll (copy)Jump to dropped file
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpFile created: C:\Program Files\FastestVPN\Resources\sp\release\nfregdrv.exe (copy)Jump to dropped file
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpFile created: C:\Program Files\FastestVPN\Service\is-8F2SU.tmpJump to dropped file
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpFile created: C:\Program Files\FastestVPN\is-2J970.tmpJump to dropped file
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpFile created: C:\Program Files\FastestVPN\Service\is-D7DH9.tmpJump to dropped file
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpFile created: C:\Program Files\FastestVPN\Resources\libeay32.dll (copy)Jump to dropped file
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpFile created: C:\Program Files\FastestVPN\is-MD8VT.tmpJump to dropped file
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpFile created: C:\Program Files\FastestVPN\Resources\is-B0TRN.tmpJump to dropped file
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpFile created: C:\Program Files\FastestVPN\Resources\libcrypto-1_1-x64.dll (copy)Jump to dropped file
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpFile created: C:\Program Files\FastestVPN\is-O9AN2.tmpJump to dropped file
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpFile created: C:\Program Files\FastestVPN\Service\Microsoft.Owin.Host.HttpListener.dll (copy)Jump to dropped file
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpFile created: C:\Program Files\FastestVPN\Resources\is-4NIRM.tmpJump to dropped file
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpFile created: C:\Program Files\FastestVPN\Resources\libpkcs11-helper-1.dll (copy)Jump to dropped file
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpFile created: C:\Program Files\FastestVPN\Resources\driver\windows\amd64\is-9R4TG.tmpJump to dropped file
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpFile created: C:\Program Files\FastestVPN\Microsoft.Extensions.DependencyInjection.dll (copy)Jump to dropped file
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpFile created: C:\Program Files\FastestVPN\Service\FastestVPN.Common.dll (copy)Jump to dropped file
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpFile created: C:\Program Files\FastestVPN\Resources\tapinstallWin32.exe (copy)Jump to dropped file
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpFile created: C:\Program Files\FastestVPN\Resources\is-6403S.tmpJump to dropped file
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpFile created: C:\Program Files\FastestVPN\FastestVPN.Diagnostics.dll (copy)Jump to dropped file
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpFile created: C:\Program Files\FastestVPN\is-0B265.tmpJump to dropped file
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpFile created: C:\Program Files\FastestVPN\Resources\driver\windows10\i386\is-6GBPO.tmpJump to dropped file
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpFile created: C:\Program Files\FastestVPN\System.Numerics.Vectors.dll (copy)Jump to dropped file
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpFile created: C:\Program Files\FastestVPN\Service\is-C2OTC.tmpJump to dropped file
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpFile created: C:\Program Files\FastestVPN\Service\is-JFLTF.tmpJump to dropped file
      Source: C:\Windows\System32\drvinst.exeFile created: C:\Windows\System32\DriverStore\Temp\{eba04833-fdea-4f40-ac46-b79bff73f8ea}\tap0901.sys (copy)Jump to dropped file
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpFile created: C:\Program Files\FastestVPN\Service\VPN.WireGuard.dll (copy)Jump to dropped file
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpFile created: C:\Program Files\FastestVPN\Service\is-NGC8I.tmpJump to dropped file
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpFile created: C:\Program Files\FastestVPN\System.Runtime.CompilerServices.Unsafe.dll (copy)Jump to dropped file
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpFile created: C:\Program Files\FastestVPN\Resources\sp\driver\windows7\i386\fastestvpndriver.sys (copy)Jump to dropped file
      Source: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exeFile created: C:\Users\user\AppData\Local\Temp\{4cb0eb0d-a103-7c4c-aedf-5caef9610c0c}\SETB0E3.tmpJump to dropped file
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpFile created: C:\Program Files\FastestVPN\is-9DEC1.tmpJump to dropped file
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpFile created: C:\Program Files\FastestVPN\FastestVPN.DI.dll (copy)Jump to dropped file
      Source: C:\Windows\System32\drvinst.exeFile created: C:\Windows\System32\drivers\SETBA95.tmpJump to dropped file
      Source: C:\Windows\System32\drvinst.exeFile created: C:\Windows\System32\drivers\tap0901.sys (copy)Jump to dropped file
      Source: C:\Windows\System32\drvinst.exeFile created: C:\Windows\System32\DriverStore\Temp\{eba04833-fdea-4f40-ac46-b79bff73f8ea}\SETB2A8.tmpJump to dropped file
      Source: C:\Windows\System32\drvinst.exeFile created: C:\Windows\System32\DriverStore\Temp\{eba04833-fdea-4f40-ac46-b79bff73f8ea}\tap0901.sys (copy)Jump to dropped file
      Source: C:\Windows\System32\xcopy.exeFile created: C:\Windows\System32\drivers\fastestvpndriver.sysJump to dropped file
      Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeFile created: C:\Program Files\FastestVPN\Service\InstallUtil.InstallLog
      Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeFile created: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.InstallLog
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\FastestVPN.lnkJump to behavior
      Source: C:\Windows\System32\drvinst.exeRegistry key created: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\tap0901Jump to behavior
      Source: C:\Windows\System32\svchost.exeRegistry key value modified: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Linkage
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpFile created: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\FastestVPNJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpFile created: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\FastestVPN\FastestVPN.lnkJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpFile created: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\FastestVPN\Uninstall FastestVPN.lnkJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\FastestVPN.lnkJump to behavior
      Source: C:\Program Files\FastestVPN\Resources\sp\release\nfregdrv.exeCode function: 35_2_10013540 OpenSCManagerA,CreateServiceW,CloseServiceHandle,GetLastError,GetLastError,OpenServiceA,QueryServiceStatus,StartServiceA,GetLastError,CloseServiceHandle,GetLastError,CloseServiceHandle,SetLastError,35_2_10013540
      Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\sc.exe sc stop fastestvpndriver
      Source: C:\Program Files\FastestVPN\FastestVPN.exeRegistry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot
      Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeRegistry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot
      Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeKey value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DDFB16CD4931C973A2037D3FC83A4D7D775D05E4 Blob
      Source: C:\Users\user\Desktop\OqAVRCkQ3T.exeProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Program Files\FastestVPN\Resources\ComDebug.exeProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
      Source: C:\Program Files\FastestVPN\Resources\ComDebug.exeProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
      Source: C:\Program Files\FastestVPN\Resources\ComDebug.exeProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
      Source: C:\Program Files\FastestVPN\Resources\ComDebug.exeProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\System32\cmd.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\System32\cmd.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\System32\drvinst.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\System32\drvinst.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\System32\drvinst.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\System32\drvinst.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\System32\drvinst.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\System32\drvinst.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\System32\drvinst.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\System32\drvinst.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\System32\drvinst.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\System32\drvinst.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\System32\drvinst.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\System32\drvinst.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\System32\drvinst.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\System32\drvinst.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\System32\drvinst.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\System32\drvinst.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\System32\drvinst.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\System32\drvinst.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\System32\drvinst.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\System32\drvinst.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\System32\drvinst.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\System32\drvinst.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\System32\drvinst.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\System32\drvinst.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\System32\drvinst.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\System32\drvinst.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\System32\drvinst.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\System32\drvinst.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\System32\drvinst.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\System32\drvinst.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\System32\drvinst.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\System32\drvinst.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\System32\drvinst.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\System32\drvinst.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\System32\drvinst.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\System32\drvinst.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\System32\drvinst.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\System32\drvinst.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\System32\drvinst.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\System32\drvinst.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\System32\drvinst.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Program Files\FastestVPN\FastestVPN.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files\FastestVPN\FastestVPN.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files\FastestVPN\FastestVPN.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files\FastestVPN\FastestVPN.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files\FastestVPN\FastestVPN.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files\FastestVPN\FastestVPN.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files\FastestVPN\FastestVPN.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files\FastestVPN\FastestVPN.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files\FastestVPN\FastestVPN.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files\FastestVPN\FastestVPN.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files\FastestVPN\FastestVPN.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files\FastestVPN\FastestVPN.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files\FastestVPN\FastestVPN.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files\FastestVPN\FastestVPN.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files\FastestVPN\FastestVPN.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files\FastestVPN\FastestVPN.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files\FastestVPN\FastestVPN.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files\FastestVPN\FastestVPN.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files\FastestVPN\FastestVPN.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files\FastestVPN\FastestVPN.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files\FastestVPN\FastestVPN.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files\FastestVPN\FastestVPN.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files\FastestVPN\FastestVPN.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files\FastestVPN\FastestVPN.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files\FastestVPN\FastestVPN.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files\FastestVPN\FastestVPN.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files\FastestVPN\FastestVPN.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files\FastestVPN\FastestVPN.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files\FastestVPN\FastestVPN.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files\FastestVPN\FastestVPN.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files\FastestVPN\FastestVPN.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files\FastestVPN\FastestVPN.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files\FastestVPN\FastestVPN.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files\FastestVPN\FastestVPN.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files\FastestVPN\FastestVPN.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files\FastestVPN\FastestVPN.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files\FastestVPN\FastestVPN.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files\FastestVPN\FastestVPN.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files\FastestVPN\FastestVPN.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files\FastestVPN\FastestVPN.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files\FastestVPN\FastestVPN.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files\FastestVPN\FastestVPN.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files\FastestVPN\FastestVPN.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files\FastestVPN\FastestVPN.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files\FastestVPN\FastestVPN.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files\FastestVPN\FastestVPN.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files\FastestVPN\FastestVPN.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files\FastestVPN\FastestVPN.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files\FastestVPN\FastestVPN.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files\FastestVPN\FastestVPN.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files\FastestVPN\FastestVPN.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files\FastestVPN\FastestVPN.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files\FastestVPN\FastestVPN.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files\FastestVPN\FastestVPN.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files\FastestVPN\FastestVPN.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files\FastestVPN\FastestVPN.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files\FastestVPN\FastestVPN.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files\FastestVPN\FastestVPN.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files\FastestVPN\FastestVPN.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files\FastestVPN\FastestVPN.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files\FastestVPN\FastestVPN.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files\FastestVPN\FastestVPN.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files\FastestVPN\FastestVPN.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files\FastestVPN\FastestVPN.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files\FastestVPN\FastestVPN.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files\FastestVPN\FastestVPN.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files\FastestVPN\FastestVPN.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files\FastestVPN\FastestVPN.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files\FastestVPN\FastestVPN.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files\FastestVPN\FastestVPN.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files\FastestVPN\FastestVPN.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files\FastestVPN\FastestVPN.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files\FastestVPN\FastestVPN.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files\FastestVPN\FastestVPN.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files\FastestVPN\FastestVPN.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files\FastestVPN\FastestVPN.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files\FastestVPN\FastestVPN.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files\FastestVPN\FastestVPN.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files\FastestVPN\FastestVPN.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files\FastestVPN\FastestVPN.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files\FastestVPN\FastestVPN.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files\FastestVPN\FastestVPN.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files\FastestVPN\FastestVPN.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files\FastestVPN\FastestVPN.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files\FastestVPN\FastestVPN.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files\FastestVPN\FastestVPN.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files\FastestVPN\FastestVPN.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files\FastestVPN\FastestVPN.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files\FastestVPN\FastestVPN.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files\FastestVPN\FastestVPN.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files\FastestVPN\FastestVPN.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files\FastestVPN\FastestVPN.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files\FastestVPN\FastestVPN.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files\FastestVPN\FastestVPN.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files\FastestVPN\FastestVPN.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files\FastestVPN\FastestVPN.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files\FastestVPN\FastestVPN.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files\FastestVPN\FastestVPN.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files\FastestVPN\FastestVPN.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files\FastestVPN\FastestVPN.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files\FastestVPN\FastestVPN.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files\FastestVPN\FastestVPN.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files\FastestVPN\FastestVPN.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files\FastestVPN\FastestVPN.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files\FastestVPN\FastestVPN.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files\FastestVPN\FastestVPN.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files\FastestVPN\FastestVPN.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files\FastestVPN\FastestVPN.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files\FastestVPN\FastestVPN.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files\FastestVPN\FastestVPN.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files\FastestVPN\FastestVPN.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files\FastestVPN\FastestVPN.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files\FastestVPN\FastestVPN.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files\FastestVPN\FastestVPN.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files\FastestVPN\FastestVPN.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files\FastestVPN\FastestVPN.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files\FastestVPN\FastestVPN.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files\FastestVPN\FastestVPN.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files\FastestVPN\FastestVPN.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files\FastestVPN\FastestVPN.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files\FastestVPN\FastestVPN.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files\FastestVPN\FastestVPN.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files\FastestVPN\FastestVPN.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files\FastestVPN\FastestVPN.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files\FastestVPN\FastestVPN.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files\FastestVPN\FastestVPN.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files\FastestVPN\FastestVPN.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files\FastestVPN\FastestVPN.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files\FastestVPN\FastestVPN.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files\FastestVPN\FastestVPN.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files\FastestVPN\FastestVPN.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files\FastestVPN\FastestVPN.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files\FastestVPN\FastestVPN.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files\FastestVPN\FastestVPN.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files\FastestVPN\FastestVPN.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files\FastestVPN\FastestVPN.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files\FastestVPN\FastestVPN.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\cmd.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\svchost.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\svchost.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\svchost.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\svchost.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\svchost.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\svchost.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\svchost.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\svchost.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\svchost.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\svchost.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\svchost.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\svchost.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\svchost.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\svchost.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\svchost.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\svchost.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX
      Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX
      Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX
      Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX
      Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX
      Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX
      Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX
      Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX
      Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX
      Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX
      Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files\FastestVPN\subinacl.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files\FastestVPN\subinacl.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files\FastestVPN\FastestVPN.exeProcess information set: NOOPENFILEERRORBOX

      Malware Analysis System Evasion

      barindex
      Queries sensitive system registry key value via command line tool
      Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\reg.exe reg Query "HKLM\Hardware\Description\System\CentralProcessor\0"
      Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\reg.exe reg Query "HKLM\Hardware\Description\System\CentralProcessor\0"
      Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\reg.exe reg Query "HKLM\Hardware\Description\System\CentralProcessor\0" Jump to behavior
      Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\reg.exe reg Query "HKLM\Hardware\Description\System\CentralProcessor\0"
      Switches to a custom stack to bypass stack traces
      Source: C:\Program Files\FastestVPN\Resources\ComDebug.exeAPI/Special instruction interceptor: Address: 764D7B27
      Source: C:\Program Files\FastestVPN\FastestVPN.exeMemory allocated: CF0000 memory reserve | memory write watch
      Source: C:\Program Files\FastestVPN\FastestVPN.exeMemory allocated: 2880000 memory reserve | memory write watch
      Source: C:\Program Files\FastestVPN\FastestVPN.exeMemory allocated: 4880000 memory reserve | memory write watch
      Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeMemory allocated: A70000 memory reserve | memory write watch
      Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeMemory allocated: 2660000 memory reserve | memory write watch
      Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeMemory allocated: 4660000 memory reserve | memory write watch
      Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeMemory allocated: 1530000 memory reserve | memory write watch
      Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeMemory allocated: 2E80000 memory reserve | memory write watch
      Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeMemory allocated: 4E80000 memory reserve | memory write watch
      Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeMemory allocated: 15F0000 memory reserve | memory write watch
      Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeMemory allocated: 17E0000 memory reserve | memory write watch
      Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeMemory allocated: 37E0000 memory reserve | memory write watch
      Source: C:\Program Files\FastestVPN\FastestVPN.exeMemory allocated: E70000 memory reserve | memory write watch
      Source: C:\Program Files\FastestVPN\FastestVPN.exeMemory allocated: 29D0000 memory reserve | memory write watch
      Source: C:\Program Files\FastestVPN\FastestVPN.exeMemory allocated: 27C0000 memory reserve | memory write watch
      Source: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exeCode function: 12_2_00007FF6EC4B4820 SetupDiGetDeviceRegistryPropertyW,GetLastError,SetupDiGetDeviceRegistryPropertyW,12_2_00007FF6EC4B4820
      Source: C:\Program Files\FastestVPN\FastestVPN.exeThread delayed: delay time: 922337203685477
      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
      Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeThread delayed: delay time: 922337203685477
      Source: C:\Program Files\FastestVPN\FastestVPN.exeThread delayed: delay time: 922337203685477
      Source: C:\Program Files\FastestVPN\FastestVPN.exeThread delayed: delay time: 922337203685477
      Source: C:\Program Files\FastestVPN\FastestVPN.exeWindow / User API: threadDelayed 2389
      Source: C:\Program Files\FastestVPN\FastestVPN.exeWindow / User API: threadDelayed 1950
      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 3463
      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 406
      Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeWindow / User API: threadDelayed 371
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpDropped PE file which has not been started: C:\Program Files\FastestVPN\Resources\driver\windows10\i386\tapinstall.exe (copy)Jump to dropped file
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpDropped PE file which has not been started: C:\Program Files\FastestVPN\is-RRCOJ.tmpJump to dropped file
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpDropped PE file which has not been started: C:\Program Files\FastestVPN\Service\is-SLLFS.tmpJump to dropped file
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpDropped PE file which has not been started: C:\Program Files\FastestVPN\Resources\is-2FSRR.tmpJump to dropped file
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpDropped PE file which has not been started: C:\Program Files\FastestVPN\is-M7G5C.tmpJump to dropped file
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpDropped PE file which has not been started: C:\Program Files\FastestVPN\Service\Microsoft.AspNet.SignalR.Core.dll (copy)Jump to dropped file
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpDropped PE file which has not been started: C:\Program Files\FastestVPN\VPN.AdvancedNetwork.dll (copy)Jump to dropped file
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpDropped PE file which has not been started: C:\Program Files\FastestVPN\Microsoft.Extensions.DependencyInjection.Abstractions.dll (copy)Jump to dropped file
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpDropped PE file which has not been started: C:\Program Files\FastestVPN\Resources\tapinstall.exe (copy)Jump to dropped file
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpDropped PE file which has not been started: C:\Program Files\FastestVPN\Service\Owin.dll (copy)Jump to dropped file
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpDropped PE file which has not been started: C:\Program Files\FastestVPN\Resources\is-E9ECF.tmpJump to dropped file
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpDropped PE file which has not been started: C:\Program Files\FastestVPN\Resources\wireguard.exe (copy)Jump to dropped file
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpDropped PE file which has not been started: C:\Program Files\FastestVPN\is-1GRRH.tmpJump to dropped file
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpDropped PE file which has not been started: C:\Program Files\FastestVPN\Resources\is-6SU3B.tmpJump to dropped file
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpDropped PE file which has not been started: C:\Program Files\FastestVPN\Service\is-ABK95.tmpJump to dropped file
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpDropped PE file which has not been started: C:\Program Files\FastestVPN\Resources\is-DJHTV.tmpJump to dropped file
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpDropped PE file which has not been started: C:\Program Files\FastestVPN\Service\Microsoft.Owin.dll (copy)Jump to dropped file
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpDropped PE file which has not been started: C:\Program Files\FastestVPN\FastestVPN.Data.Local.dll (copy)Jump to dropped file
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpDropped PE file which has not been started: C:\Program Files\FastestVPN\is-EFE8N.tmpJump to dropped file
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpDropped PE file which has not been started: C:\Program Files\FastestVPN\Resources\libssl-1_1-x64.dll (copy)Jump to dropped file
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpDropped PE file which has not been started: C:\Program Files\FastestVPN\Flurl.dll (copy)Jump to dropped file
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpDropped PE file which has not been started: C:\Program Files\FastestVPN\Resources\driver\windows\amd64\tap0901.sys (copy)Jump to dropped file
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpDropped PE file which has not been started: C:\Program Files\FastestVPN\Service\is-H126L.tmpJump to dropped file
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpDropped PE file which has not been started: C:\Program Files\FastestVPN\Resources\is-QLNQ0.tmpJump to dropped file
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpDropped PE file which has not been started: C:\Program Files\FastestVPN\iphelperclose.dll (copy)Jump to dropped file
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpDropped PE file which has not been started: C:\Program Files\FastestVPN\System.Buffers.dll (copy)Jump to dropped file
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpDropped PE file which has not been started: C:\Program Files\FastestVPN\Service\is-4F6CO.tmpJump to dropped file
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpDropped PE file which has not been started: C:\Program Files\FastestVPN\VPN.Common.dll (copy)Jump to dropped file
      Source: C:\Windows\System32\drvinst.exeDropped PE file which has not been started: C:\Windows\System32\DriverStore\Temp\{eba04833-fdea-4f40-ac46-b79bff73f8ea}\SETB2A8.tmpJump to dropped file
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpDropped PE file which has not been started: C:\Program Files\FastestVPN\Service\iphelperclose.dll (copy)Jump to dropped file
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpDropped PE file which has not been started: C:\Program Files\FastestVPN\is-N38EL.tmpJump to dropped file
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpDropped PE file which has not been started: C:\Program Files\FastestVPN\Service\is-6V6PA.tmpJump to dropped file
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpDropped PE file which has not been started: C:\Program Files\FastestVPN\is-MM0UH.tmpJump to dropped file
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpDropped PE file which has not been started: C:\Program Files\FastestVPN\SingleInstanceApplication.dll (copy)Jump to dropped file
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpDropped PE file which has not been started: C:\Program Files\FastestVPN\Resources\is-CDU5N.tmpJump to dropped file
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpDropped PE file which has not been started: C:\Program Files\FastestVPN\Service\is-M7EC0.tmpJump to dropped file
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpDropped PE file which has not been started: C:\Program Files\FastestVPN\Service\Microsoft.Owin.Hosting.dll (copy)Jump to dropped file
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpDropped PE file which has not been started: C:\Program Files\FastestVPN\is-7EKKK.tmpJump to dropped file
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpDropped PE file which has not been started: C:\Program Files\FastestVPN\Resources\sp\driver\windows8\i386\fastestvpndriver.sys (copy)Jump to dropped file
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpDropped PE file which has not been started: C:\Program Files\FastestVPN\Service\System.Web.Cors.dll (copy)Jump to dropped file
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpDropped PE file which has not been started: C:\Program Files\FastestVPN\Resources\is-OOEI3.tmpJump to dropped file
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-28AK4.tmp\_isetup\_setup64.tmpJump to dropped file
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpDropped PE file which has not been started: C:\Program Files\FastestVPN\Service\is-PPT86.tmpJump to dropped file
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpDropped PE file which has not been started: C:\Program Files\FastestVPN\Resources\libssl32.dll (copy)Jump to dropped file
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpDropped PE file which has not been started: C:\Program Files\FastestVPN\unins000.exe (copy)Jump to dropped file
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpDropped PE file which has not been started: C:\Program Files\FastestVPN\Resources\sp\driver\windows8\amd64\is-JUHU2.tmpJump to dropped file
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpDropped PE file which has not been started: C:\Program Files\FastestVPN\Resources\openvpnserv.exe (copy)Jump to dropped file
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpDropped PE file which has not been started: C:\Program Files\FastestVPN\Resources\ssleay32.dll (copy)Jump to dropped file
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpDropped PE file which has not been started: C:\Program Files\FastestVPN\Resources\driver\windows\amd64\tapinstall.exe (copy)Jump to dropped file
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpDropped PE file which has not been started: C:\Program Files\FastestVPN\Resources\sp\driver\windows8\i386\is-T910E.tmpJump to dropped file
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpDropped PE file which has not been started: C:\Program Files\FastestVPN\is-LGHQU.tmpJump to dropped file
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpDropped PE file which has not been started: C:\Program Files\FastestVPN\FastestVPN.Data.Remote.dll (copy)Jump to dropped file
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpDropped PE file which has not been started: C:\Program Files\FastestVPN\is-AASMC.tmpJump to dropped file
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpDropped PE file which has not been started: C:\Program Files\FastestVPN\Resources\openssl.exe (copy)Jump to dropped file
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpDropped PE file which has not been started: C:\Program Files\FastestVPN\Resources\sp\driver\windows7\amd64\is-N7JEQ.tmpJump to dropped file
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpDropped PE file which has not been started: C:\Program Files\FastestVPN\is-IAI1H.tmpJump to dropped file
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpDropped PE file which has not been started: C:\Program Files\FastestVPN\SQLitePCLRaw.batteries_v2.dll (copy)Jump to dropped file
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpDropped PE file which has not been started: C:\Program Files\FastestVPN\Resources\is-80EU7.tmpJump to dropped file
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpDropped PE file which has not been started: C:\Program Files\FastestVPN\Service\is-9KRN8.tmpJump to dropped file
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpDropped PE file which has not been started: C:\Program Files\FastestVPN\Resources\is-O25O5.tmpJump to dropped file
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpDropped PE file which has not been started: C:\Program Files\FastestVPN\Resources\driver\windows\i386\tap0901.sys (copy)Jump to dropped file
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpDropped PE file which has not been started: C:\Program Files\FastestVPN\Resources\devcon.exe (copy)Jump to dropped file
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpDropped PE file which has not been started: C:\Program Files\FastestVPN\is-U1J8U.tmpJump to dropped file
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpDropped PE file which has not been started: C:\Program Files\FastestVPN\is-RP1DP.tmpJump to dropped file
      Source: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\{4cb0eb0d-a103-7c4c-aedf-5caef9610c0c}\tap0901.sys (copy)Jump to dropped file
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpDropped PE file which has not been started: C:\Program Files\FastestVPN\Resources\openvpnserv2.exe (copy)Jump to dropped file
      Source: C:\Windows\System32\drvinst.exeDropped PE file which has not been started: C:\Windows\System32\drivers\SETBA95.tmpJump to dropped file
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpDropped PE file which has not been started: C:\Program Files\FastestVPN\Resources\is-79FJ0.tmpJump to dropped file
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpDropped PE file which has not been started: C:\Program Files\FastestVPN\is-Q6C5B.tmpJump to dropped file
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpDropped PE file which has not been started: C:\Program Files\FastestVPN\is-28KS7.tmpJump to dropped file
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpDropped PE file which has not been started: C:\Program Files\FastestVPN\VPN.dll (copy)Jump to dropped file
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpDropped PE file which has not been started: C:\Program Files\FastestVPN\Resources\is-56EGR.tmpJump to dropped file
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpDropped PE file which has not been started: C:\Program Files\FastestVPN\is-3TGVV.tmpJump to dropped file
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpDropped PE file which has not been started: C:\Program Files\FastestVPN\Microsoft.AppCenter.Analytics.dll (copy)Jump to dropped file
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpDropped PE file which has not been started: C:\Program Files\FastestVPN\Service\subinacl.exe (copy)Jump to dropped file
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpDropped PE file which has not been started: C:\Program Files\FastestVPN\Service\VPN.dll (copy)Jump to dropped file
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpDropped PE file which has not been started: C:\Program Files\FastestVPN\Resources\tapctl.exe (copy)Jump to dropped file
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpDropped PE file which has not been started: C:\Program Files\FastestVPN\SQLitePCLRaw.provider.dynamic_cdecl.dll (copy)Jump to dropped file
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpDropped PE file which has not been started: C:\Program Files\FastestVPN\Service\is-17HNF.tmpJump to dropped file
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpDropped PE file which has not been started: C:\Program Files\FastestVPN\Resources\liblzo2-2.dll (copy)Jump to dropped file
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpDropped PE file which has not been started: C:\Program Files\FastestVPN\Resources\is-RFTSN.tmpJump to dropped file
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpDropped PE file which has not been started: C:\Program Files\FastestVPN\Resources\is-EHLQ3.tmpJump to dropped file
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpDropped PE file which has not been started: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tap0901.sys (copy)Jump to dropped file
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpDropped PE file which has not been started: C:\Program Files\FastestVPN\is-F69J1.tmpJump to dropped file
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpDropped PE file which has not been started: C:\Program Files\FastestVPN\System.Threading.Tasks.Extensions.dll (copy)Jump to dropped file
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpDropped PE file which has not been started: C:\Program Files\FastestVPN\Resources\driver\windows\i386\is-DP5T8.tmpJump to dropped file
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpDropped PE file which has not been started: C:\Program Files\FastestVPN\System.Memory.dll (copy)Jump to dropped file
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpDropped PE file which has not been started: C:\Program Files\FastestVPN\is-TQ8EO.tmpJump to dropped file
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpDropped PE file which has not been started: C:\Program Files\FastestVPN\is-DQ4HF.tmpJump to dropped file
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpDropped PE file which has not been started: C:\Program Files\FastestVPN\is-MB689.tmpJump to dropped file
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpDropped PE file which has not been started: C:\Program Files\FastestVPN\FastestVPN.Common.dll (copy)Jump to dropped file
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpDropped PE file which has not been started: C:\Program Files\FastestVPN\is-AC86P.tmpJump to dropped file
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpDropped PE file which has not been started: C:\Program Files\FastestVPN\Service\is-51UBL.tmpJump to dropped file
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpDropped PE file which has not been started: C:\Program Files\FastestVPN\Resources\sp\driver\windows7\i386\is-UE60Q.tmpJump to dropped file
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpDropped PE file which has not been started: C:\Program Files\FastestVPN\Resources\driver\windows\i386\is-LC5II.tmpJump to dropped file
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpDropped PE file which has not been started: C:\Program Files\FastestVPN\is-L0D1P.tmpJump to dropped file
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpDropped PE file which has not been started: C:\Program Files\FastestVPN\Service\is-AC1A8.tmpJump to dropped file
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpDropped PE file which has not been started: C:\Program Files\FastestVPN\is-NJH6K.tmpJump to dropped file
      Source: C:\Windows\System32\xcopy.exeDropped PE file which has not been started: C:\Windows\System32\drivers\fastestvpndriver.sysJump to dropped file
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpDropped PE file which has not been started: C:\Program Files\FastestVPN\Resources\is-LGI72.tmpJump to dropped file
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpDropped PE file which has not been started: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\is-4K729.tmpJump to dropped file
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpDropped PE file which has not been started: C:\Program Files\FastestVPN\Service\is-2G3FE.tmpJump to dropped file
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpDropped PE file which has not been started: C:\Program Files\FastestVPN\Service\is-5GMR0.tmpJump to dropped file
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpDropped PE file which has not been started: C:\Program Files\FastestVPN\Resources\driver\windows10\i386\tap0901.sys (copy)Jump to dropped file
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpDropped PE file which has not been started: C:\Program Files\FastestVPN\Resources\is-9K65C.tmpJump to dropped file
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpDropped PE file which has not been started: C:\Program Files\FastestVPN\Service\is-DPP41.tmpJump to dropped file
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpDropped PE file which has not been started: C:\Program Files\FastestVPN\VPN.RAS.dll (copy)Jump to dropped file
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpDropped PE file which has not been started: C:\Program Files\FastestVPN\Resources\is-EANN9.tmpJump to dropped file
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpDropped PE file which has not been started: C:\Program Files\FastestVPN\BouncyCastle.Crypto.dll (copy)Jump to dropped file
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpDropped PE file which has not been started: C:\Program Files\FastestVPN\Microsoft.AspNet.SignalR.Client.dll (copy)Jump to dropped file
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpDropped PE file which has not been started: C:\Program Files\FastestVPN\is-K0SIQ.tmpJump to dropped file
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpDropped PE file which has not been started: C:\Program Files\FastestVPN\is-JOA76.tmpJump to dropped file
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpDropped PE file which has not been started: C:\Program Files\FastestVPN\is-E3G7B.tmpJump to dropped file
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpDropped PE file which has not been started: C:\Program Files\FastestVPN\is-NTHCN.tmpJump to dropped file
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpDropped PE file which has not been started: C:\Program Files\FastestVPN\is-EES9I.tmpJump to dropped file
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpDropped PE file which has not been started: C:\Program Files\FastestVPN\is-67AMD.tmpJump to dropped file
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpDropped PE file which has not been started: C:\Program Files\FastestVPN\FastestVPN.BLL.dll (copy)Jump to dropped file
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpDropped PE file which has not been started: C:\Program Files\FastestVPN\Resources\sp\driver\windows7\amd64\fastestvpndriver.sys (copy)Jump to dropped file
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpDropped PE file which has not been started: C:\Program Files\FastestVPN\Service\is-O78V3.tmpJump to dropped file
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpDropped PE file which has not been started: C:\Program Files\FastestVPN\fix-dns-leak-32.dll (copy)Jump to dropped file
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpDropped PE file which has not been started: C:\Program Files\FastestVPN\Service\is-04ESR.tmpJump to dropped file
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpDropped PE file which has not been started: C:\Program Files\FastestVPN\is-Q0KU7.tmpJump to dropped file
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpDropped PE file which has not been started: C:\Program Files\FastestVPN\Service\Microsoft.Owin.Diagnostics.dll (copy)Jump to dropped file
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpDropped PE file which has not been started: C:\Program Files\FastestVPN\Resources\vcruntime140.dll (copy)Jump to dropped file
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpDropped PE file which has not been started: C:\Program Files\FastestVPN\is-OO2G4.tmpJump to dropped file
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpDropped PE file which has not been started: C:\Program Files\FastestVPN\Resources\msvcr100.dll (copy)Jump to dropped file
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpDropped PE file which has not been started: C:\Program Files\FastestVPN\WpfAnimatedGif.dll (copy)Jump to dropped file
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpDropped PE file which has not been started: C:\Program Files\FastestVPN\Resources\sp\release\is-8GLTJ.tmpJump to dropped file
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpDropped PE file which has not been started: C:\Program Files\FastestVPN\Resources\openvpn.exe (copy)Jump to dropped file
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpDropped PE file which has not been started: C:\Program Files\FastestVPN\is-4N32R.tmpJump to dropped file
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpDropped PE file which has not been started: C:\Program Files\FastestVPN\Service\VPN.RAS.dll (copy)Jump to dropped file
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpDropped PE file which has not been started: C:\Program Files\FastestVPN\Microsoft.AppCenter.dll (copy)Jump to dropped file
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpDropped PE file which has not been started: C:\Program Files\FastestVPN\is-CVBBG.tmpJump to dropped file
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpDropped PE file which has not been started: C:\Program Files\FastestVPN\Service\VPN.OpenVpn.dll (copy)Jump to dropped file
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpDropped PE file which has not been started: C:\Program Files\FastestVPN\Resources\driver\windows\i386\tapinstall.exe (copy)Jump to dropped file
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpDropped PE file which has not been started: C:\Program Files\FastestVPN\is-2J970.tmpJump to dropped file
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpDropped PE file which has not been started: C:\Program Files\FastestVPN\Service\is-8F2SU.tmpJump to dropped file
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpDropped PE file which has not been started: C:\Program Files\FastestVPN\Resources\libeay32.dll (copy)Jump to dropped file
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpDropped PE file which has not been started: C:\Program Files\FastestVPN\Service\is-D7DH9.tmpJump to dropped file
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpDropped PE file which has not been started: C:\Program Files\FastestVPN\is-MD8VT.tmpJump to dropped file
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpDropped PE file which has not been started: C:\Program Files\FastestVPN\Resources\is-B0TRN.tmpJump to dropped file
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpDropped PE file which has not been started: C:\Program Files\FastestVPN\Resources\libcrypto-1_1-x64.dll (copy)Jump to dropped file
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpDropped PE file which has not been started: C:\Program Files\FastestVPN\is-O9AN2.tmpJump to dropped file
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpDropped PE file which has not been started: C:\Program Files\FastestVPN\Service\Microsoft.Owin.Host.HttpListener.dll (copy)Jump to dropped file
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpDropped PE file which has not been started: C:\Program Files\FastestVPN\VPN.OpenVpn.dll (copy)Jump to dropped file
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpDropped PE file which has not been started: C:\Program Files\FastestVPN\Resources\is-4NIRM.tmpJump to dropped file
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpDropped PE file which has not been started: C:\Program Files\FastestVPN\Resources\libpkcs11-helper-1.dll (copy)Jump to dropped file
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpDropped PE file which has not been started: C:\Program Files\FastestVPN\Resources\driver\windows\amd64\is-9R4TG.tmpJump to dropped file
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpDropped PE file which has not been started: C:\Program Files\FastestVPN\Microsoft.Extensions.DependencyInjection.dll (copy)Jump to dropped file
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpDropped PE file which has not been started: C:\Program Files\FastestVPN\Resources\sp\driver\windows8\amd64\fastestvpndriver.sys (copy)Jump to dropped file
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpDropped PE file which has not been started: C:\Program Files\FastestVPN\Flurl.Http.dll (copy)Jump to dropped file
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpDropped PE file which has not been started: C:\Program Files\FastestVPN\Newtonsoft.Json.dll (copy)Jump to dropped file
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpDropped PE file which has not been started: C:\Program Files\FastestVPN\Service\FastestVPN.Common.dll (copy)Jump to dropped file
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpDropped PE file which has not been started: C:\Program Files\FastestVPN\FastestVPN.ViewModel.dll (copy)Jump to dropped file
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpDropped PE file which has not been started: C:\Program Files\FastestVPN\is-ALQ73.tmpJump to dropped file
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpDropped PE file which has not been started: C:\Program Files\FastestVPN\Resources\tapinstallWin32.exe (copy)Jump to dropped file
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpDropped PE file which has not been started: C:\Program Files\FastestVPN\Service\Newtonsoft.Json.dll (copy)Jump to dropped file
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpDropped PE file which has not been started: C:\Program Files\FastestVPN\Service\VPN.Common.dll (copy)Jump to dropped file
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpDropped PE file which has not been started: C:\Program Files\FastestVPN\Resources\is-6403S.tmpJump to dropped file
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpDropped PE file which has not been started: C:\Program Files\FastestVPN\FastestVPN.Diagnostics.dll (copy)Jump to dropped file
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpDropped PE file which has not been started: C:\Program Files\FastestVPN\Service\fix-dns-leak-32.dll (copy)Jump to dropped file
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpDropped PE file which has not been started: C:\Program Files\FastestVPN\is-G45GB.tmpJump to dropped file
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpDropped PE file which has not been started: C:\Program Files\FastestVPN\VPN.WireGuard.dll (copy)Jump to dropped file
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpDropped PE file which has not been started: C:\Program Files\FastestVPN\Resources\driver\windows10\i386\is-6GBPO.tmpJump to dropped file
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpDropped PE file which has not been started: C:\Program Files\FastestVPN\System.Numerics.Vectors.dll (copy)Jump to dropped file
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpDropped PE file which has not been started: C:\Program Files\FastestVPN\Service\is-C2OTC.tmpJump to dropped file
      Source: C:\Windows\System32\drvinst.exeDropped PE file which has not been started: C:\Windows\System32\drivers\tap0901.sys (copy)Jump to dropped file
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpDropped PE file which has not been started: C:\Program Files\FastestVPN\Service\is-JFLTF.tmpJump to dropped file
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpDropped PE file which has not been started: C:\Program Files\FastestVPN\Resources\driver\windows\amd64\is-HM6P4.tmpJump to dropped file
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpDropped PE file which has not been started: C:\Program Files\FastestVPN\is-C2OV1.tmpJump to dropped file
      Source: C:\Windows\System32\drvinst.exeDropped PE file which has not been started: C:\Windows\System32\DriverStore\Temp\{eba04833-fdea-4f40-ac46-b79bff73f8ea}\tap0901.sys (copy)Jump to dropped file
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpDropped PE file which has not been started: C:\Program Files\FastestVPN\Updater.exe (copy)Jump to dropped file
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpDropped PE file which has not been started: C:\Program Files\FastestVPN\Service\VPN.WireGuard.dll (copy)Jump to dropped file
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpDropped PE file which has not been started: C:\Program Files\FastestVPN\Service\is-NGC8I.tmpJump to dropped file
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpDropped PE file which has not been started: C:\Program Files\FastestVPN\is-Q7N7F.tmpJump to dropped file
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpDropped PE file which has not been started: C:\Program Files\FastestVPN\SQLitePCLRaw.core.dll (copy)Jump to dropped file
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpDropped PE file which has not been started: C:\Program Files\FastestVPN\Resources\driver\windows10\i386\is-SUSF8.tmpJump to dropped file
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpDropped PE file which has not been started: C:\Program Files\FastestVPN\Service\Microsoft.Owin.Cors.dll (copy)Jump to dropped file
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpDropped PE file which has not been started: C:\Program Files\FastestVPN\System.Runtime.CompilerServices.Unsafe.dll (copy)Jump to dropped file
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpDropped PE file which has not been started: C:\Program Files\FastestVPN\Hardcodet.NotifyIcon.Wpf.dll (copy)Jump to dropped file
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpDropped PE file which has not been started: C:\Program Files\FastestVPN\Resources\sp\driver\windows7\i386\fastestvpndriver.sys (copy)Jump to dropped file
      Source: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\{4cb0eb0d-a103-7c4c-aedf-5caef9610c0c}\SETB0E3.tmpJump to dropped file
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpDropped PE file which has not been started: C:\Program Files\FastestVPN\Resources\tapinstallWin64.exe (copy)Jump to dropped file
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpDropped PE file which has not been started: C:\Program Files\FastestVPN\Service\VPN.AdvancedNetwork.dll (copy)Jump to dropped file
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpDropped PE file which has not been started: C:\Program Files\FastestVPN\FastestVPN.DI.dll (copy)Jump to dropped file
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpDropped PE file which has not been started: C:\Program Files\FastestVPN\is-9DEC1.tmpJump to dropped file
      Source: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exeAPI coverage: 6.2 %
      Source: C:\Program Files\FastestVPN\Resources\sp\release\nfregdrv.exeAPI coverage: 3.4 %
      Source: C:\Program Files\FastestVPN\Resources\ComDebug.exe TID: 6672Thread sleep time: -180000s >= -30000sJump to behavior
      Source: C:\Program Files\FastestVPN\FastestVPN.exe TID: 5984Thread sleep time: -922337203685477s >= -30000s
      Source: C:\Program Files\FastestVPN\FastestVPN.exe TID: 5372Thread sleep time: -30000s >= -30000s
      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 2720Thread sleep count: 3463 > 30
      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 3552Thread sleep time: -922337203685477s >= -30000s
      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 2720Thread sleep count: 406 > 30
      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 3108Thread sleep time: -922337203685477s >= -30000s
      Source: C:\Windows\System32\svchost.exe TID: 3992Thread sleep time: -30000s >= -30000s
      Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe TID: 2976Thread sleep time: -922337203685477s >= -30000s
      Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe TID: 4784Thread sleep count: 371 > 30
      Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe TID: 4784Thread sleep count: 193 > 30
      Source: C:\Program Files\FastestVPN\FastestVPN.exe TID: 4236Thread sleep time: -922337203685477s >= -30000s
      Source: C:\Program Files\FastestVPN\FastestVPN.exe TID: 3248Thread sleep time: -922337203685477s >= -30000s
      Source: C:\Windows\System32\svchost.exeFile opened: PhysicalDrive0
      Source: C:\Program Files\FastestVPN\FastestVPN.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_ComputerSystem
      Source: C:\Program Files\FastestVPN\FastestVPN.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_ComputerSystem
      Source: C:\Program Files\FastestVPN\FastestVPN.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_ComputerSystem
      Source: C:\Program Files\FastestVPN\FastestVPN.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_ComputerSystem
      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from Win32_ComputerSystemProduct
      Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
      Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
      Source: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exeCode function: 12_2_00007FF6EC4EECAC FindFirstFileExW,FindNextFileW,FindClose,12_2_00007FF6EC4EECAC
      Source: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exeCode function: 12_2_00007FF6EC4EE810 FindFirstFileExW,12_2_00007FF6EC4EE810
      Source: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exeCode function: 12_2_00007FF6EC4EE0B0 _invalid_parameter_noinfo,_invalid_parameter_noinfo,FindFirstFileExW,FindNextFileW,FindClose,FindClose,FindClose,12_2_00007FF6EC4EE0B0
      Source: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exeCode function: 12_2_00007FF6EC4EE0B0 _invalid_parameter_noinfo,_invalid_parameter_noinfo,FindFirstFileExW,FindNextFileW,FindClose,FindClose,FindClose,12_2_00007FF6EC4EE0B0
      Source: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exeCode function: 12_2_00007FF6EC4B3630 GetWindowsDirectoryW,FindFirstFileW,FindNextFileW,FindClose,12_2_00007FF6EC4B3630
      Source: C:\Program Files\FastestVPN\subinacl.exeCode function: 46_2_0103172D __EH_prolog,#540,#922,#858,#800,#2910,wcslen,#2910,wcslen,#823,GetLastError,_CxxThrowException,#2910,#2910,swprintf,FindFirstFileW,GetLastError,#825,#2910,FindFirstFileW,wcscmp,wcscmp,wcscmp,#535,#942,#942,#535,#942,#942,#800,FindNextFileW,FindClose,#800,46_2_0103172D
      Source: C:\Program Files\FastestVPN\subinacl.exeCode function: 46_2_01031DDF __EH_prolog,#540,#925,#858,#800,#2910,wcslen,wcslen,#2910,wcslen,#823,GetLastError,_CxxThrowException,#2910,#2910,swprintf,FindFirstFileW,GetLastError,#825,#2910,FindFirstFileW,wcscmp,wcscmp,#540,#538,#922,#925,#858,#800,#800,#800,#925,#800,#858,#800,FindNextFileW,FindClose,#800,46_2_01031DDF
      Source: C:\Program Files\FastestVPN\Resources\sp\release\nfregdrv.exeCode function: 35_2_100163B0 GetLogicalDriveStringsW,QueryDosDeviceW,GetDriveTypeW,EnterCriticalSection,LeaveCriticalSection,35_2_100163B0
      Source: C:\Program Files\FastestVPN\Resources\sp\release\nfregdrv.exeCode function: 35_2_100013F0 ResetEvent,GetSystemInfo,35_2_100013F0
      Source: C:\Program Files\FastestVPN\FastestVPN.exeThread delayed: delay time: 922337203685477
      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
      Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeThread delayed: delay time: 922337203685477
      Source: C:\Program Files\FastestVPN\FastestVPN.exeThread delayed: delay time: 922337203685477
      Source: C:\Program Files\FastestVPN\FastestVPN.exeThread delayed: delay time: 922337203685477
      Source: C:\Windows\System32\cmd.exeFile opened: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\Jump to behavior
      Source: C:\Windows\System32\cmd.exeFile opened: C:\Program Files\FastestVPN\Jump to behavior
      Source: C:\Windows\System32\cmd.exeFile opened: C:\Program Files\FastestVPN\Resources\Jump to behavior
      Source: C:\Windows\System32\cmd.exeFile opened: C:\Program Files\FastestVPN\Resources\driver\windows10\Jump to behavior
      Source: C:\Windows\System32\cmd.exeFile opened: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64Jump to behavior
      Source: C:\Windows\System32\cmd.exeFile opened: C:\Program Files\FastestVPN\Resources\driver\Jump to behavior
      Source: svchost.exe, 00000015.00000003.2624296118.00000155C1121000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: .@vmnetextension
      Source: powershell.exe, 0000001D.00000002.2756638813.0000000002F99000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: VMware, Inc.
      Source: FastestVPN.exe, 00000034.00000002.3078888465.0000000000D25000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll<
      Source: powershell.exe, 0000001D.00000002.2756638813.0000000002F99000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: stringComputer System ProductComputer System ProductK42V1F4D802742-3099-9C0E-C19B-2A23EA1FC420VMware, Inc.Noney*
      Source: FastestVPN.exe, 00000016.00000002.4076182123.0000000008783000.00000004.00000020.00020000.00000000.sdmp, FastestVPN.exe, 00000016.00000002.4016598487.0000000000D43000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW
      Source: FastestVPN.exe, 00000016.00000002.4088567969.000000000B02C000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAWen-GBn
      Source: svchost.exe, 00000015.00000003.2625309599.00000155C1117000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: (@ethernetwlanppipvmnetextensionA1}
      Source: svchost.exe, 00000015.00000003.2623934111.00000155C1138000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: @vmnetextension
      Source: powershell.exe, 0000001D.00000002.2756638813.0000000002F99000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: stringComputer System ProductComputer System ProductK42V1F4D802742-3099-9C0E-C19B-2A23EA1FC420VMware, Inc.NoneQ
      Source: FastestVPN.WindowsService.exe, 00000032.00000002.4013372056.0000000000BF7000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpProcess information queried: ProcessInformationJump to behavior
      Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeProcess queried: DebugPort
      Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeProcess queried: DebugPort
      Source: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exeCode function: 12_2_00007FF6EC4B8550 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,12_2_00007FF6EC4B8550
      Source: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exeCode function: 12_2_00007FF6EC4B6C90 SetupOpenInfFileW,GetLastError,SetupFindFirstLineW,SetupGetStringFieldW,SetupFindFirstLineW,SetupGetStringFieldW,CLSIDFromString,SetupDiGetClassDescriptionExW,LoadLibraryW,GetProcAddress,GetLastError,GetLastError,SetupFindFirstLineW,SetupGetStringFieldW,SetupGetStringFieldW,SetupCloseInfFile,FreeLibrary,12_2_00007FF6EC4B6C90
      Source: C:\Program Files\FastestVPN\Resources\ComDebug.exeCode function: 6_2_007A5746 mov eax, dword ptr fs:[00000030h]6_2_007A5746
      Source: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exeCode function: 12_2_00007FF6EC4F57E0 GetProcessHeap,12_2_00007FF6EC4F57E0
      Source: C:\Program Files\FastestVPN\subinacl.exeProcess token adjusted: Debug
      Source: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exeCode function: 12_2_00007FF6EC4B8550 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,12_2_00007FF6EC4B8550
      Source: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exeCode function: 12_2_00007FF6EC4E6788 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,12_2_00007FF6EC4E6788
      Source: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exeCode function: 12_2_00007FF6EC4B8738 SetUnhandledExceptionFilter,12_2_00007FF6EC4B8738
      Source: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exeCode function: 12_2_00007FF6EC4B7B18 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,12_2_00007FF6EC4B7B18
      Source: C:\Program Files\FastestVPN\Resources\sp\release\nfregdrv.exeCode function: 35_2_004054F3 _raise,SetUnhandledExceptionFilter,UnhandledExceptionFilter,35_2_004054F3
      Source: C:\Program Files\FastestVPN\Resources\sp\release\nfregdrv.exeCode function: 35_2_0040148B SetUnhandledExceptionFilter,35_2_0040148B
      Source: C:\Program Files\FastestVPN\Resources\sp\release\nfregdrv.exeCode function: 35_2_0040134A IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,35_2_0040134A
      Source: C:\Program Files\FastestVPN\Resources\sp\release\nfregdrv.exeCode function: 35_2_00402D4D IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,35_2_00402D4D
      Source: C:\Program Files\FastestVPN\Resources\sp\release\nfregdrv.exeCode function: 35_2_100081EF _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,35_2_100081EF
      Source: C:\Program Files\FastestVPN\Resources\sp\release\nfregdrv.exeCode function: 35_2_1000B228 _raise,_memset,SetUnhandledExceptionFilter,UnhandledExceptionFilter,35_2_1000B228
      Source: C:\Program Files\FastestVPN\Resources\sp\release\nfregdrv.exeCode function: 35_2_10007CCF IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,35_2_10007CCF
      Source: C:\Program Files\FastestVPN\subinacl.exeCode function: 46_2_0103DEE7 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,46_2_0103DEE7
      Source: C:\Program Files\FastestVPN\FastestVPN.exeMemory allocated: page read and write | page guard

      HIPS / PFW / Operating System Protection Evasion

      barindex
      Found direct / indirect Syscall (likely to bypass EDR)
      Source: C:\Program Files\FastestVPN\Resources\ComDebug.exeNtProtectVirtualMemory: Direct from: 0x6BFE2B20Jump to behavior
      Source: C:\Program Files\FastestVPN\Resources\ComDebug.exeNtQuerySystemInformation: Direct from: 0x57EB6FJump to behavior
      Source: C:\Program Files\FastestVPN\Resources\ComDebug.exeNtTerminateThread: Direct from: 0x77377B2EJump to behavior
      Source: C:\Program Files\FastestVPN\subinacl.exeCode function: 46_2_010383F6 __EH_prolog,#540,#538,#540,#540,#538,#2910,#861,#4197,#2755,#2910,#800,#800,#800,#800,#800,#2910,#2910,#2910,#2910,#2910,#2910,#2910,#2910,#2910,#2910,#2910,#4124,#858,#800,#2910,#2910,#2910,#2755,#4272,#858,#800,#4197,#6563,#2910,#2755,#4272,#858,#800,#4197,#6563,#2910,#2755,#4272,#858,#800,#2910,#2910,#2910,#2910,#2910,#2910,#2910,#2756,#2910,swscanf,#2910,#2910,#2910,#2910,#2755,#4272,#858,#800,#825,#4199,#2910,ConvertStringSecurityDescriptorToSecurityDescriptorW,GetLastError,GetSecurityDescriptorLength,#823,GetLastError,#2910,#2910,LocalFree,LocalFree,GetLastError,#2910,#2910,#2910,#2755,#4272,#858,#800,#2910,_wtoi,#2910,#2755,#4272,#858,#800,#858,GetLastError,#2910,#2910,#2910,#2910,#2910,#2755,#4272,#858,#800,#6278,#6279,wcscmp,#2910,swscanf,#2910,#2910,#2910,#2910,#2910,#2910,#2910,#2910,#2910,#2910,#2910,#2910,#2755,#4272,#858,#800,#540,#540,#2755,#858,#861,#4272,#858,#800,#4124,#858,#800,#2910,wcscmp,#2910,#2910,LogonUserW,GetLastError,#2910,#2910,#800,#800,#800,#800,#2910,#2755,#4272,#858,#800,#858,#861,#861,GetLastError,#2910,#2910,#2910,#2755,#4272,#858,#800,#2755,#538,#4272,#858,#800,#4124,#858,#800,#2910,#2910,#858,GetLastError,#2910,#2910,#2910,#2755,#4272,#858,#800,#2755,#4272,#4124,#858,#800,#4197,#2910,#2910,#2910,#2910,#2910,#800,#537,#800,GetComputerNameW,#861,#927,#858,#800,#538,#922,#800,#800,#2910,#2910,#2910,#2910,#800,#2910,wcsncpy,#861,#861,#800,#2910,#2910,#2910,#2755,#4272,#858,#800,#2756,#2756,#2756,#2756,#2910,#2755,#4272,#858,#800,#5679,#861,#4273,#858,#800,#858,#941,#2910,#2755,#4272,#858,#800,#538,#925,#800,#2910,#2755,#4272,#858,#800,#2755,#4124,#858,#800,#4272,#858,#800,#2755,#540,#4272,#858,#800,#4124,#858,#800,#2756,#2756,#4124,#858,#800,#2910,#2910,wcscmp,GetComputerNameW,#861,#927,#858,#800,#538,#922,#800,#800,#2910,#2910,#2910,#2910,#2910,#800,#800,GetLastError,#2910,#2910,#2910,wcsncpy,wcsncpy,#2910,wcsncpy,#800,#800,#2755,#4272,#858,#800,#2755,#4124,#858,#800,#4272,#858,#800,#2910,#858,GetLastError,#2910,#2910,#858,GetLastError,#2910,#2910,#2910,#2910,#2910,#2755,#4272,#858,#800,#2755,#858,#861,#4124,#858,#800,#4272,#858,#800,#2910,#2910,#2910,#858,GetLastError,#2910,#2910,#2755,#4124,#858,#800,wcsncpy,#2910,GetLengthSid,GetLengthSid,#2910,#2910,#2910,#2755,#4272,#858,#800,#2756,#4124,#858,#800,#6278,#6279,#4272,#858,#800,GetLastError,#2910,#2910,#2910,swscanf,#2910,GetLengthSid,GetLengthSid,GetLengthSid,#2755,#4272,#858,#800,#858,GetLastError,#2910,#2755,#4272,#858,#800,#858,GetLastError,#2910,46_2_010383F6
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpProcess created: C:\Program Files\FastestVPN\Resources\ComDebug.exe "C:\Program Files\FastestVPN\Resources\ComDebug.exe" Jump to behavior
      Source: C:\Program Files\FastestVPN\Resources\ComDebug.exeProcess created: C:\Windows\SysWOW64\more.com C:\Windows\SysWOW64\more.comJump to behavior
      Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\reg.exe reg Query "HKLM\Hardware\Description\System\CentralProcessor\0" Jump to behavior
      Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\find.exe find /i "x86" Jump to behavior
      Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c verJump to behavior
      Source: C:\Windows\System32\cmd.exeProcess created: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exe tapinstall.exe remove tap0901Jump to behavior
      Source: C:\Windows\System32\cmd.exeProcess created: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exe tapinstall.exe install OemVista.inf tap0901Jump to behavior
      Source: C:\Program Files\FastestVPN\FastestVPN.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "powershell" -windowstyle hidden get-wmiobject Win32_ComputerSystemProduct | Select-Object -ExpandProperty UUID
      Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\sc.exe sc stop fastestvpndriver
      Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\reg.exe reg Query "HKLM\Hardware\Description\System\CentralProcessor\0"
      Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\find.exe find /i "x86"
      Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\reg.exe reg QUERY "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion"
      Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\find.exe find /i "Windows 7"
      Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\xcopy.exe xcopy /y driver\windows8\amd64\fastestvpndriver.sys C:\Windows\system32\drivers
      Source: C:\Windows\System32\cmd.exeProcess created: C:\Program Files\FastestVPN\Resources\sp\release\nfregdrv.exe release\nfregdrv.exe -u fastestvpndriver
      Source: C:\Windows\System32\cmd.exeProcess created: C:\Program Files\FastestVPN\Resources\sp\release\nfregdrv.exe release\nfregdrv.exe fastestvpndriver
      Source: C:\Windows\System32\svchost.exeProcess created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 2540 -ip 2540
      Source: C:\Windows\System32\svchost.exeProcess created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 2540 -s 1076
      Source: C:\Windows\System32\svchost.exeProcess created: C:\Windows\System32\drvinst.exe drvinst.exe "4" "0" "c:\users\user\appdata\local\temp\{4cb0eb0d-a103-7c4c-aedf-5caef9610c0c}\oemvista.inf" "9" "4d14a44ff" "0000000000000154" "winsta0\default" "0000000000000168" "208" "c:\program files\fastestvpn\resources\driver\windows10\amd64"
      Source: C:\Windows\System32\svchost.exeProcess created: C:\Windows\System32\drvinst.exe drvinst.exe "4" "0" "c:\users\user\appdata\local\temp\{4cb0eb0d-a103-7c4c-aedf-5caef9610c0c}\oemvista.inf" "9" "4d14a44ff" "0000000000000154" "winsta0\default" "0000000000000168" "208" "c:\program files\fastestvpn\resources\driver\windows10\amd64"Jump to behavior
      Source: FastestVPN.exe, FastestVPN.exe, 00000016.00000002.4059523377.0000000005A92000.00000002.00000001.01000000.0000001D.sdmpBinary or memory string: Shell_TrayWnd
      Source: OqAVRCkQ3T.tmp, 00000002.00000003.3069897606.0000000005580000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: RegDeleteKeyWRegEnumKeyExWRegEnumValueWRegOpenKeyExWRoundingMode(RtlGetVersionRtlInitStringRtlMoveMemorySelectedCountSetBrushOrgExSetScrollInfoSetWindowLongShellExecuteWShell_TrayWndShutting downStartServiceWStarting%s %sSysFreeStringSysListView32Thread32FirstUnknown stateValueOverflowVirtualUnlockWTSFreeMemoryWireGuard: %sWriteConsoleWbad flushGen bad map statedalTLDpSugct?debugCall2048effect == nilexchange fullfatal error: getTypeInfo: gethostbynamegetservbynameinvalid UTF-8invalid base invalid indexinvalid stylelevel 3 resetload64 failedmin too largenil stackbasenot availableout of memoryparsing time runtime: seq=runtime: val=srmount errortimer expiredtraceStackTabvalue method wglShareListswireguard-%s-wireguard.dllxadd64 failedxchg64 failed}
      Source: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exeCode function: 12_2_00007FF6EC501B20 cpuid 12_2_00007FF6EC501B20
      Source: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exeCode function: EnumSystemLocalesW,12_2_00007FF6EC4F4D3C
      Source: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exeCode function: EnumSystemLocalesW,12_2_00007FF6EC4F4E0C
      Source: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exeCode function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,12_2_00007FF6EC4F4ED0
      Source: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exeCode function: GetLocaleInfoW,12_2_00007FF6EC4F5120
      Source: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exeCode function: TranslateName,TranslateName,GetACP,IsValidCodePage,GetLocaleInfoW,12_2_00007FF6EC4F4960
      Source: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exeCode function: try_get_function,GetLocaleInfoW,12_2_00007FF6EC4E8B44
      Source: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exeCode function: EnumSystemLocalesW,12_2_00007FF6EC4F4CB8
      Source: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exeCode function: EnumSystemLocalesW,12_2_00007FF6EC4E7A70
      Source: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exeCode function: EnumSystemLocalesW,12_2_00007FF6EC4E7B7C
      Source: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exeCode function: EnumSystemLocalesW,12_2_00007FF6EC4E7BF8
      Source: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exeCode function: GetLocaleInfoW,GetLocaleInfoW,GetACP,12_2_00007FF6EC4F5278
      Source: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exeCode function: GetLocaleInfoW,12_2_00007FF6EC4F534C
      Source: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exeCode function: EnumSystemLocalesW,GetUserDefaultLCID,ProcessCodePage,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,12_2_00007FF6EC4F5478
      Source: C:\Program Files\FastestVPN\Resources\sp\release\nfregdrv.exeCode function: GetLocaleInfoA,35_2_00406C2C
      Source: C:\Program Files\FastestVPN\Resources\sp\release\nfregdrv.exeCode function: GetLocaleInfoA,35_2_10011E31
      Source: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exeCode function: 12_2_00007FF6EC4B4820 SetupDiGetDeviceRegistryPropertyW,GetLastError,SetupDiGetDeviceRegistryPropertyW,12_2_00007FF6EC4B4820
      Source: C:\Windows\System32\reg.exeRegistry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0Jump to behavior
      Source: C:\Windows\System32\reg.exeRegistry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0Jump to behavior
      Source: C:\Windows\System32\reg.exeRegistry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0Jump to behavior
      Source: C:\Windows\System32\reg.exeRegistry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0Jump to behavior
      Source: C:\Windows\System32\reg.exeRegistry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0Jump to behavior
      Source: C:\Windows\System32\reg.exeRegistry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0Jump to behavior
      Source: C:\Windows\System32\reg.exeRegistry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0
      Source: C:\Windows\System32\reg.exeRegistry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0
      Source: C:\Windows\System32\reg.exeRegistry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0
      Source: C:\Windows\System32\reg.exeRegistry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0
      Source: C:\Windows\System32\reg.exeRegistry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0
      Source: C:\Windows\System32\reg.exeRegistry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0
      Source: C:\Windows\System32\reg.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion InstallDate
      Source: C:\Windows\System32\reg.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion ProductId
      Source: C:\Windows\System32\reg.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion DigitalProductId
      Source: C:\Windows\System32\reg.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion DigitalProductId4
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpQueries volume information: C:\ VolumeInformationJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpQueries volume information: C:\ VolumeInformationJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpQueries volume information: C:\ VolumeInformationJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpQueries volume information: C:\ VolumeInformationJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmpQueries volume information: C:\ VolumeInformationJump to behavior
      Source: C:\Program Files\FastestVPN\Resources\ComDebug.exeQueries volume information: C:\Users\user\AppData\Local\Temp\2807bd9f VolumeInformationJump to behavior
      Source: C:\Windows\System32\cmd.exeQueries volume information: C:\ VolumeInformationJump to behavior
      Source: C:\Windows\System32\cmd.exeQueries volume information: C:\ VolumeInformationJump to behavior
      Source: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exeQueries volume information: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tap0901.cat VolumeInformationJump to behavior
      Source: C:\Windows\System32\drvinst.exeQueries volume information: C:\Windows\System32\DriverStore\Temp\{eba04833-fdea-4f40-ac46-b79bff73f8ea}\tap0901.cat VolumeInformationJump to behavior
      Source: C:\Program Files\FastestVPN\FastestVPN.exeQueries volume information: C:\Program Files\FastestVPN\FastestVPN.exe VolumeInformation
      Source: C:\Program Files\FastestVPN\FastestVPN.exeQueries volume information: C:\Program Files\FastestVPN\SingleInstanceApplication.dll VolumeInformation
      Source: C:\Program Files\FastestVPN\FastestVPN.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Runtime.Remoting\v4.0_4.0.0.0__b77a5c561934e089\System.Runtime.Remoting.dll VolumeInformation
      Source: C:\Program Files\FastestVPN\FastestVPN.exeQueries volume information: C:\Program Files\FastestVPN\FastestVPN.Common.dll VolumeInformation
      Source: C:\Program Files\FastestVPN\FastestVPN.exeQueries volume information: C:\Program Files\FastestVPN\FastestVPN.DI.dll VolumeInformation
      Source: C:\Program Files\FastestVPN\FastestVPN.exeQueries volume information: C:\Program Files\FastestVPN\Microsoft.Extensions.DependencyInjection.Abstractions.dll VolumeInformation
      Source: C:\Program Files\FastestVPN\FastestVPN.exeQueries volume information: C:\Program Files\FastestVPN\Microsoft.Extensions.DependencyInjection.dll VolumeInformation
      Source: C:\Program Files\FastestVPN\FastestVPN.exeQueries volume information: C:\Program Files\FastestVPN\Microsoft.Bcl.AsyncInterfaces.dll VolumeInformation
      Source: C:\Program Files\FastestVPN\FastestVPN.exeQueries volume information: C:\Program Files\FastestVPN\System.Threading.Tasks.Extensions.dll VolumeInformation
      Source: C:\Program Files\FastestVPN\FastestVPN.exeQueries volume information: C:\Program Files\FastestVPN\FastestVPN.ViewModel.dll VolumeInformation
      Source: C:\Program Files\FastestVPN\FastestVPN.exeQueries volume information: C:\Program Files\FastestVPN\VPN.Common.dll VolumeInformation
      Source: C:\Program Files\FastestVPN\FastestVPN.exeQueries volume information: C:\Program Files\FastestVPN\FastestVPN.Diagnostics.dll VolumeInformation
      Source: C:\Program Files\FastestVPN\FastestVPN.exeQueries volume information: C:\Program Files\FastestVPN\FastestVPN.BLL.dll VolumeInformation
      Source: C:\Program Files\FastestVPN\FastestVPN.exeQueries volume information: C:\Program Files\FastestVPN\FastestVPN.Data.Local.dll VolumeInformation
      Source: C:\Program Files\FastestVPN\FastestVPN.exeQueries volume information: C:\Program Files\FastestVPN\FastestVPN.Data.Remote.dll VolumeInformation
      Source: C:\Program Files\FastestVPN\FastestVPN.exeQueries volume information: C:\Program Files\FastestVPN\Hardcodet.NotifyIcon.Wpf.dll VolumeInformation
      Source: C:\Program Files\FastestVPN\FastestVPN.exeQueries volume information: C:\Program Files\FastestVPN\WpfAnimatedGif.dll VolumeInformation
      Source: C:\Program Files\FastestVPN\FastestVPN.exeQueries volume information: C:\Program Files\FastestVPN\Newtonsoft.Json.dll VolumeInformation
      Source: C:\Program Files\FastestVPN\FastestVPN.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\PresentationFramework-SystemXml\v4.0_4.0.0.0__b77a5c561934e089\PresentationFramework-SystemXml.dll VolumeInformation
      Source: C:\Program Files\FastestVPN\FastestVPN.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
      Source: C:\Program Files\FastestVPN\FastestVPN.exeQueries volume information: C:\Windows\Fonts\segoeui.ttf VolumeInformation
      Source: C:\Program Files\FastestVPN\FastestVPN.exeQueries volume information: C:\Windows\Fonts\segoeui.ttf VolumeInformation
      Source: C:\Program Files\FastestVPN\FastestVPN.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\UIAutomationTypes\v4.0_4.0.0.0__31bf3856ad364e35\UIAutomationTypes.dll VolumeInformation
      Source: C:\Program Files\FastestVPN\FastestVPN.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\UIAutomationProvider\v4.0_4.0.0.0__31bf3856ad364e35\UIAutomationProvider.dll VolumeInformation
      Source: C:\Program Files\FastestVPN\FastestVPN.exeQueries volume information: C:\Windows\Fonts\segoeui.ttf VolumeInformation
      Source: C:\Program Files\FastestVPN\FastestVPN.exeQueries volume information: C:\Program Files\FastestVPN\Microsoft.AppCenter.dll VolumeInformation
      Source: C:\Program Files\FastestVPN\FastestVPN.exeQueries volume information: C:\Program Files\FastestVPN\Microsoft.AppCenter.Analytics.dll VolumeInformation
      Source: C:\Program Files\FastestVPN\FastestVPN.exeQueries volume information: C:\Program Files\FastestVPN\Microsoft.AppCenter.Crashes.dll VolumeInformation
      Source: C:\Program Files\FastestVPN\FastestVPN.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
      Source: C:\Program Files\FastestVPN\FastestVPN.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.CSharp\v4.0_4.0.0.0__b03f5f7f11d50a3a\Microsoft.CSharp.dll VolumeInformation
      Source: C:\Program Files\FastestVPN\FastestVPN.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Dynamic\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Dynamic.dll VolumeInformation
      Source: C:\Program Files\FastestVPN\FastestVPN.exeQueries volume information: C:\Program Files\FastestVPN\SQLitePCLRaw.batteries_v2.dll VolumeInformation
      Source: C:\Program Files\FastestVPN\FastestVPN.exeQueries volume information: C:\Program Files\FastestVPN\SQLitePCLRaw.core.dll VolumeInformation
      Source: C:\Program Files\FastestVPN\FastestVPN.exeQueries volume information: C:\Program Files\FastestVPN\SQLitePCLRaw.provider.dynamic_cdecl.dll VolumeInformation
      Source: C:\Program Files\FastestVPN\FastestVPN.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\netstandard\v4.0_2.0.0.0__cc7b13ffcd2ddd51\netstandard.dll VolumeInformation
      Source: C:\Program Files\FastestVPN\FastestVPN.exeQueries volume information: C:\Program Files\FastestVPN\System.Memory.dll VolumeInformation
      Source: C:\Program Files\FastestVPN\FastestVPN.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Runtime.InteropServices.RuntimeInformation\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Runtime.InteropServices.RuntimeInformation.dll VolumeInformation
      Source: C:\Program Files\FastestVPN\FastestVPN.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ValueTuple\v4.0_4.0.0.0__cc7b13ffcd2ddd51\System.ValueTuple.dll VolumeInformation
      Source: C:\Program Files\FastestVPN\FastestVPN.exeQueries volume information: C:\Program Files\FastestVPN\System.Runtime.CompilerServices.Unsafe.dll VolumeInformation
      Source: C:\Program Files\FastestVPN\FastestVPN.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Deployment\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Deployment.dll VolumeInformation
      Source: C:\Program Files\FastestVPN\FastestVPN.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
      Source: C:\Program Files\FastestVPN\FastestVPN.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Web\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Web.dll VolumeInformation
      Source: C:\Windows\System32\cmd.exeQueries volume information: C:\ VolumeInformation
      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\ VolumeInformation
      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation
      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceProcess\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.ServiceProcess.dll VolumeInformation
      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
      Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation
      Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation
      Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation
      Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation
      Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation
      Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation
      Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation
      Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation
      Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation
      Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation
      Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation
      Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ VolumeInformation
      Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ VolumeInformation
      Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeQueries volume information: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe VolumeInformation
      Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceProcess\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.ServiceProcess.dll VolumeInformation
      Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeQueries volume information: C:\Program Files\FastestVPN\Service\Microsoft.AspNet.SignalR.Core.dll VolumeInformation
      Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeQueries volume information: C:\Program Files\FastestVPN\Service\VPN.Common.dll VolumeInformation
      Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeQueries volume information: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe VolumeInformation
      Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceProcess\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.ServiceProcess.dll VolumeInformation
      Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeQueries volume information: C:\Program Files\FastestVPN\Service\Microsoft.AspNet.SignalR.Core.dll VolumeInformation
      Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeQueries volume information: C:\Program Files\FastestVPN\Service\VPN.Common.dll VolumeInformation
      Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
      Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
      Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\SMDiagnostics\v4.0_4.0.0.0__b77a5c561934e089\SMDiagnostics.dll VolumeInformation
      Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel.Internals\v4.0_4.0.0.0__31bf3856ad364e35\System.ServiceModel.Internals.dll VolumeInformation
      Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeQueries volume information: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe VolumeInformation
      Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceProcess\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.ServiceProcess.dll VolumeInformation
      Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeQueries volume information: C:\Program Files\FastestVPN\Service\FastestVPN.Common.dll VolumeInformation
      Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeQueries volume information: C:\Program Files\FastestVPN\Service\Microsoft.Owin.Hosting.dll VolumeInformation
      Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeQueries volume information: C:\Program Files\FastestVPN\Service\Microsoft.Owin.dll VolumeInformation
      Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeQueries volume information: C:\Program Files\FastestVPN\Service\Owin.dll VolumeInformation
      Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeQueries volume information: C:\Program Files\FastestVPN\Service\Microsoft.Owin.Host.HttpListener.dll VolumeInformation
      Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeQueries volume information: C:\Program Files\FastestVPN\Service\FastestVPN.Common.dll VolumeInformation
      Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeQueries volume information: C:\Program Files\FastestVPN\Service\fix-dns-leak-32.dll VolumeInformation
      Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeQueries volume information: C:\Program Files\FastestVPN\Service\Microsoft.AspNet.SignalR.Core.dll VolumeInformation
      Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeQueries volume information: C:\Program Files\FastestVPN\Service\Microsoft.AspNet.SignalR.Core.dll VolumeInformation
      Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeQueries volume information: C:\Program Files\FastestVPN\Service\Microsoft.Owin.Cors.dll VolumeInformation
      Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeQueries volume information: C:\Program Files\FastestVPN\Service\Microsoft.Owin.Cors.dll VolumeInformation
      Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeQueries volume information: C:\Program Files\FastestVPN\Service\Microsoft.Owin.Diagnostics.dll VolumeInformation
      Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeQueries volume information: C:\Program Files\FastestVPN\Service\Microsoft.Owin.Diagnostics.dll VolumeInformation
      Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeQueries volume information: C:\Program Files\FastestVPN\Service\Microsoft.Owin.dll VolumeInformation
      Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeQueries volume information: C:\Program Files\FastestVPN\Service\Microsoft.Owin.Host.HttpListener.dll VolumeInformation
      Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeQueries volume information: C:\Program Files\FastestVPN\Service\Microsoft.Owin.Security.dll VolumeInformation
      Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeQueries volume information: C:\Program Files\FastestVPN\Service\Newtonsoft.Json.dll VolumeInformation
      Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeQueries volume information: C:\Program Files\FastestVPN\Service\Newtonsoft.Json.dll VolumeInformation
      Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeQueries volume information: C:\Program Files\FastestVPN\Service\nfapi.dll VolumeInformation
      Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeQueries volume information: C:\Program Files\FastestVPN\Service\Owin.dll VolumeInformation
      Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeQueries volume information: C:\Program Files\FastestVPN\Service\System.Web.Cors.dll VolumeInformation
      Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeQueries volume information: C:\Program Files\FastestVPN\Service\System.Web.Cors.dll VolumeInformation
      Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeQueries volume information: C:\Program Files\FastestVPN\Service\VPN.AdvancedNetwork.dll VolumeInformation
      Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeQueries volume information: C:\Program Files\FastestVPN\Service\VPN.AdvancedNetwork.dll VolumeInformation
      Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeQueries volume information: C:\Program Files\FastestVPN\Service\VPN.Common.dll VolumeInformation
      Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeQueries volume information: C:\Program Files\FastestVPN\Service\VPN.Common.dll VolumeInformation
      Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeQueries volume information: C:\Program Files\FastestVPN\Service\VPN.dll VolumeInformation
      Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeQueries volume information: C:\Program Files\FastestVPN\Service\VPN.dll VolumeInformation
      Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeQueries volume information: C:\Program Files\FastestVPN\Service\VPN.OpenVpn.dll VolumeInformation
      Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeQueries volume information: C:\Program Files\FastestVPN\Service\VPN.RAS.dll VolumeInformation
      Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeQueries volume information: C:\Program Files\FastestVPN\Service\VPN.WireGuard.dll VolumeInformation
      Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeQueries volume information: C:\Program Files\FastestVPN\Service\VPN.WireGuard.dll VolumeInformation
      Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeQueries volume information: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe VolumeInformation
      Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeQueries volume information: C:\Program Files\FastestVPN\Service\subinacl.exe VolumeInformation
      Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeQueries volume information: C:\Program Files\FastestVPN\Service\FastestVPN.Common.dll VolumeInformation
      Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeQueries volume information: C:\Program Files\FastestVPN\Service\fix-dns-leak-32.dll VolumeInformation
      Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeQueries volume information: C:\Program Files\FastestVPN\Service\iphelperclose.dll VolumeInformation
      Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeQueries volume information: C:\Program Files\FastestVPN\Service\Microsoft.AspNet.SignalR.Core.dll VolumeInformation
      Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeQueries volume information: C:\Program Files\FastestVPN\Service\Microsoft.Owin.Cors.dll VolumeInformation
      Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeQueries volume information: C:\Program Files\FastestVPN\Service\Microsoft.Owin.Diagnostics.dll VolumeInformation
      Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeQueries volume information: C:\Program Files\FastestVPN\Service\Microsoft.Owin.Host.HttpListener.dll VolumeInformation
      Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeQueries volume information: C:\Program Files\FastestVPN\Service\Microsoft.Owin.Hosting.dll VolumeInformation
      Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeQueries volume information: C:\Program Files\FastestVPN\Service\Microsoft.Owin.Security.dll VolumeInformation
      Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeQueries volume information: C:\Program Files\FastestVPN\Service\Newtonsoft.Json.dll VolumeInformation
      Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeQueries volume information: C:\Program Files\FastestVPN\Service\System.Web.Cors.dll VolumeInformation
      Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeQueries volume information: C:\Program Files\FastestVPN\Service\VPN.AdvancedNetwork.dll VolumeInformation
      Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeQueries volume information: C:\Program Files\FastestVPN\Service\VPN.Common.dll VolumeInformation
      Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeQueries volume information: C:\Program Files\FastestVPN\Service\VPN.RAS.dll VolumeInformation
      Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation
      Source: C:\Program Files\FastestVPN\FastestVPN.exeQueries volume information: C:\Program Files\FastestVPN\FastestVPN.exe VolumeInformation
      Source: C:\Program Files\FastestVPN\FastestVPN.exeQueries volume information: C:\Program Files\FastestVPN\SingleInstanceApplication.dll VolumeInformation
      Source: C:\Program Files\FastestVPN\FastestVPN.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Runtime.Remoting\v4.0_4.0.0.0__b77a5c561934e089\System.Runtime.Remoting.dll VolumeInformation
      Source: C:\Program Files\FastestVPN\FastestVPN.exeCode function: 22_2_00CF27C8 CreateNamedPipeA,22_2_00CF27C8
      Source: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exeCode function: 12_2_00007FF6EC4E8BC8 try_get_function,GetSystemTimeAsFileTime,12_2_00007FF6EC4E8BC8
      Source: C:\Program Files\FastestVPN\subinacl.exeCode function: 46_2_0102E7AC __EH_prolog,#540,#2755,#858,#2910,#2910,LookupAccountNameW,#861,#942,#940,#4197,#4197,#800,#2910,#2910,LookupAccountNameW,#858,46_2_0102E7AC
      Source: C:\Program Files\FastestVPN\Resources\sp\release\nfregdrv.exeCode function: 35_2_00401160 GetStartupInfoA,GetProcessHeap,GetProcessHeap,HeapAlloc,_fast_error_exit,GetVersionExA,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,_fast_error_exit,_fast_error_exit,__RTC_Initialize,__ioinit,__amsg_exit,GetCommandLineA,___crtGetEnvironmentStringsA,__setargv,__amsg_exit,__setenvp,__amsg_exit,__cinit,__amsg_exit,__wincmdln,35_2_00401160
      Source: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuidJump to behavior
      Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeRegistry key created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\8CF427FD790C3AD166068DE81E57EFBB932272D4 Blob

      Stealing of Sensitive Information

      barindex
      Modifies the DNS server
      Source: C:\Windows\System32\svchost.exeRegistry value created:
      Source: FastestVPN.WindowsService.exe, 00000032.00000002.4025246226.0000000004152000.00000002.00000001.01000000.00000037.sdmpBinary or memory string: OWIN_SERVER@Microsoft.Owin.Host.HttpListener
      Source: FastestVPN.WindowsService.exe, 00000032.00000002.4025246226.0000000004152000.00000002.00000001.01000000.00000037.sdmpBinary or memory string: OWIN_SERVERAMicrosoft.Owin.Host.HttpListenerPORT
      Source: FastestVPN.WindowsService.exe, 00000032.00000002.4019346826.000000000183D000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: OWIN_SERVER
      Source: FastestVPN.WindowsService.exeBinary or memory string: WIN_SERVER
      Source: C:\Program Files\FastestVPN\Resources\sp\release\nfregdrv.exeCode function: 35_2_10014170 ?nf_deleteBindingRules@nfapi@@YA?AW4_NF_STATUS@@XZ,EnterCriticalSection,LeaveCriticalSection,DeviceIoControl,LeaveCriticalSection,LeaveCriticalSection,35_2_10014170
      Source: C:\Program Files\FastestVPN\Resources\sp\release\nfregdrv.exeCode function: 35_2_100141E0 ?nf_addBindingRule@nfapi@@YA?AW4_NF_STATUS@@PAU_NF_BINDING_RULE@1@H@Z,EnterCriticalSection,LeaveCriticalSection,DeviceIoControl,LeaveCriticalSection,LeaveCriticalSection,35_2_100141E0

      Mitre Att&ck Matrix

      ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
      Gather Victim Identity Information1
      Scripting      		1
      Valid Accounts      		1
      Windows Management Instrumentation      		1
      Scripting      		1
      Abuse Elevation Control Mechanism      		11
      Disable or Modify Tools      		1
      Network Sniffing      		1
      System Time Discovery      		Remote Services1
      Archive Collected Data      		1
      Encrypted Channel      		Exfiltration Over Other Network MediumAbuse Accessibility Features
      CredentialsDomainsDefault Accounts1
      Native API      		1
      LSASS Driver      		1
      LSASS Driver      		1
      Deobfuscate/Decode Files or Information      		11
      Input Capture      		1
      Account Discovery      		Remote Desktop Protocol11
      Input Capture      		Junk DataExfiltration Over BluetoothNetwork Denial of Service
      Email AddressesDNS ServerDomain Accounts113
      Command and Scripting Interpreter      		1
      DLL Side-Loading      		1
      DLL Side-Loading      		1
      Abuse Elevation Control Mechanism      		Security Account Manager4
      File and Directory Discovery      		SMB/Windows Admin SharesData from Network Shared DriveSteganographyAutomated ExfiltrationData Encrypted for Impact
      Employee NamesVirtual Private ServerLocal Accounts1
      Scheduled Task/Job      		1
      Valid Accounts      		1
      Valid Accounts      		3
      Obfuscated Files or Information      		NTDS1
      Network Sniffing      		Distributed Component Object ModelInput CaptureProtocol ImpersonationTraffic DuplicationData Destruction
      Gather Victim Network InformationServerCloud Accounts13
      Service Execution      		45
      Windows Service      		11
      Access Token Manipulation      		2
      Software Packing      		LSA Secrets295
      System Information Discovery      		SSHKeyloggingFallback ChannelsScheduled TransferData Encrypted for Impact
      Domain PropertiesBotnetReplication Through Removable Media1
      PowerShell      		1
      Scheduled Task/Job      		45
      Windows Service      		1
      Timestomp      		Cached Domain Credentials2
      Query Registry      		VNCGUI Input CaptureMultiband CommunicationData Transfer Size LimitsService Stop
      DNSWeb ServicesExternal Remote ServicesSystemd Timers2
      Registry Run Keys / Startup Folder      		13
      Process Injection      		1
      DLL Side-Loading      		DCSync251
      Security Software Discovery      		Windows Remote ManagementWeb Portal CaptureCommonly Used PortExfiltration Over C2 ChannelInhibit System Recovery
      Network Trust DependenciesServerlessDrive-by CompromiseContainer Orchestration JobScheduled Task/Job1
      Scheduled Task/Job      		1
      File Deletion      		Proc Filesystem2
      Process Discovery      		Cloud ServicesCredential API HookingApplication Layer ProtocolExfiltration Over Alternative ProtocolDefacement
      Network TopologyMalvertisingExploit Public-Facing ApplicationCommand and Scripting InterpreterAt2
      Registry Run Keys / Startup Folder      		33
      Masquerading      		/etc/passwd and /etc/shadow61
      Virtualization/Sandbox Evasion      		Direct Cloud VM ConnectionsData StagedWeb ProtocolsExfiltration Over Symmetric Encrypted Non-C2 ProtocolInternal Defacement
      IP AddressesCompromise InfrastructureSupply Chain CompromisePowerShellCronCron1
      Valid Accounts      		Network Sniffing1
      Application Window Discovery      		Shared WebrootLocal Data StagingFile Transfer ProtocolsExfiltration Over Asymmetric Encrypted Non-C2 ProtocolExternal Defacement
      Network Security AppliancesDomainsCompromise Software Dependencies and Development ToolsAppleScriptLaunchdLaunchd2
      Modify Registry      		Input Capture3
      System Owner/User Discovery      		Software Deployment ToolsRemote Data StagingMail ProtocolsExfiltration Over Unencrypted Non-C2 ProtocolFirmware Corruption
      Gather Victim Org InformationDNS ServerCompromise Software Supply ChainWindows Command ShellScheduled TaskScheduled Task61
      Virtualization/Sandbox Evasion      		KeyloggingProcess DiscoveryTaint Shared ContentScreen CaptureDNSExfiltration Over Physical MediumResource Hijacking
      Determine Physical LocationsVirtual Private ServerCompromise Hardware Supply ChainUnix ShellSystemd TimersSystemd Timers11
      Access Token Manipulation      		GUI Input CapturePermission Groups DiscoveryReplication Through Removable MediaEmail CollectionProxyExfiltration over USBNetwork Denial of Service
      Business RelationshipsServerTrusted RelationshipVisual BasicContainer Orchestration JobContainer Orchestration Job13
      Process Injection      		Web Portal CaptureLocal GroupsComponent Object Model and Distributed COMLocal Email CollectionInternal ProxyCommonly Used PortDirect Network Flood

      Behavior Graph

      Hide Legend

      Legend:

      • Process
      • Signature
      • Created File
      • DNS/IP Info
      • Is Dropped
      • Is Windows Process
      • Number of created Registry Values
      • Number of created Files
      • Visual Basic
      • Delphi
      • Java
      • .Net C# or VB.NET
      • C, C++ or other language
      • Is malicious
      • Internet
      behaviorgraph top1 signatures2 2 Behavior Graph ID: 1524835 Sample: OqAVRCkQ3T.exe Startdate: 03/10/2024 Architecture: WINDOWS Score: 44 91 Yara detected UAC Bypass using CMSTP 2->91 93 NDIS Filter Driver detected (likely used to intercept and sniff network traffic) 2->93 95 Suspicious powershell command line found 2->95 97 2 other signatures 2->97 9 OqAVRCkQ3T.exe 2 2->9         started        12 FastestVPN.WindowsService.exe 2->12         started        15 FastestVPN.exe 2->15         started        17 4 other processes 2->17 process3 dnsIp4 81 C:\Users\user\AppData\...\OqAVRCkQ3T.tmp, PE32 9->81 dropped 20 OqAVRCkQ3T.tmp 28 163 9->20         started        99 Reads the Security eventlog 12->99 101 Reads the System eventlog 12->101 103 Suspicious powershell command line found 15->103 23 powershell.exe 15->23         started        89 127.0.0.1 unknown unknown 17->89 105 Modifies the DNS server 17->105 25 drvinst.exe 12 17->25         started        27 drvinst.exe 46 2 17->27         started        29 WerFault.exe 17->29         started        file5 signatures6 process7 file8 65 C:\...\FastestVPN.WindowsService.exe (copy), PE32 20->65 dropped 67 C:\Program Files\...\ComDebug.exe (copy), PE32 20->67 dropped 69 C:\Program Files\...\FastestVPN.exe (copy), PE32 20->69 dropped 79 196 other files (2 malicious) 20->79 dropped 31 cmd.exe 20->31         started        34 cmd.exe 1 20->34         started        36 FastestVPN.WindowsService.exe 20->36         started        40 7 other processes 20->40 38 conhost.exe 23->38         started        71 C:\Windows\System32\...\tap0901.sys (copy), PE32+ 25->71 dropped 73 C:\Windows\System32\...\SETB2A8.tmp, PE32+ 25->73 dropped 75 C:\Windows\System32\...\tap0901.sys (copy), PE32+ 27->75 dropped 77 C:\Windows\System32\drivers\SETBA95.tmp, PE32+ 27->77 dropped process9 signatures10 107 Uses cmd line tools excessively to alter registry or file data 31->107 109 Queries sensitive system registry key value via command line tool 31->109 42 sc.exe 31->42         started        44 xcopy.exe 31->44         started        55 7 other processes 31->55 47 tapinstall.exe 1 8 34->47         started        49 reg.exe 1 34->49         started        57 4 other processes 34->57 111 Reads the Security eventlog 36->111 113 Reads the System eventlog 36->113 51 WerFault.exe 36->51         started        115 Found direct / indirect Syscall (likely to bypass EDR) 40->115 53 more.com 1 40->53         started        59 4 other processes 40->59 process11 file12 61 conhost.exe 42->61         started        83 C:\Windows\System32\...\fastestvpndriver.sys, PE32+ 44->83 dropped 85 C:\Users\user\AppData\...\tap0901.sys (copy), PE32+ 47->85 dropped 87 C:\Users\user\AppData\Local\...\SETB0E3.tmp, PE32+ 47->87 dropped 63 conhost.exe 53->63         started        process13

      Screenshots

      Thumbnails

      This section contains all screenshots as thumbnails, including those not shown in the slideshow.


      windows-stand

      Antivirus, Machine Learning and Genetic Malware Detection

      Initial Sample

      SourceDetectionScannerLabelLink
      OqAVRCkQ3T.exe0%ReversingLabs
      OqAVRCkQ3T.exe6%VirustotalBrowse

      Dropped Files

      SourceDetectionScannerLabelLink
      C:\Program Files\FastestVPN\BouncyCastle.Crypto.dll (copy)0%ReversingLabs
      C:\Program Files\FastestVPN\FastestVPN.BLL.dll (copy)0%ReversingLabs
      C:\Program Files\FastestVPN\FastestVPN.Common.dll (copy)0%ReversingLabs
      C:\Program Files\FastestVPN\FastestVPN.DI.dll (copy)0%ReversingLabs
      C:\Program Files\FastestVPN\FastestVPN.Data.Local.dll (copy)0%ReversingLabs
      C:\Program Files\FastestVPN\FastestVPN.Data.Remote.dll (copy)0%ReversingLabs
      C:\Program Files\FastestVPN\FastestVPN.Diagnostics.dll (copy)0%ReversingLabs
      C:\Program Files\FastestVPN\FastestVPN.ViewModel.dll (copy)0%ReversingLabs
      C:\Program Files\FastestVPN\FastestVPN.exe (copy)0%ReversingLabs
      C:\Program Files\FastestVPN\Flurl.Http.dll (copy)0%ReversingLabs
      C:\Program Files\FastestVPN\Flurl.dll (copy)0%ReversingLabs
      C:\Program Files\FastestVPN\Hardcodet.NotifyIcon.Wpf.dll (copy)0%ReversingLabs
      C:\Program Files\FastestVPN\Microsoft.AppCenter.Analytics.dll (copy)0%ReversingLabs
      C:\Program Files\FastestVPN\Microsoft.AppCenter.Crashes.dll (copy)0%ReversingLabs
      C:\Program Files\FastestVPN\Microsoft.AppCenter.dll (copy)0%ReversingLabs
      C:\Program Files\FastestVPN\Microsoft.AspNet.SignalR.Client.dll (copy)0%ReversingLabs
      C:\Program Files\FastestVPN\Microsoft.Bcl.AsyncInterfaces.dll (copy)0%ReversingLabs
      C:\Program Files\FastestVPN\Microsoft.Extensions.DependencyInjection.Abstractions.dll (copy)0%ReversingLabs
      C:\Program Files\FastestVPN\Microsoft.Extensions.DependencyInjection.dll (copy)0%ReversingLabs
      C:\Program Files\FastestVPN\Newtonsoft.Json.dll (copy)0%ReversingLabs
      C:\Program Files\FastestVPN\Resources\ComDebug.exe (copy)3%ReversingLabs
      C:\Program Files\FastestVPN\Resources\devcon.exe (copy)0%ReversingLabs
      C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\is-4K729.tmp0%ReversingLabs
      C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\is-OI0G9.tmp0%ReversingLabs
      C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tap0901.sys (copy)0%ReversingLabs
      C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exe (copy)0%ReversingLabs
      C:\Program Files\FastestVPN\Resources\driver\windows10\i386\is-6GBPO.tmp0%ReversingLabs
      C:\Program Files\FastestVPN\Resources\driver\windows10\i386\is-SUSF8.tmp0%ReversingLabs
      C:\Program Files\FastestVPN\Resources\driver\windows10\i386\tap0901.sys (copy)0%ReversingLabs
      C:\Program Files\FastestVPN\Resources\driver\windows10\i386\tapinstall.exe (copy)0%ReversingLabs
      C:\Program Files\FastestVPN\Resources\driver\windows\amd64\is-9R4TG.tmp0%ReversingLabs
      C:\Program Files\FastestVPN\Resources\driver\windows\amd64\is-HM6P4.tmp0%ReversingLabs
      C:\Program Files\FastestVPN\Resources\driver\windows\amd64\tap0901.sys (copy)0%ReversingLabs
      C:\Program Files\FastestVPN\Resources\driver\windows\amd64\tapinstall.exe (copy)0%ReversingLabs
      C:\Program Files\FastestVPN\Resources\driver\windows\i386\is-DP5T8.tmp0%ReversingLabs
      C:\Program Files\FastestVPN\Resources\driver\windows\i386\is-LC5II.tmp0%ReversingLabs
      C:\Program Files\FastestVPN\Resources\driver\windows\i386\tap0901.sys (copy)0%ReversingLabs
      C:\Program Files\FastestVPN\Resources\driver\windows\i386\tapinstall.exe (copy)0%ReversingLabs

      Unpacked PE Files

      ⊘No Antivirus matches

      Domains

      SourceDetectionScannerLabelLink
      fp2e7a.wpc.phicdn.net0%VirustotalBrowse

      URLs

      SourceDetectionScannerLabelLink
      http://crl.sectigo.com/SectigoPublicCodeSigningRootR46.crl00%URL Reputationsafe
      http://crl.sectigo.com/SectigoPublicCodeSigningRootR46.crl00%URL Reputationsafe
      http://www.indyproject.org/0%URL Reputationsafe
      https://aka.ms/pscore6lB0%URL Reputationsafe
      https://www.remobjects.com/ps0%URL Reputationsafe
      https://nuget.org/nuget.exe0%URL Reputationsafe
      https://www.innosetup.com/0%URL Reputationsafe
      http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name0%URL Reputationsafe
      http://pesterbdd.com/images/Pester.png0%URL Reputationsafe
      http://schemas.xmlsoap.org/soap/encoding/0%URL Reputationsafe
      http://www.entrust.net/rpa030%URL Reputationsafe
      https://contoso.com/Icon0%URL Reputationsafe
      http://schemas.xmlsoap.org/wsdl/0%URL Reputationsafe
      https://www.entrust.net/rpa00%URL Reputationsafe
      https://fastestvpn.com/buy-vpn1%VirustotalBrowse
      http://ocsp.sectigo.com00%URL Reputationsafe
      http://ocsp.entrust.net030%URL Reputationsafe
      https://jrsoftware.org/ishelp/index.php?topic=setupcmdlineSetupU0%VirustotalBrowse
      http://ip-api.com/json0%URL Reputationsafe
      https://github.co0%VirustotalBrowse
      https://contoso.com/License0%URL Reputationsafe
      http://crt.sectigo.com/SectigoPublicCodeSigningRootR46.p7c0#0%URL Reputationsafe
      http://www.openssl.org/support/faq.html0%URL Reputationsafe
      http://schemas.datacontract.org0%VirustotalBrowse
      http://crl.thawte.com/ThawteTimestampingCA.crl00%URL Reputationsafe
      http://vovsoft.com/blog/how-to-activate-using-license-key/openU0%VirustotalBrowse
      https://contoso.com/0%URL Reputationsafe
      http://nuget.org/NuGet.exe0%URL Reputationsafe
      https://github.com/aspnet/AspNetKatanad0%VirustotalBrowse
      https://github.com/dotnet/corefx/tree/c6cf790234e063b855fcdb50f3fb1b3cfac7327580%VirustotalBrowse
      http://crt.sectigo.com/SectigoPublicCodeSigningCAEVR36.crt0#0%VirustotalBrowse
      https://github.com/hardcodet/wpf-notifyicon.0%VirustotalBrowse
      https://fastestvpn.com/terms-of-service?device=windows1%VirustotalBrowse
      https://vovsoft.com/files/batch-url-downloader.exe0%VirustotalBrowse
      https://github.com/dotnet/corefx/tree/7601f4f6225089ff0%VirustotalBrowse
      http://schemas.datacontract.org/2004/07/System.ServiceProcess0%VirustotalBrowse
      http://aia.entrust.net/ts2-chain256.p7c010%VirustotalBrowse
      http://www.hardcodet.net/taskbar0%VirustotalBrowse
      https://scripts.sil.org/OFL0%VirustotalBrowse
      https://www.fastestvpn.com/0%VirustotalBrowse
      https://fastestvpn.com/buy-vpn?device=windows1%VirustotalBrowse
      https://api.fastestvpn.com/v21%VirustotalBrowse
      https://vovsoft.com/files/text-edit-plus.exe1%VirustotalBrowse
      http://crl.entrust.net/g2ca.c0%VirustotalBrowse
      http://signalr.net/0%VirustotalBrowse
      http://www.entrust.net/rpa00%VirustotalBrowse
      https://in.appcenter.ms./logs?api-version=1.0.00%VirustotalBrowse
      http://wpfanimatedgif.codeplex.com1%VirustotalBrowse
      https://github.com/dotnet/corefx/tree/7601f4f6225089ffb291dc7d58293c7bbf5c5d4f0%VirustotalBrowse
      https://github.com/JamesNK/Newtonsoft.Jsond0%VirustotalBrowse
      http://schemas.datacontract.org/2004/07/0%VirustotalBrowse
      http://www.apache.org/licenses/LICENSE-2.0.html0%VirustotalBrowse
      http://www.google.com/bot.html)0%VirustotalBrowse
      https://api.fastestvpn.com//v2/chat1%VirustotalBrowse
      http://foo.com/foo0%VirustotalBrowse
      https://g.live.com/odclientsettings/Prod1C:0%VirustotalBrowse
      https://github.com/Pester/Pester1%VirustotalBrowse

      Domains and IPs

      Contacted Domains

      NameIPActiveMaliciousAntivirus DetectionReputation
      fp2e7a.wpc.phicdn.net
      		192.229.221.95
      		truefalseunknown

      URLs from Memory and Binaries

      NameSourceMaliciousAntivirus DetectionReputation
      https://jrsoftware.org/ishelp/index.php?topic=setupcmdlineSetupUOqAVRCkQ3T.exefalseunknown
      https://fastestvpn.com/buy-vpnFastestVPN.exe, FastestVPN.exe, 00000016.00000002.4057691774.0000000005872000.00000002.00000001.01000000.00000017.sdmpfalseunknown
      http://vovsoft.com/blog/how-to-activate-using-license-key/openUComDebug.exe, 00000006.00000000.2563954116.0000000000401000.00000020.00000001.01000000.00000008.sdmp, ComDebug.exe, 00000006.00000002.4022885088.00000000048BD000.00000004.00000020.00020000.00000000.sdmpfalseunknown
      http://crl.sectigo.com/SectigoPublicCodeSigningRootR46.crl0is-80EU7.tmp.2.dr, is-17HNF.tmp.2.dr, is-EANN9.tmp.2.drfalse
      • URL Reputation: safe
      • URL Reputation: safe
      		unknown
      http://schemas.datacontract.orgFastestVPN.WindowsService.exe, 0000002D.00000002.3041458929.0000000002EF5000.00000004.00000800.00020000.00000000.sdmpfalseunknown
      https://github.coFastestVPN.exe, 00000016.00000002.4060295521.0000000005C14000.00000004.00000020.00020000.00000000.sdmpfalseunknown
      https://github.com/Outfitio/Outfit-Fonts)onFastestVPN.exe, 00000016.00000002.4060295521.0000000005C14000.00000004.00000020.00020000.00000000.sdmpfalse
        		unknown
        https://github.com/dotnet/corefx/tree/c6cf790234e063b855fcdb50f3fb1b3cfac732758FastestVPN.exe, 00000016.00000002.4101032372.000000000BDD2000.00000002.00000001.01000000.00000033.sdmpfalseunknown
        http://crt.sectigo.com/SectigoPublicCodeSigningCAEVR36.crt0#is-80EU7.tmp.2.dr, is-17HNF.tmp.2.dr, is-EANN9.tmp.2.drfalseunknown
        https://github.com/aspnet/AspNetKatanadFastestVPN.WindowsService.exe, 00000032.00000002.4019346826.000000000183D000.00000004.00000800.00020000.00000000.sdmpfalseunknown
        https://github.com/hardcodet/wpf-notifyicon.FastestVPN.exe, 00000016.00000002.4059523377.0000000005A92000.00000002.00000001.01000000.0000001D.sdmpfalseunknown
        https://vovsoft.com/files/batch-url-downloader.exeComDebug.exe, 00000006.00000002.4022885088.0000000004DCC000.00000004.00000020.00020000.00000000.sdmp, ComDebug.exe, 00000006.00000002.4017666798.0000000002821000.00000004.00001000.00020000.00000000.sdmpfalseunknown
        http://www.indyproject.org/ComDebug.exe, 00000006.00000002.4017666798.0000000002850000.00000004.00001000.00020000.00000000.sdmp, ComDebug.exe, 00000006.00000000.2563954116.0000000000401000.00000020.00000001.01000000.00000008.sdmp, ComDebug.exe, 00000006.00000002.4022885088.00000000048BD000.00000004.00000020.00020000.00000000.sdmpfalse
        • URL Reputation: safe
        		unknown
        https://fastestvpn.com/terms-of-service?device=windowsFastestVPN.exe, FastestVPN.exe, 00000016.00000002.4057691774.0000000005872000.00000002.00000001.01000000.00000017.sdmpfalseunknown
        http://aia.entrust.net/ts2-chain256.p7c01OqAVRCkQ3T.tmp, 00000002.00000003.3069897606.0000000005580000.00000004.00001000.00020000.00000000.sdmp, OqAVRCkQ3T.tmp, 00000002.00000002.3098599633.000000000018C000.00000004.00000010.00020000.00000000.sdmp, ComDebug.exe, 00000006.00000002.4022885088.0000000004DCC000.00000004.00000020.00020000.00000000.sdmp, FastestVPN.exe, 00000016.00000002.4071204873.0000000008648000.00000004.00000020.00020000.00000000.sdmp, FastestVPN.WindowsService.exe, 0000002D.00000002.3044325400.00000000058C0000.00000004.00000020.00020000.00000000.sdmp, FastestVPN.WindowsService.exe, 0000002D.00000002.3041213432.0000000001570000.00000004.00000020.00020000.00000000.sdmp, is-0B265.tmp.2.dr, is-DQ4HF.tmp.2.dr, is-80EU7.tmp.2.dr, is-NJH6K.tmp.2.dr, is-CVBBG.tmp.2.dr, is-17HNF.tmp.2.dr, is-EANN9.tmp.2.dr, is-Q6C5B.tmp.2.dr, is-NGC8I.tmp.2.dr, is-L0D1P.tmp.2.dr, is-AC86P.tmp.2.drfalseunknown
        https://vovsoft.com/files/text-edit-plus.exeComDebug.exe, 00000006.00000002.4022885088.0000000004DCC000.00000004.00000020.00020000.00000000.sdmp, ComDebug.exe, 00000006.00000002.4017666798.0000000002821000.00000004.00001000.00020000.00000000.sdmpfalseunknown
        http://schemas.datacontract.org/2004/07/System.ServiceProcessFastestVPN.WindowsService.exe, 0000002D.00000002.3041458929.0000000002EF5000.00000004.00000800.00020000.00000000.sdmpfalseunknown
        http://www.hardcodet.net/taskbarFastestVPN.exe, 00000016.00000002.4059523377.0000000005A92000.00000002.00000001.01000000.0000001D.sdmp, FastestVPN.exe, 00000016.00000000.2625434306.00000000005AD000.00000002.00000001.01000000.0000000D.sdmpfalseunknown
        https://github.com/dotnet/corefx/tree/7601f4f6225089ffFastestVPN.exefalseunknown
        https://scripts.sil.org/OFLFastestVPN.exe, 00000016.00000002.4079933992.0000000008A62000.00000004.00000800.00020000.00000000.sdmp, FastestVPN.exe, 00000016.00000002.4060295521.0000000005C08000.00000004.00000020.00020000.00000000.sdmpfalseunknown
        https://aka.ms/pscore6lBpowershell.exe, 0000001D.00000002.2764855375.0000000004FA1000.00000004.00000800.00020000.00000000.sdmpfalse
        • URL Reputation: safe
        		unknown
        https://github.com/Outfitio/Outfit-Fonts)tVPT)cFastestVPN.exe, 00000016.00000002.4060295521.0000000005C14000.00000004.00000020.00020000.00000000.sdmpfalse
          		unknown
          https://www.fastestvpn.com/OqAVRCkQ3T.exe, 00000000.00000003.3102125657.0000000002336000.00000004.00001000.00020000.00000000.sdmp, OqAVRCkQ3T.exe, 00000000.00000003.2147099573.00000000027F0000.00000004.00001000.00020000.00000000.sdmp, OqAVRCkQ3T.tmp, 00000002.00000003.2152152914.00000000033B0000.00000004.00001000.00020000.00000000.sdmpfalseunknown
          https://www.remobjects.com/psOqAVRCkQ3T.exe, 00000000.00000003.2148424618.00000000027F0000.00000004.00001000.00020000.00000000.sdmp, OqAVRCkQ3T.exe, 00000000.00000003.2148872656.000000007FB7B000.00000004.00001000.00020000.00000000.sdmp, OqAVRCkQ3T.tmp, 00000002.00000000.2150644096.0000000000401000.00000020.00000001.01000000.00000004.sdmpfalse
          • URL Reputation: safe
          		unknown
          https://nuget.org/nuget.exepowershell.exe, 0000001D.00000002.2773499593.0000000006008000.00000004.00000800.00020000.00000000.sdmpfalse
          • URL Reputation: safe
          		unknown
          https://www.innosetup.com/OqAVRCkQ3T.exe, 00000000.00000003.2148424618.00000000027F0000.00000004.00001000.00020000.00000000.sdmp, OqAVRCkQ3T.exe, 00000000.00000003.2148872656.000000007FB7B000.00000004.00001000.00020000.00000000.sdmp, OqAVRCkQ3T.tmp, 00000002.00000000.2150644096.0000000000401000.00000020.00000001.01000000.00000004.sdmpfalse
          • URL Reputation: safe
          		unknown
          https://fastestvpn.com/buy-vpn?device=windowsFastestVPN.exe, FastestVPN.exe, 00000016.00000002.4057691774.0000000005872000.00000002.00000001.01000000.00000017.sdmpfalseunknown
          https://api.fastestvpn.com/v2FastestVPN.exe, FastestVPN.exe, 00000016.00000002.4058632607.00000000058D2000.00000002.00000001.01000000.0000001C.sdmpfalseunknown
          http://crl.entrust.net/g2ca.cFastestVPN.WindowsService.exe, 0000002D.00000002.3044325400.00000000058C0000.00000004.00000020.00020000.00000000.sdmpfalseunknown
          https://github.com/JamesNK/Newtonsoft.JsondFastestVPN.WindowsService.exe, 00000032.00000002.4019346826.000000000183D000.00000004.00000800.00020000.00000000.sdmpfalseunknown
          http://signalr.net/FastestVPN.WindowsService.exe, FastestVPN.WindowsService.exe, 00000027.00000002.3020164102.00000000050A2000.00000002.00000001.01000000.0000002A.sdmpfalseunknown
          https://in.appcenter.ms./logs?api-version=1.0.0FastestVPN.exe, 00000016.00000002.4078599339.0000000008862000.00000002.00000001.01000000.0000002D.sdmpfalseunknown
          http://schemas.xmlsoap.org/ws/2005/05/identity/claims/nameFastestVPN.exe, 00000016.00000002.4021722402.0000000002881000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001D.00000002.2764855375.0000000004FA1000.00000004.00000800.00020000.00000000.sdmp, FastestVPN.WindowsService.exe, FastestVPN.WindowsService.exe, 00000032.00000002.4019346826.00000000017E6000.00000004.00000800.00020000.00000000.sdmpfalse
          • URL Reputation: safe
          		unknown
          http://wpfanimatedgif.codeplex.comFastestVPN.exe, 00000016.00000002.4021722402.0000000002881000.00000004.00000800.00020000.00000000.sdmp, FastestVPN.exe, 00000016.00000000.2625434306.00000000005AD000.00000002.00000001.01000000.0000000D.sdmp, FastestVPN.exe, 00000016.00000002.4067532678.0000000005DF2000.00000002.00000001.01000000.0000001E.sdmpfalseunknown
          http://www.entrust.net/rpa0OqAVRCkQ3T.tmp, 00000002.00000003.3069897606.0000000005580000.00000004.00001000.00020000.00000000.sdmp, OqAVRCkQ3T.tmp, 00000002.00000002.3098599633.000000000018C000.00000004.00000010.00020000.00000000.sdmp, ComDebug.exe, 00000006.00000002.4022885088.0000000004DCC000.00000004.00000020.00020000.00000000.sdmp, FastestVPN.WindowsService.exe, 0000002D.00000002.3041213432.0000000001570000.00000004.00000020.00020000.00000000.sdmp, FastestVPN.WindowsService.exe, 0000002D.00000002.3039966230.000000000118C000.00000004.00000020.00020000.00000000.sdmp, is-0B265.tmp.2.dr, is-DQ4HF.tmp.2.dr, is-80EU7.tmp.2.dr, is-NJH6K.tmp.2.dr, is-CVBBG.tmp.2.dr, is-17HNF.tmp.2.dr, is-EANN9.tmp.2.dr, is-Q6C5B.tmp.2.dr, is-NGC8I.tmp.2.dr, is-L0D1P.tmp.2.dr, is-AC86P.tmp.2.drfalseunknown
          http://ocsp.sectigo.com0.is-80EU7.tmp.2.dr, is-17HNF.tmp.2.dr, is-EANN9.tmp.2.drfalse
            		unknown
            https://fastestvpn.com/upgrade?t=ndelyNN7yduAcFastestVPN.exefalse
              		unknown
              http://pesterbdd.com/images/Pester.pngpowershell.exe, 0000001D.00000002.2764855375.00000000050F1000.00000004.00000800.00020000.00000000.sdmpfalse
              • URL Reputation: safe
              		unknown
              http://schemas.xmlsoap.org/soap/encoding/FastestVPN.exe, 00000016.00000002.4021722402.0000000002881000.00000004.00000800.00020000.00000000.sdmpfalse
              • URL Reputation: safe
              		unknown
              http://schemas.datacontract.org/2004/07/FastestVPN.WindowsService.exe, 0000002D.00000002.3041458929.0000000002EF5000.00000004.00000800.00020000.00000000.sdmpfalseunknown
              http://www.apache.org/licenses/LICENSE-2.0.htmlpowershell.exe, 0000001D.00000002.2764855375.00000000050F1000.00000004.00000800.00020000.00000000.sdmpfalseunknown
              http://www.entrust.net/rpa03OqAVRCkQ3T.tmp, 00000002.00000003.3069897606.0000000005580000.00000004.00001000.00020000.00000000.sdmp, OqAVRCkQ3T.tmp, 00000002.00000002.3098599633.000000000018C000.00000004.00000010.00020000.00000000.sdmp, ComDebug.exe, 00000006.00000002.4022885088.0000000004DCC000.00000004.00000020.00020000.00000000.sdmp, FastestVPN.WindowsService.exe, 0000002D.00000002.3044325400.00000000058C0000.00000004.00000020.00020000.00000000.sdmp, FastestVPN.WindowsService.exe, 0000002D.00000002.3041213432.0000000001570000.00000004.00000020.00020000.00000000.sdmp, FastestVPN.WindowsService.exe, 0000002D.00000002.3039966230.000000000118C000.00000004.00000020.00020000.00000000.sdmp, is-0B265.tmp.2.dr, is-DQ4HF.tmp.2.dr, is-80EU7.tmp.2.dr, is-NJH6K.tmp.2.dr, is-CVBBG.tmp.2.dr, is-17HNF.tmp.2.dr, is-EANN9.tmp.2.dr, is-Q6C5B.tmp.2.dr, is-NGC8I.tmp.2.dr, is-L0D1P.tmp.2.dr, is-AC86P.tmp.2.drfalse
              • URL Reputation: safe
              		unknown
              http://www.google.com/bot.html)ComDebug.exe, 00000006.00000002.4017666798.000000000287D000.00000004.00001000.00020000.00000000.sdmp, ComDebug.exe, 00000006.00000002.4022885088.0000000004DCC000.00000004.00000020.00020000.00000000.sdmp, ComDebug.exe, 00000006.00000002.4017666798.0000000002821000.00000004.00001000.00020000.00000000.sdmpfalseunknown
              https://github.com/dotnet/corefx/tree/7601f4f6225089ffb291dc7d58293c7bbf5c5d4fFastestVPN.exe, FastestVPN.exe, 00000016.00000002.4056758757.00000000054D2000.00000002.00000001.01000000.00000016.sdmpfalseunknown
              https://contoso.com/Iconpowershell.exe, 0000001D.00000002.2773499593.0000000006008000.00000004.00000800.00020000.00000000.sdmpfalse
              • URL Reputation: safe
              		unknown
              https://github.com/Pester/Pesterpowershell.exe, 0000001D.00000002.2764855375.00000000050F1000.00000004.00000800.00020000.00000000.sdmpfalseunknown
              https://api.fastestvpn.com//v2/chatFastestVPN.exe, FastestVPN.exe, 00000016.00000002.4057691774.0000000005872000.00000002.00000001.01000000.00000017.sdmpfalseunknown
              http://foo.com/fooFastestVPN.exe, 00000034.00000002.3082000495.00000000029D1000.00000004.00000800.00020000.00000000.sdmpfalseunknown
              https://vovsoft.com/blog/credits-and-acknowledgements/openComDebug.exe, 00000006.00000000.2563954116.0000000000401000.00000020.00000001.01000000.00000008.sdmp, ComDebug.exe, 00000006.00000002.4022885088.00000000048BD000.00000004.00000020.00020000.00000000.sdmpfalse
                		unknown
                https://g.live.com/odclientsettings/Prod1C:svchost.exe, 0000001F.00000003.2655239463.000001E6FF6BE000.00000004.00000800.00020000.00000000.sdmpfalseunknown
                https://scripts.sil.org/OFLOFLFastestVPN.exe, 00000016.00000002.4060295521.0000000005C08000.00000004.00000020.00020000.00000000.sdmpfalse
                  		unknown
                  http://vovsoft.com/blog/how-to-uninstall-vovsoft-software/openUComDebug.exe, 00000006.00000000.2563954116.0000000000401000.00000020.00000001.01000000.00000008.sdmp, ComDebug.exe, 00000006.00000002.4022885088.00000000048BD000.00000004.00000020.00020000.00000000.sdmpfalse
                    		unknown
                    https://github.com/hardcodet/wpf-notifyiconFastestVPN.exe, FastestVPN.exe, 00000016.00000002.4059523377.0000000005A92000.00000002.00000001.01000000.0000001D.sdmpfalse
                      		unknown
                      http://schemas.xmlsoap.org/wsdl/FastestVPN.exe, 00000016.00000002.4021722402.0000000002881000.00000004.00000800.00020000.00000000.sdmpfalse
                      • URL Reputation: safe
                      		unknown
                      https://fastestvpn.com/password/resetFastestVPN.exe, FastestVPN.exe, 00000016.00000002.4057691774.0000000005872000.00000002.00000001.01000000.00000017.sdmpfalse
                        		unknown
                        https://www.newtonsoft.com/jsonschemaFastestVPN.WindowsService.exe, 00000032.00000002.4032701232.0000000004432000.00000002.00000001.01000000.0000003F.sdmpfalse
                          		unknown
                          http://defaultcontainer/FastestVPN;component/Assets/Fonts/outfit-variablefont_wght.ttfFastestVPN.exe, 00000016.00000002.4021722402.0000000002AE3000.00000004.00000800.00020000.00000000.sdmpfalse
                            		unknown
                            https://github.com/ericsink/SQLitePCL.rawFastestVPN.exe, FastestVPN.exe, 00000016.00000002.4100328999.000000000BD62000.00000002.00000001.01000000.00000032.sdmp, FastestVPN.exe, 00000016.00000002.4099109913.000000000BCF2000.00000002.00000001.01000000.00000030.sdmp, FastestVPN.exe, 00000016.00000002.4100015977.000000000BD42000.00000002.00000001.01000000.00000031.sdmp, is-AC86P.tmp.2.drfalse
                              		unknown
                              https://github.com/tmenier/Flurl.git5is-CVBBG.tmp.2.drfalse
                                		unknown
                                http://crl.entrust.net/ts2ca.crl0OqAVRCkQ3T.tmp, 00000002.00000003.3069897606.0000000005580000.00000004.00001000.00020000.00000000.sdmp, OqAVRCkQ3T.tmp, 00000002.00000002.3098599633.000000000018C000.00000004.00000010.00020000.00000000.sdmp, ComDebug.exe, 00000006.00000002.4022885088.0000000004DCC000.00000004.00000020.00020000.00000000.sdmp, FastestVPN.exe, 00000016.00000002.4071204873.0000000008648000.00000004.00000020.00020000.00000000.sdmp, FastestVPN.WindowsService.exe, 0000002D.00000002.3044325400.00000000058C0000.00000004.00000020.00020000.00000000.sdmp, FastestVPN.WindowsService.exe, 0000002D.00000002.3041213432.0000000001570000.00000004.00000020.00020000.00000000.sdmp, is-0B265.tmp.2.dr, is-DQ4HF.tmp.2.dr, is-80EU7.tmp.2.dr, is-NJH6K.tmp.2.dr, is-CVBBG.tmp.2.dr, is-17HNF.tmp.2.dr, is-EANN9.tmp.2.dr, is-Q6C5B.tmp.2.dr, is-NGC8I.tmp.2.dr, is-L0D1P.tmp.2.dr, is-AC86P.tmp.2.drfalse
                                  		unknown
                                  https://www.entrust.net/rpa0OqAVRCkQ3T.tmp, 00000002.00000003.3069897606.0000000005580000.00000004.00001000.00020000.00000000.sdmp, OqAVRCkQ3T.tmp, 00000002.00000002.3098599633.000000000018C000.00000004.00000010.00020000.00000000.sdmp, ComDebug.exe, 00000006.00000002.4022885088.0000000004DCC000.00000004.00000020.00020000.00000000.sdmp, FastestVPN.exe, 00000016.00000002.4071204873.0000000008648000.00000004.00000020.00020000.00000000.sdmp, FastestVPN.WindowsService.exe, 0000002D.00000002.3044325400.00000000058C0000.00000004.00000020.00020000.00000000.sdmp, FastestVPN.WindowsService.exe, 0000002D.00000002.3041213432.0000000001570000.00000004.00000020.00020000.00000000.sdmp, is-0B265.tmp.2.dr, is-DQ4HF.tmp.2.dr, is-80EU7.tmp.2.dr, is-NJH6K.tmp.2.dr, is-CVBBG.tmp.2.dr, is-17HNF.tmp.2.dr, is-EANN9.tmp.2.dr, is-Q6C5B.tmp.2.dr, is-NGC8I.tmp.2.dr, is-L0D1P.tmp.2.dr, is-AC86P.tmp.2.drfalse
                                  • URL Reputation: safe
                                  		unknown
                                  http://vovsoft.com/openUComDebug.exe, 00000006.00000000.2563954116.0000000000401000.00000020.00000001.01000000.00000008.sdmp, ComDebug.exe, 00000006.00000002.4022885088.00000000048BD000.00000004.00000020.00020000.00000000.sdmpfalse
                                    		unknown
                                    http://www.e-trust.be/CPS/QNcertsFastestVPN.exe, 00000016.00000002.4093911697.000000000B1D0000.00000004.00000020.00020000.00000000.sdmpfalse
                                      		unknown
                                      http://crl.entrust.net/g2ca.crl0OqAVRCkQ3T.tmp, 00000002.00000003.3069897606.0000000005580000.00000004.00001000.00020000.00000000.sdmp, OqAVRCkQ3T.tmp, 00000002.00000002.3098599633.000000000018C000.00000004.00000010.00020000.00000000.sdmp, ComDebug.exe, 00000006.00000002.4022885088.0000000004DCC000.00000004.00000020.00020000.00000000.sdmp, FastestVPN.WindowsService.exe, 0000002D.00000002.3041213432.0000000001570000.00000004.00000020.00020000.00000000.sdmp, FastestVPN.WindowsService.exe, 0000002D.00000002.3039966230.000000000118C000.00000004.00000020.00020000.00000000.sdmp, is-0B265.tmp.2.dr, is-DQ4HF.tmp.2.dr, is-80EU7.tmp.2.dr, is-NJH6K.tmp.2.dr, is-CVBBG.tmp.2.dr, is-17HNF.tmp.2.dr, is-EANN9.tmp.2.dr, is-Q6C5B.tmp.2.dr, is-NGC8I.tmp.2.dr, is-L0D1P.tmp.2.dr, is-AC86P.tmp.2.drfalse
                                        		unknown
                                        https://fastestvpn.com/aboutFastestVPN.exe, FastestVPN.exe, 00000016.00000002.4057691774.0000000005872000.00000002.00000001.01000000.00000017.sdmpfalse
                                          		unknown
                                          http://www.somewhere.orgComDebug.exe, 00000006.00000000.2563954116.0000000000401000.00000020.00000001.01000000.00000008.sdmp, ComDebug.exe, 00000006.00000002.4022885088.00000000048BD000.00000004.00000020.00020000.00000000.sdmpfalse
                                            		unknown
                                            https://scripts.sil.org/OFLThisFastestVPN.exe, 00000016.00000000.2625434306.00000000003E2000.00000002.00000001.01000000.0000000D.sdmpfalse
                                              		unknown
                                              https://github.com/dotnet/corefx/tree/7601f4f6225089ffb291dc7d58293c7bbf5c5d4f8FastestVPN.exe, 00000016.00000002.4056758757.00000000054D2000.00000002.00000001.01000000.00000016.sdmp, FastestVPN.exe, 00000016.00000002.4102331799.000000000BE22000.00000002.00000001.01000000.00000034.sdmpfalse
                                                		unknown
                                                http://ocsp.sectigo.com0is-80EU7.tmp.2.dr, is-17HNF.tmp.2.dr, is-EANN9.tmp.2.drfalse
                                                • URL Reputation: safe
                                                		unknown
                                                https://github.com/dotnet/corefx/tree/c6cf790234eFastestVPN.exefalse
                                                  		unknown
                                                  http://ocsp.entrust.net03OqAVRCkQ3T.tmp, 00000002.00000003.3069897606.0000000005580000.00000004.00001000.00020000.00000000.sdmp, OqAVRCkQ3T.tmp, 00000002.00000002.3098599633.000000000018C000.00000004.00000010.00020000.00000000.sdmp, ComDebug.exe, 00000006.00000002.4022885088.0000000004DCC000.00000004.00000020.00020000.00000000.sdmp, FastestVPN.exe, 00000016.00000002.4071204873.0000000008648000.00000004.00000020.00020000.00000000.sdmp, FastestVPN.WindowsService.exe, 0000002D.00000002.3044325400.00000000058C0000.00000004.00000020.00020000.00000000.sdmp, FastestVPN.WindowsService.exe, 0000002D.00000002.3041213432.0000000001570000.00000004.00000020.00020000.00000000.sdmp, is-0B265.tmp.2.dr, is-DQ4HF.tmp.2.dr, is-80EU7.tmp.2.dr, is-NJH6K.tmp.2.dr, is-CVBBG.tmp.2.dr, is-17HNF.tmp.2.dr, is-EANN9.tmp.2.dr, is-Q6C5B.tmp.2.dr, is-NGC8I.tmp.2.dr, is-L0D1P.tmp.2.dr, is-AC86P.tmp.2.drfalse
                                                  • URL Reputation: safe
                                                  		unknown
                                                  http://www.openssl.org/Vis-EANN9.tmp.2.drfalse
                                                    		unknown
                                                    http://ocsp.entrust.net01OqAVRCkQ3T.tmp, 00000002.00000003.3069897606.0000000005580000.00000004.00001000.00020000.00000000.sdmp, OqAVRCkQ3T.tmp, 00000002.00000002.3098599633.000000000018C000.00000004.00000010.00020000.00000000.sdmp, ComDebug.exe, 00000006.00000002.4022885088.0000000004DCC000.00000004.00000020.00020000.00000000.sdmp, FastestVPN.WindowsService.exe, 0000002D.00000002.3041213432.0000000001570000.00000004.00000020.00020000.00000000.sdmp, FastestVPN.WindowsService.exe, 0000002D.00000002.3039966230.000000000118C000.00000004.00000020.00020000.00000000.sdmp, is-0B265.tmp.2.dr, is-DQ4HF.tmp.2.dr, is-80EU7.tmp.2.dr, is-NJH6K.tmp.2.dr, is-CVBBG.tmp.2.dr, is-17HNF.tmp.2.dr, is-EANN9.tmp.2.dr, is-Q6C5B.tmp.2.dr, is-NGC8I.tmp.2.dr, is-L0D1P.tmp.2.dr, is-AC86P.tmp.2.drfalse
                                                      		unknown
                                                      https://fastestvpn.com/upgrade?t=ndelyNN7yduAc5EnjoyFastestVPN.exe, 00000016.00000002.4058237613.00000000058B2000.00000002.00000001.01000000.0000001A.sdmpfalse
                                                        		unknown
                                                        http://ocsp.entrust.net00OqAVRCkQ3T.tmp, 00000002.00000003.3069897606.0000000005580000.00000004.00001000.00020000.00000000.sdmp, OqAVRCkQ3T.tmp, 00000002.00000002.3098599633.000000000018C000.00000004.00000010.00020000.00000000.sdmp, ComDebug.exe, 00000006.00000002.4022885088.0000000004DCC000.00000004.00000020.00020000.00000000.sdmp, FastestVPN.WindowsService.exe, 0000002D.00000002.3044325400.00000000058C0000.00000004.00000020.00020000.00000000.sdmp, FastestVPN.WindowsService.exe, 0000002D.00000002.3041213432.0000000001570000.00000004.00000020.00020000.00000000.sdmp, FastestVPN.WindowsService.exe, 0000002D.00000002.3039966230.000000000118C000.00000004.00000020.00020000.00000000.sdmp, is-0B265.tmp.2.dr, is-DQ4HF.tmp.2.dr, is-80EU7.tmp.2.dr, is-NJH6K.tmp.2.dr, is-CVBBG.tmp.2.dr, is-17HNF.tmp.2.dr, is-EANN9.tmp.2.dr, is-Q6C5B.tmp.2.dr, is-NGC8I.tmp.2.dr, is-L0D1P.tmp.2.dr, is-AC86P.tmp.2.drfalse
                                                          		unknown
                                                          https://vovsoft.comComDebug.exe, 00000006.00000002.4022885088.0000000004DCC000.00000004.00000020.00020000.00000000.sdmpfalse
                                                            		unknown
                                                            http://ip-api.com/jsonFastestVPN.exe, FastestVPN.exe, 00000016.00000002.4058632607.00000000058D2000.00000002.00000001.01000000.0000001C.sdmpfalse
                                                            • URL Reputation: safe
                                                            		unknown
                                                            https://contoso.com/Licensepowershell.exe, 0000001D.00000002.2773499593.0000000006008000.00000004.00000800.00020000.00000000.sdmpfalse
                                                            • URL Reputation: safe
                                                            		unknown
                                                            https://fastestvpn.com/privacy-policyFastestVPN.exe, FastestVPN.exe, 00000016.00000002.4057691774.0000000005872000.00000002.00000001.01000000.00000017.sdmpfalse
                                                              		unknown
                                                              https://www.wireguard.com/donations/keyOqAVRCkQ3T.tmp, 00000002.00000003.3069897606.0000000005580000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                		unknown
                                                                https://github.com/aspnet/AspNetKatanaFastestVPN.WindowsService.exe, FastestVPN.WindowsService.exe, 00000032.00000002.4029624292.0000000004322000.00000002.00000001.01000000.0000003D.sdmp, FastestVPN.WindowsService.exe, 00000032.00000002.4026934919.00000000041D2000.00000002.00000001.01000000.0000003A.sdmp, FastestVPN.WindowsService.exe, 00000032.00000002.4028217019.0000000004282000.00000002.00000001.01000000.0000003C.sdmp, FastestVPN.WindowsService.exe, 00000032.00000002.4030619936.0000000004352000.00000002.00000001.01000000.0000003E.sdmp, FastestVPN.WindowsService.exe, 00000032.00000002.4026203269.00000000041A2000.00000002.00000001.01000000.00000039.sdmp, FastestVPN.WindowsService.exe, 00000032.00000002.4025246226.0000000004152000.00000002.00000001.01000000.00000037.sdmpfalse
                                                                  		unknown
                                                                  https://www.newtonsoft.com/jsonOqAVRCkQ3T.tmp, 00000002.00000003.3069897606.0000000005580000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                    		unknown
                                                                    http://www.hardcodet.net/projects/wpf-notifyiconFastestVPN.exe, FastestVPN.exe, 00000016.00000002.4059969196.0000000005AAA000.00000002.00000001.01000000.0000001D.sdmp, FastestVPN.exe, 00000016.00000002.4059523377.0000000005A92000.00000002.00000001.01000000.0000001D.sdmpfalse
                                                                      		unknown
                                                                      http://schemas.datacontract.org/2004/07/System.ServiceProcessdFastestVPN.WindowsService.exe, 0000002D.00000002.3041458929.0000000002EF5000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                        		unknown
                                                                        http://crt.sectigo.com/SectigoPublicCodeSigningRootR46.p7c0#is-80EU7.tmp.2.dr, is-17HNF.tmp.2.dr, is-EANN9.tmp.2.drfalse
                                                                        • URL Reputation: safe
                                                                        		unknown
                                                                        http://defaultcontainer/FastestVPN;component/Assets/Fonts/outfit-variablefont_wght.ttfdFastestVPN.exe, 00000016.00000002.4021722402.0000000002AE3000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                          		unknown
                                                                          http://www.openssl.org/support/faq.htmlis-EANN9.tmp.2.drfalse
                                                                          • URL Reputation: safe
                                                                          		unknown
                                                                          https://github.com/dotnet/runtimeFastestVPN.exe, FastestVPN.exe, 00000016.00000002.4056210634.00000000054A2000.00000002.00000001.01000000.00000014.sdmp, FastestVPN.exe, 00000016.00000002.4055392390.0000000005342000.00000002.00000001.01000000.00000013.sdmp, FastestVPN.exe, 00000016.00000002.4056338798.00000000054B2000.00000002.00000001.01000000.00000015.sdmp, is-RP1DP.tmp.2.drfalse
                                                                            		unknown
                                                                            http://crl.entrust.net/csbr1.crl0OqAVRCkQ3T.tmp, 00000002.00000003.3069897606.0000000005580000.00000004.00001000.00020000.00000000.sdmp, OqAVRCkQ3T.tmp, 00000002.00000002.3098599633.000000000018C000.00000004.00000010.00020000.00000000.sdmp, ComDebug.exe, 00000006.00000002.4022885088.0000000004DCC000.00000004.00000020.00020000.00000000.sdmp, FastestVPN.WindowsService.exe, 0000002D.00000002.3041213432.0000000001570000.00000004.00000020.00020000.00000000.sdmp, FastestVPN.WindowsService.exe, 0000002D.00000002.3039966230.000000000118C000.00000004.00000020.00020000.00000000.sdmp, is-0B265.tmp.2.dr, is-DQ4HF.tmp.2.dr, is-80EU7.tmp.2.dr, is-NJH6K.tmp.2.dr, is-CVBBG.tmp.2.dr, is-17HNF.tmp.2.dr, is-EANN9.tmp.2.dr, is-Q6C5B.tmp.2.dr, is-NGC8I.tmp.2.dr, is-L0D1P.tmp.2.dr, is-AC86P.tmp.2.drfalse
                                                                              		unknown
                                                                              http://vovsoft.com/ComDebug.exe, 00000006.00000002.4022885088.0000000004DCC000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                		unknown
                                                                                http://help.yahoo.com/help/us/ysearch/slurp)ComDebug.exe, 00000006.00000002.4017666798.0000000002892000.00000004.00001000.00020000.00000000.sdmp, ComDebug.exe, 00000006.00000002.4022885088.0000000004DCC000.00000004.00000020.00020000.00000000.sdmp, ComDebug.exe, 00000006.00000002.4017666798.0000000002821000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                  		unknown
                                                                                  http://crl.thawte.com/ThawteTimestampingCA.crl0is-N7JEQ.tmp.2.drfalse
                                                                                  • URL Reputation: safe
                                                                                  		unknown
                                                                                  https://github.com/Outfitio/Outfit-Fonts)FastestVPN.exe, 00000016.00000000.2625434306.00000000003E2000.00000002.00000001.01000000.0000000D.sdmp, FastestVPN.exe, 00000016.00000002.4079933992.0000000008A62000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                    		unknown
                                                                                    https://contoso.com/powershell.exe, 0000001D.00000002.2773499593.0000000006008000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                    • URL Reputation: safe
                                                                                    		unknown
                                                                                    http://www.w3.oFastestVPN.WindowsService.exe, 0000002D.00000002.3041458929.0000000002EF5000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                      		unknown
                                                                                      https://github.com/JamesNK/Newtonsoft.JsonOqAVRCkQ3T.tmp, 00000002.00000003.3069897606.0000000005580000.00000004.00001000.00020000.00000000.sdmp, FastestVPN.WindowsService.exe, FastestVPN.WindowsService.exe, 00000032.00000002.4032701232.0000000004432000.00000002.00000001.01000000.0000003F.sdmpfalse
                                                                                        		unknown
                                                                                        https://scripts.sil.org/OFLwww.rfuenzalida.comwww.fragtypefoundry.xyzRodrigoFastestVPN.exe, 00000016.00000000.2625434306.00000000003E2000.00000002.00000001.01000000.0000000D.sdmpfalse
                                                                                          		unknown
                                                                                          http://crl.sectigo.com/SectigoPublicCodeSigningCAEVR36.crl0is-80EU7.tmp.2.dr, is-17HNF.tmp.2.dr, is-EANN9.tmp.2.drfalse
                                                                                            		unknown
                                                                                            http://nuget.org/NuGet.exepowershell.exe, 0000001D.00000002.2773499593.0000000006008000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                            • URL Reputation: safe
                                                                                            		unknown
                                                                                            https://aka.ms/signalr-core-differencesis-3TGVV.tmp.2.drfalse
                                                                                              		unknown

                                                                                              World Map of Contacted IPs

                                                                                              • No. of IPs < 25%
                                                                                              • 25% < No. of IPs < 50%
                                                                                              • 50% < No. of IPs < 75%
                                                                                              • 75% < No. of IPs

                                                                                              Public IPs

                                                                                              IPDomainCountryFlagASNASN NameMalicious

                                                                                              Private

                                                                                              IP
                                                                                              127.0.0.1

                                                                                              General Information

                                                                                              Joe Sandbox version:41.0.0 Charoite
                                                                                              Analysis ID:1524835
                                                                                              Start date and time:2024-10-03 10:35:46 +02:00
                                                                                              Joe Sandbox product:CloudBasic
                                                                                              Overall analysis duration:0h 14m 15s
                                                                                              Hypervisor based Inspection enabled:false
                                                                                              Report type:full
                                                                                              Cookbook file name:default.jbs
                                                                                              Analysis system description:Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
                                                                                              Run name:Run with higher sleep bypass
                                                                                              Number of analysed new started processes analysed:53
                                                                                              Number of new started drivers analysed:0
                                                                                              Number of existing processes analysed:0
                                                                                              Number of existing drivers analysed:0
                                                                                              Number of injected processes analysed:0
                                                                                              Technologies:
                                                                                              • HCA enabled
                                                                                              • EGA enabled
                                                                                              • AMSI enabled
                                                                                              Analysis Mode:default
                                                                                              Sample name:OqAVRCkQ3T.exe
                                                                                              renamed because original name is a hash value
                                                                                              Original Sample Name:649ec4858e572e0145e35a9faa712708949b7bb1bce1594154cda580d80a0ca9.exe
                                                                                              Detection:MAL
                                                                                              Classification:mal44.troj.spyw.expl.evad.winEXE@77/324@0/1
                                                                                              EGA Information:
                                                                                              • Successful, ratio: 90%
                                                                                              HCA Information:
                                                                                              • Successful, ratio: 97%
                                                                                              • Number of executed functions: 343
                                                                                              • Number of non-executed functions: 138
                                                                                              Cookbook Comments:
                                                                                              • Found application associated with file extension: .exe
                                                                                              • Sleeps bigger than 100000000ms are automatically reduced to 1000ms

                                                                                              Warnings

                                                                                              • Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe
                                                                                              • Excluded IPs from analysis (whitelisted): 192.229.221.95, 20.189.173.22, 184.28.90.27
                                                                                              • Excluded domains from analysis (whitelisted): www.bing.com, client.wns.windows.com, fs.microsoft.com, slscr.update.microsoft.com, cacerts.digicert.com, onedsblobprdwus17.westus.cloudapp.azure.com, ctldl.windowsupdate.com, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, fe3cr.delivery.mp.microsoft.com, ocsp.digicert.com, login.live.com, e16604.g.akamaiedge.net, blobcollector.events.data.trafficmanager.net, umwatson.events.data.microsoft.com, prod.fs.microsoft.com.akadns.net
                                                                                              • Execution Graph export aborted for target powershell.exe, PID 424 because it is empty
                                                                                              • Not all processes where analyzed, report is missing behavior information
                                                                                              • Report size exceeded maximum capacity and may have missing behavior information.
                                                                                              • Report size exceeded maximum capacity and may have missing disassembly code.
                                                                                              • Report size getting too big, too many NtAllocateVirtualMemory calls found.
                                                                                              • Report size getting too big, too many NtOpenKeyEx calls found.
                                                                                              • Report size getting too big, too many NtProtectVirtualMemory calls found.
                                                                                              • Report size getting too big, too many NtQueryValueKey calls found.
                                                                                              • Report size getting too big, too many NtSetInformationFile calls found.

                                                                                              Simulations

                                                                                              Behavior and APIs

                                                                                              TimeTypeDescription
                                                                                              10:37:19AutostartRun: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\FastestVPN.lnk

                                                                                              Joe Sandbox View / Context

                                                                                              IPs

                                                                                              ⊘No context

                                                                                              Domains

                                                                                              MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                                                              fp2e7a.wpc.phicdn.netPVUfopbGfc.exeGet hashmaliciousLummaCBrowse
                                                                                              • 192.229.221.95
                                                                                              mapMd1URzq.exeGet hashmaliciousUnknownBrowse
                                                                                              • 192.229.221.95
                                                                                              mnFHs2DuKg.exeGet hashmaliciousUnknownBrowse
                                                                                              • 192.229.221.95
                                                                                              https://email.mg.pmctraining.com/c/eJwkkcuSojAUhp_muJOKJyHAgoXTyMw41lxaa9TepZNwkUvoEER8-i7o3Vf5_tS5qVhRobla6XgTYBCSaMP9VRFHAWWMaKZYqJifqSALMoEkyiiXWvBsVcZaCn-jwmCtA63XQaTFmoVhuNZSURVo5RPCgJEm97pGOivKtmxzT5pmVceFc10PdAuYAqbjOHq5MXmtPWm8oQJMB1sDTT-AJqz9rc_hMPwrt93h9id50qkA5FY6oMnlyEiJ-zFZQtMkT4C8F0ATB8h1byXQL5fmu5cteUx9uGswPcwxM1ipgSaAXKr5y5GfwtqEw05apk_lGF1-zE7M8tL9rZJs_1WwTvb_j-QKyO96lo9bW7n6w07X8_j289urze-_APkgliZnmsdJRNMB-pjWMhN9UZrWWd2qft7J8l6Zyiyw3-TiuJAUnZOFWBgwvZ4fncRoODRdcUW3VU39FJfX5xUj8v49Hd5e_Ns7EqDJysaiLnvTejchK2DkXval66VxtWjVcoZ7jJ8BAAD__0X-oIkGet hashmaliciousUnknownBrowse
                                                                                              • 192.229.221.95
                                                                                              oRdgOQMxjr.exeGet hashmaliciousRedLineBrowse
                                                                                              • 192.229.221.95
                                                                                              https://globalairt.com/arull.php?7104797967704b536932307464507a53744a4c53704a7a4d77727273784c7a7453725374524c7a732f564c3477776474594841413d3dkkirkman@ssc.nsw.gov.auGet hashmaliciousHTMLPhisherBrowse
                                                                                              • 192.229.221.95
                                                                                              v173TV3V11.exeGet hashmaliciousSmokeLoaderBrowse
                                                                                              • 192.229.221.95
                                                                                              0k3ibTiMjy.exeGet hashmaliciousSmokeLoaderBrowse
                                                                                              • 192.229.221.95
                                                                                              http://www.sunsetsafaris.com.au//homeGet hashmaliciousUnknownBrowse
                                                                                              • 192.229.221.95

                                                                                              ASNs

                                                                                              ⊘No context

                                                                                              JA3 Fingerprints

                                                                                              ⊘No context

                                                                                              Dropped Files

                                                                                              MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                                                              C:\Program Files\FastestVPN\BouncyCastle.Crypto.dll (copy)PVUfopbGfc.exeGet hashmaliciousLummaCBrowse
                                                                                                mapMd1URzq.exeGet hashmaliciousUnknownBrowse
                                                                                                  mnFHs2DuKg.exeGet hashmaliciousUnknownBrowse
                                                                                                    External.exeGet hashmaliciousAdes Stealer, BlackGuard, VEGA StealerBrowse
                                                                                                      newvideozones.click.ps1Get hashmaliciousUnknownBrowse
                                                                                                        use_2024_t#U043e_#U043epen.zipGet hashmaliciousUnknownBrowse
                                                                                                          JetBrains.dotPeek.2024.1.3.web.exeGet hashmaliciousUnknownBrowse
                                                                                                            JetBrains.dotPeek.2024.1.3.web.exeGet hashmaliciousUnknownBrowse

                                                                                                              Created / dropped Files

                                                                                                              C:\Program Files\FastestVPN\BouncyCastle.Crypto.dll (copy)

                                                                                                              Download File
                                                                                                              Process:C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmp
                                                                                                              File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                              Category:dropped
                                                                                                              Size (bytes):3316968
                                                                                                              Entropy (8bit):6.532906510598102
                                                                                                              Encrypted:false
                                                                                                              SSDEEP:49152:JIBbo0WIgmjljFtXCdRLRBcJd+KaGxHIkMNqzP56O8lZ7qXUqi9Y:6BbBWIgWljGxRB/LLY
                                                                                                              MD5:0CF454B6ED4D9E46BC40306421E4B800
                                                                                                              SHA1:9611AA929D35CBD86B87E40B628F60D5177D2411
                                                                                                              SHA-256:E51721DC0647F4838B1ABC592BD95FD8CB924716E8A64F83D4B947821FA1FA42
                                                                                                              SHA-512:85262F1BC67A89911640F59A759B476B30CA644BD1A1D9CD3213CC8AAE16D7CC6EA689815F19B146DB1D26F7A75772CEB48E71E27940E3686A83EB2CF7E46048
                                                                                                              Malicious:false
                                                                                                              Antivirus:
                                                                                                              • Antivirus: ReversingLabs, Detection: 0%
                                                                                                              Joe Sandbox View:
                                                                                                              • Filename: PVUfopbGfc.exe, Detection: malicious, Browse
                                                                                                              • Filename: mapMd1URzq.exe, Detection: malicious, Browse
                                                                                                              • Filename: mnFHs2DuKg.exe, Detection: malicious, Browse
                                                                                                              • Filename: External.exe, Detection: malicious, Browse
                                                                                                              • Filename: newvideozones.click.ps1, Detection: malicious, Browse
                                                                                                              • Filename: use_2024_t#U043e_#U043epen.zip, Detection: malicious, Browse
                                                                                                              • Filename: JetBrains.dotPeek.2024.1.3.web.exe, Detection: malicious, Browse
                                                                                                              • Filename: JetBrains.dotPeek.2024.1.3.web.exe, Detection: malicious, Browse
                                                                                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....R............" ..0..r2..........&1.. ....2...... ........................2.....6Q3...@.................................G&1.O.....2..............|2.. ....2.....X.(.p............................................ ............... ..H............text....p2.. ...r2................. ..`.rsrc.........2......t2.............@..@.reloc........2......z2.............@..B................{&1.....H...........$....................(.....................................V!........s.........*.~....-*(....o....o....o.........~....-.~.........~....*..( ...*...0..G.......(!....o"....s.1....s*,..%..(.... ....o.....o 0...Zo....t....o8(..(....*..0..$..........(.....(....o.....(!.......io#...*z...(....(!....o"...o....(....*..0............T....r...p.(O....o$....(....*..0..I.......sG...sB)..s.(..s.(...(....s6(....,..o%....2...(....sV(....+.....%..ox...*..( ...*V.(&.....}......}..

                                                                                                              C:\Program Files\FastestVPN\FastestVPN.BLL.dll (copy)

                                                                                                              Download File
                                                                                                              Process:C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmp
                                                                                                              File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                              Category:dropped
                                                                                                              Size (bytes):30888
                                                                                                              Entropy (8bit):6.550270680442998
                                                                                                              Encrypted:false
                                                                                                              SSDEEP:384:RzfFYXOvijvSGpUprWHEvgr0KnB4C7GrhIYiRSk0FP27NBY3Yuv+U:RxyOg9bxr9qaGKYi8K/Y/+U
                                                                                                              MD5:96D7E9527C5D8BDBA798F72B5FD9B94A
                                                                                                              SHA1:C9CE9813C74493084D6E3DDA37C35C8822CA381F
                                                                                                              SHA-256:6942DC9FDBB229D066BA3E1844883B9DA3EAE21F7035FFF2674C3F19C6331B55
                                                                                                              SHA-512:BE88433F513C4D9F58BDDFED57427DEC12BA0490E2D7C79176144732FBB7969956FA55B03E462C50EA3508389B3C29BC5A559F4B6002C6022C93D059C65B5C44
                                                                                                              Malicious:false
                                                                                                              Antivirus:
                                                                                                              • Antivirus: ReversingLabs, Detection: 0%
                                                                                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...f6............" ..0..F...........e... ........... ....................................`..................................e..O....................N...*...........d..8............................................ ............... ..H............text....E... ...F.................. ..`.rsrc................H..............@..@.reloc...............L..............@..B................be......H.......\4..$0............................................................(....*..{....*"..}....*..{....*"..}....*V.(......(......(....*.0..7.........(....}.......}.......}......|......(...+..|....(....*..{....*"..}....*..{....*"..}....*..{....*"..}....*..{....*"..}....*..(......(......(......(.......(....*.0..?.........(....}3......}4......}5......}2.....|3.....(...+..|3...(....*..0..7.........(....}#......}$......}".....|#.....(...+..|#...(....*..0..?.........(....}.......}

                                                                                                              C:\Program Files\FastestVPN\FastestVPN.Common.dll (copy)

                                                                                                              Download File
                                                                                                              Process:C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmp
                                                                                                              File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                              Category:dropped
                                                                                                              Size (bytes):70824
                                                                                                              Entropy (8bit):6.23750269831583
                                                                                                              Encrypted:false
                                                                                                              SSDEEP:1536:rMDv5NwVvDK0HBDk4rVHe061i/kObvmaLLJBr+tTe7TK/SB0:UorK0HBDk4rV21HObvm2LJB4eHK/SO
                                                                                                              MD5:0F7D6DEE75C3FBB958529AB6A351CBDF
                                                                                                              SHA1:1CA639AB692ECD972C51C8BF826BF9BF089359FE
                                                                                                              SHA-256:C5B07CBACD0FF045485A0A4CE6FB3CCB330A0623E3EFE347D61DA4E698FDE412
                                                                                                              SHA-512:58F0B5ED44E3290D6C9FB0E624F2A351CD5BB4744A84AC55AC47FB1B087026DE4DBAA6BBC83255EEC51A2BB3ED9A680EF53E8FC7035586B4A74CA68016AE0F5D
                                                                                                              Malicious:false
                                                                                                              Antivirus:
                                                                                                              • Antivirus: ReversingLabs, Detection: 0%
                                                                                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.... F..........." ..0.............J.... ... ....... .......................`...........`.....................................O.... ...................*...@......D...8............................................ ............... ..H............text...P.... ...................... ..`.rsrc........ ......................@..@.reloc.......@......................@..B................,.......H.......0<................................................................("...*^.("......I...%...}....*:.(".....}....*b.{....%-.&*..s#...o$...*.0..)........{.........(%...t......|......(...+...3.*....0..)........{.........('...t......|......(...+...3.*..((...*..{....*"..}....*..{....*"..}....*..{....*"..}....*2.(....s)...*..{....*"..}....*..{....*"..}....*..{....*"..}....*..((...*..{....*"..}....*..{....*"..}....*..{....*"..}....*..{....*"..}....*..((...*..{....*"..}....*..{

                                                                                                              C:\Program Files\FastestVPN\FastestVPN.DI.dll (copy)

                                                                                                              Download File
                                                                                                              Process:C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmp
                                                                                                              File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                              Category:dropped
                                                                                                              Size (bytes):19112
                                                                                                              Entropy (8bit):6.821071301483957
                                                                                                              Encrypted:false
                                                                                                              SSDEEP:384:LVVVVVwhr+vtlzIYilpm0FP27NBY3Yuv+Z:LVVVVVwhKvtl8YijnK/Y/+Z
                                                                                                              MD5:64E2269D156CA2AA5704E2E0908506F9
                                                                                                              SHA1:0F7D6EECE52D8A9A91E389736BE1092739AA3014
                                                                                                              SHA-256:B012720952E3FE9CB303E9EDB4314F924CB388D9C24FB63A968A3479113B665D
                                                                                                              SHA-512:C845E7EB96ED29C564C28D42F07F5EB81C27568F0F89C343533384BF8E704B99566EA073E46259D9F3740A7A3D41AAB5BFA78AEAB05697100B3A179F5C1EDFB6
                                                                                                              Malicious:false
                                                                                                              Antivirus:
                                                                                                              • Antivirus: ReversingLabs, Detection: 0%
                                                                                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....c............" ..0..............6... ...@....... ..............................hj....`.................................16..O....@............... ...*...`......t5..8............................................ ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B................e6......H.......("..L............................................................~....*.......*..s....*..s....*..0..B.......(....,.*s....(....(....(....(....(....(.....(....(....(.....(....*..(...+*F.(...+(...+(...+*F.(...+(...+(...+*F.(...+(...+(...+*.0..f........(...+(...+(...+(...+(...+(...+(...+(...+(...+(...+(...+(...+(...+(...+(...+(...+(...+(...+(...+(...+*..(...+*...0...........-..*....8.......%o.....%o.....o........E........ ...>...+X..(....-...(....+....(......+:..(....-...

                                                                                                              C:\Program Files\FastestVPN\FastestVPN.DI.dll.config (copy)

                                                                                                              Download File
                                                                                                              Process:C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmp
                                                                                                              File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                                                                                                              Category:dropped
                                                                                                              Size (bytes):432
                                                                                                              Entropy (8bit):5.0141792226861375
                                                                                                              Encrypted:false
                                                                                                              SSDEEP:12:MMHdGzNFF7ap+5v5OXrRf/2//FicYo4xT:JduPF7NhOXrRH2/d9y
                                                                                                              MD5:8F6EB9E75E6A6F0C0D58FB697C10CEDF
                                                                                                              SHA1:6944935DFDC33E0C6DB26869BF25EDA85A2622D8
                                                                                                              SHA-256:E2B8677434501735FB0233ED0CC2FFEE5BF6FB4387C51DBCB2585A70E42E4F08
                                                                                                              SHA-512:A946252B2E3705EAE751A2672D4ADE1499ECEB28C48B4BE6150C4201EE20A7B9A4450C75E06B07F5DAA3528041A566931D988FBD0C2EA90240D61008895BA44A
                                                                                                              Malicious:false
                                                                                                              Preview:.<?xml version="1.0" encoding="utf-8"?>..<configuration>.. <runtime>.. <assemblyBinding xmlns="urn:schemas-microsoft-com:asm.v1">.. <dependentAssembly>.. <assemblyIdentity name="Newtonsoft.Json" publicKeyToken="30ad4fe6b2a6aeed" culture="neutral" />.. <bindingRedirect oldVersion="0.0.0.0-13.0.0.0" newVersion="13.0.0.0" />.. </dependentAssembly>.. </assemblyBinding>.. </runtime>..</configuration>

                                                                                                              C:\Program Files\FastestVPN\FastestVPN.Data.Local.dll (copy)

                                                                                                              Download File
                                                                                                              Process:C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmp
                                                                                                              File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                              Category:dropped
                                                                                                              Size (bytes):25768
                                                                                                              Entropy (8bit):6.623350319992477
                                                                                                              Encrypted:false
                                                                                                              SSDEEP:384:21Vrp7wobZBVBhB3GmLiVWgktWe9JHEDIYirwt0FP27NBY3Yuv+1WyT1g:21VV7TbXX72MtWQJHEsYi/K/Y/+1Wy5g
                                                                                                              MD5:D92BF2C8E0A192E18B1F0B24CCB75171
                                                                                                              SHA1:2A6343C3409172E1D426B763151E0CBA3B35E473
                                                                                                              SHA-256:BEED084878EACA4A745A53CC21FAAD1A76F4F82C955BB507496B5B9F23032F1C
                                                                                                              SHA-512:71AD4963BCEBE516FD9EE526F2DD1ECB13F10E1424D0D3CED08A19A38D902DA562C9B1D0E308C4B898E30187773F040CF6A437210EFEF52B957623F798E59459
                                                                                                              Malicious:false
                                                                                                              Antivirus:
                                                                                                              • Antivirus: ReversingLabs, Detection: 0%
                                                                                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...R.s..........." ..0..2..........:Q... ...`....... ..............................I/....`..................................P..O....`...............:...*..........,P..8............................................ ............... ..H............text...@1... ...2.................. ..`.rsrc........`.......4..............@..@.reloc...............8..............@..B.................Q......H.......`(...'...........................................................0..M........r...p}.....r...p}.....(......{..... (....(....(......{..... (....(....(....*^~....-.s.........~....*..{....*"..}....*..{....*"..}....*..0..8........(........(.....(.....o....r...p(....o.......&..r...p*.*........--.......0..(.......(.....o........(.....(.......&..r...p*.*.................0..X........o.....[.&......+9...Z.o.... ....(........Z.X.o.... ....(......b`.......X...o.....[2..*.0..V...

                                                                                                              C:\Program Files\FastestVPN\FastestVPN.Data.Remote.dll (copy)

                                                                                                              Download File
                                                                                                              Process:C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmp
                                                                                                              File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                              Category:dropped
                                                                                                              Size (bytes):29352
                                                                                                              Entropy (8bit):6.56368110636982
                                                                                                              Encrypted:false
                                                                                                              SSDEEP:768:vT6rilChUvVsYQTJMS6V4B6PYikK/Y/+V7:7qSsYOwP7kK/77
                                                                                                              MD5:1CFBF0CBA3C87653D9639ADA438C3291
                                                                                                              SHA1:07E36A34319EAD85857CC022E277B69EA132750B
                                                                                                              SHA-256:3525FCE82E2687D8EFAF992147B196881818856EA9EA851A8DC930751329A8DD
                                                                                                              SHA-512:E95FC978E889BD62E92975EFD8F39161B6E43FE97451068552E3A71635943F990E4E8697323794D75F77BB12F3DE4E2CFADB5B9D80EF90F1992C82298EBFD00B
                                                                                                              Malicious:false
                                                                                                              Antivirus:
                                                                                                              • Antivirus: ReversingLabs, Detection: 0%
                                                                                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...t.i..........." ..0..@...........^... ...`....... ....................................`.................................:^..O....`...............H...*..........|]..8............................................ ............... ..H............text....>... ...@.................. ..`.rsrc........`.......B..............@..@.reloc...............F..............@..B................n^......H........1...+............................................................{....*:.(......}....*..0..)........u..........,.(.....{.....{....o....*.*.*v .5Q' )UU.Z(.....{....o....X*..0..:........r...p......%..{.......%q.........-.&.+.......o.....(....*..{....*:.(......}....*....0..)........u..........,.(.....{.....{....o....*.*.*v . .q )UU.Z(.....{....o....X*..0..:........r-..p......%..{.......%q.........-.&.+.......o.....(....*..{....*..{....*V.(......}......}....*.0..A.......

                                                                                                              C:\Program Files\FastestVPN\FastestVPN.Data.Remote.dll.config (copy)

                                                                                                              Download File
                                                                                                              Process:C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmp
                                                                                                              File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                                                                                                              Category:dropped
                                                                                                              Size (bytes):432
                                                                                                              Entropy (8bit):5.0141792226861375
                                                                                                              Encrypted:false
                                                                                                              SSDEEP:12:MMHdGzNFF7ap+5v5OXrRf/2//FicYo4xT:JduPF7NhOXrRH2/d9y
                                                                                                              MD5:8F6EB9E75E6A6F0C0D58FB697C10CEDF
                                                                                                              SHA1:6944935DFDC33E0C6DB26869BF25EDA85A2622D8
                                                                                                              SHA-256:E2B8677434501735FB0233ED0CC2FFEE5BF6FB4387C51DBCB2585A70E42E4F08
                                                                                                              SHA-512:A946252B2E3705EAE751A2672D4ADE1499ECEB28C48B4BE6150C4201EE20A7B9A4450C75E06B07F5DAA3528041A566931D988FBD0C2EA90240D61008895BA44A
                                                                                                              Malicious:false
                                                                                                              Preview:.<?xml version="1.0" encoding="utf-8"?>..<configuration>.. <runtime>.. <assemblyBinding xmlns="urn:schemas-microsoft-com:asm.v1">.. <dependentAssembly>.. <assemblyIdentity name="Newtonsoft.Json" publicKeyToken="30ad4fe6b2a6aeed" culture="neutral" />.. <bindingRedirect oldVersion="0.0.0.0-13.0.0.0" newVersion="13.0.0.0" />.. </dependentAssembly>.. </assemblyBinding>.. </runtime>..</configuration>

                                                                                                              C:\Program Files\FastestVPN\FastestVPN.Diagnostics.dll (copy)

                                                                                                              Download File
                                                                                                              Process:C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmp
                                                                                                              File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                              Category:dropped
                                                                                                              Size (bytes):19624
                                                                                                              Entropy (8bit):6.761472837087098
                                                                                                              Encrypted:false
                                                                                                              SSDEEP:384:pwG3NNuGs7lkviba8FLdwIYieB0FP27NBY3Yuv+4pdS:F+V7PpFLdZYixK/Y/+4S
                                                                                                              MD5:12A69C58D97C26D0132D493111E42345
                                                                                                              SHA1:0DCC8570C7D76B660746A0F657607864F8764AD4
                                                                                                              SHA-256:E6682B67F0C489BEB53C93C399D46CEAEBDD7096AD7DB984BF99DCC68E476F4C
                                                                                                              SHA-512:3335371222BB282C55F1309432CD776CD146EFA9B6D17BF23997EFA6E3A741512FD95B9382EB719F400C6A70BD13E6A445A6011716B4C7637CF1083C8D669BE6
                                                                                                              Malicious:false
                                                                                                              Antivirus:
                                                                                                              • Antivirus: ReversingLabs, Detection: 0%
                                                                                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L................." ..0..............8... ...@....... ...............................P....`.................................j8..O....@..............."...*...`.......7..8............................................ ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`....... ..............@..B.................8......H.......L'..`............................................................0..?.........(....}.......}.......}.......}......|......(...+..|....(....*..0..7.........(....}.......}.......}......|......(...+..|....(....*..0../.........(....}.......}......|......(...+..|....(....*..0..7.........(....}.......}.......}......|......(...+..|....(....*6..(...+(....*..(....*..(....*..{..........%..#...(.....%..!...(.....(.....(....*.0..e........{......E....8............(....o ......(!...

                                                                                                              C:\Program Files\FastestVPN\FastestVPN.Diagnostics.dll.config (copy)

                                                                                                              Download File
                                                                                                              Process:C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmp
                                                                                                              File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                                                                                                              Category:dropped
                                                                                                              Size (bytes):1192
                                                                                                              Entropy (8bit):5.059106104983516
                                                                                                              Encrypted:false
                                                                                                              SSDEEP:24:JduPF7NV+TkH2/17zVVXBOH2/17zVQ7uH2/XVUrPH2/+C9y:327Gwg1BOg1SagXSg+Cw
                                                                                                              MD5:66373624F8B60F41B8FEC0E61779C0AC
                                                                                                              SHA1:0D3BE3C009F0A2260F89C3FBC9FFEBA0061C17F2
                                                                                                              SHA-256:FE0A5830D875B8BD0864BF4F85705D4F2E3D7A575C07B2B5A18041558DBA1386
                                                                                                              SHA-512:74F084B2697F936122E371042FEF5740BF205914B3FA276F8F7C72561680BF2C39A7DD2970BDEDF36AACC20970CD9552A719211F30090881E498815D91C6CDD0
                                                                                                              Malicious:false
                                                                                                              Preview:.<?xml version="1.0" encoding="utf-8"?>..<configuration>.. <runtime>.. <assemblyBinding xmlns="urn:schemas-microsoft-com:asm.v1">.. <dependentAssembly>.. <assemblyIdentity name="SQLitePCLRaw.core" publicKeyToken="1488e028ca7ab535" culture="neutral" />.. <bindingRedirect oldVersion="0.0.0.0-2.1.6.2060" newVersion="2.1.6.2060" />.. </dependentAssembly>.. <dependentAssembly>.. <assemblyIdentity name="SQLitePCLRaw.batteries_v2" publicKeyToken="8226ea5df37bcae9" culture="neutral" />.. <bindingRedirect oldVersion="0.0.0.0-2.1.6.2060" newVersion="2.1.6.2060" />.. </dependentAssembly>.. <dependentAssembly>.. <assemblyIdentity name="System.Runtime.CompilerServices.Unsafe" publicKeyToken="b03f5f7f11d50a3a" culture="neutral" />.. <bindingRedirect oldVersion="0.0.0.0-6.0.0.0" newVersion="6.0.0.0" />.. </dependentAssembly>.. <dependentAssembly>.. <assemblyIdentity name="System.Memory" publicKeyToken="cc7b13ffc

                                                                                                              C:\Program Files\FastestVPN\FastestVPN.ViewModel.dll (copy)

                                                                                                              Download File
                                                                                                              Process:C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmp
                                                                                                              File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                              Category:dropped
                                                                                                              Size (bytes):124072
                                                                                                              Entropy (8bit):6.169344446608534
                                                                                                              Encrypted:false
                                                                                                              SSDEEP:3072:LurAkSCDvkOtt+niUnQY8/LFEMnK8VQW5K/7:LJkSCDv+iUnQXLFEEM/7
                                                                                                              MD5:2DC3102392DAEF9B935CDF4939A9B132
                                                                                                              SHA1:F56261CE19BFC14F8317C2AA05F010E9ACFBCE02
                                                                                                              SHA-256:B6D9088505C220F23132D78675004BC31E0FB5C04257357C2B02072EF8C28DAD
                                                                                                              SHA-512:596AFAA1347CF730D2D0312857366EE3AD4C5C439E2F93BD6D38B29129C7B3530523B206FAEEF1DB3F6D9A18482162FF56321C9F1A1FA4F296F6B29AE8659321
                                                                                                              Malicious:false
                                                                                                              Antivirus:
                                                                                                              • Antivirus: ReversingLabs, Detection: 0%
                                                                                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...q............" ..0.................. ........... ....................... ......Q.....`.....................................O........................*..............8............................................ ............... ..H............text........ ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................H.......d................................................................0...........s....%r...pr...po....%rk..pru..po....%r...pr...po....}......(....(...+o.....(...+o.......o....r!..p.o....(....}......o....}......o....}......o....}.....(....r%..p( ...-..(....re..p( ...,...}....*..}....*..{....*..{....*..{....*..{....*..{....*J.......s!...s:...*.~....%-.&~..........s!...%.....s:...*J.......s"...s#...*J.......s!...s:...*..0..........(...+o$.....E........9...^...*.r...pr...pr..

                                                                                                              C:\Program Files\FastestVPN\FastestVPN.ViewModel.dll.config (copy)

                                                                                                              Download File
                                                                                                              Process:C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmp
                                                                                                              File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                                                                                                              Category:dropped
                                                                                                              Size (bytes):432
                                                                                                              Entropy (8bit):5.0141792226861375
                                                                                                              Encrypted:false
                                                                                                              SSDEEP:12:MMHdGzNFF7ap+5v5OXrRf/2//FicYo4xT:JduPF7NhOXrRH2/d9y
                                                                                                              MD5:8F6EB9E75E6A6F0C0D58FB697C10CEDF
                                                                                                              SHA1:6944935DFDC33E0C6DB26869BF25EDA85A2622D8
                                                                                                              SHA-256:E2B8677434501735FB0233ED0CC2FFEE5BF6FB4387C51DBCB2585A70E42E4F08
                                                                                                              SHA-512:A946252B2E3705EAE751A2672D4ADE1499ECEB28C48B4BE6150C4201EE20A7B9A4450C75E06B07F5DAA3528041A566931D988FBD0C2EA90240D61008895BA44A
                                                                                                              Malicious:false
                                                                                                              Preview:.<?xml version="1.0" encoding="utf-8"?>..<configuration>.. <runtime>.. <assemblyBinding xmlns="urn:schemas-microsoft-com:asm.v1">.. <dependentAssembly>.. <assemblyIdentity name="Newtonsoft.Json" publicKeyToken="30ad4fe6b2a6aeed" culture="neutral" />.. <bindingRedirect oldVersion="0.0.0.0-13.0.0.0" newVersion="13.0.0.0" />.. </dependentAssembly>.. </assemblyBinding>.. </runtime>..</configuration>

                                                                                                              C:\Program Files\FastestVPN\FastestVPN.exe (copy)

                                                                                                              Download File
                                                                                                              Process:C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmp
                                                                                                              File Type:PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                              Category:dropped
                                                                                                              Size (bytes):2059432
                                                                                                              Entropy (8bit):7.651137710710665
                                                                                                              Encrypted:false
                                                                                                              SSDEEP:24576:+3zNmj7tPN/PPINv2lYnvqfI1L3ciKKqjnTVlKJ+hgyiTebWmDXQHMkgXvYOdSYB:84vtPNvCv2Qqfobuvq+hqCTDgHMT
                                                                                                              MD5:01CF6EF766C41BB2C99A2CCCDECC69C1
                                                                                                              SHA1:8DD5EB983C1C8F2E3A2538E50295644BB778A69E
                                                                                                              SHA-256:9A9B95CA40D32FA23A615A122FA3AAF7AEB32FBEF2850D729F77C1169FFC0452
                                                                                                              SHA-512:9EE4D4D7852555F67CF0C9B372DCA87EC0727AB0A6FC5EAE309CF6BF5467FC75C6868A5E528D34AB605CDC736D30684D35A1451D4ABE3B99BA37D276474AC940
                                                                                                              Malicious:true
                                                                                                              Antivirus:
                                                                                                              • Antivirus: ReversingLabs, Detection: 0%
                                                                                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....G............"...0......D........... ... ....@.. ...............................P ...`.................................^...O.... ...A...........B...*..............8............................................ ............... ..H............text........ ...................... ..`.rsrc....A... ...B..................@..@.reloc...............@..............@..B........................H.......DD..T`......-....... v...........................................0..O.......s....%.o....%.o ...%.o!...%..o".....o#........($........(%..._,...o&...(....*.*..(....*..{....*"..}....*..{....*"..}....*..{....*"..}....*..{....*"..}....*...(.......(....(.......(....(.......(....(.....*.0..5........('...-..*.((.....o)...(*...(+...(,.......,..o-.....*............)........(....*2.(/...o0...*..(1...*.(2...*2.(....o3...*..(....o4...&.(.....o5....(.....o5....(....o6...&*2.(....o7

                                                                                                              C:\Program Files\FastestVPN\FastestVPN.exe.config (copy)

                                                                                                              Download File
                                                                                                              Process:C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmp
                                                                                                              File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                                                                                                              Category:dropped
                                                                                                              Size (bytes):1112
                                                                                                              Entropy (8bit):5.030466366630491
                                                                                                              Encrypted:false
                                                                                                              SSDEEP:24:JdArztW1oF7Nv+IcvH2/+GVTcvH2/+GVhOXrRH2/d9y:3Arzcq7h+Iag+GMg+G27Rgdw
                                                                                                              MD5:B94AE93769D64791440B3C36CC82AC69
                                                                                                              SHA1:E4AAAD9A0FB51051C8B25F768BC1563543F132C0
                                                                                                              SHA-256:432BFD182828A531147812566CB3439702A243BB7A4C45CC816192F9CB91D4A5
                                                                                                              SHA-512:AD978C59980C0194357D5070D53EA77C334493D14593C141B9DBEEF835FC688FD90C99236D687F50860FA7F4FD4125650E432A61EDF7917C77E4EE4E5E3D4E66
                                                                                                              Malicious:true
                                                                                                              Preview:.<?xml version="1.0" encoding="utf-8"?>..<configuration>.. <startup> .. <supportedRuntime version="v4.0" sku=".NETFramework,Version=v4.8" />.. </startup>.. <runtime>.. <legacyCorruptedStateExceptionsPolicy enabled="true" />.. <assemblyBinding xmlns="urn:schemas-microsoft-com:asm.v1">.. <dependentAssembly>.. <assemblyIdentity name="Microsoft.Expression.Interactions" publicKeyToken="31bf3856ad364e35" culture="neutral" />.. <bindingRedirect oldVersion="0.0.0.0-4.5.0.0" newVersion="4.5.0.0" />.. </dependentAssembly>.. <dependentAssembly>.. <assemblyIdentity name="System.Windows.Interactivity" publicKeyToken="31bf3856ad364e35" culture="neutral" />.. <bindingRedirect oldVersion="0.0.0.0-4.5.0.0" newVersion="4.5.0.0" />.. </dependentAssembly>.. <dependentAssembly>.. <assemblyIdentity name="Newtonsoft.Json" publicKeyToken="30ad4fe6b2a6aeed" culture="neutral" />.. <bindingRedirect oldVersion="0.0.0.0-13.0.0

                                                                                                              C:\Program Files\FastestVPN\Flurl.Http.dll (copy)

                                                                                                              Download File
                                                                                                              Process:C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmp
                                                                                                              File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                              Category:dropped
                                                                                                              Size (bytes):117928
                                                                                                              Entropy (8bit):6.160360774488817
                                                                                                              Encrypted:false
                                                                                                              SSDEEP:3072:Hzne5lbC/VlCG2OWMMdWWbWbWw+Hfz+8lKbchOD07PQCFP1IYmDe/WAbBuhEK/a:HFO4WMMdWWbWbWw+Hfz+8lKbchOD07PP
                                                                                                              MD5:FDFDFE021B53B630939D27C6C90CB435
                                                                                                              SHA1:AA0987A6EA6987BB9930B9167EC31C249EF9D885
                                                                                                              SHA-256:D753A7EF62BABC2ADB5D1DBEB0BEBAA2B042CC01CC219726F32F761BBB0A711D
                                                                                                              SHA-512:1FD0C74D0ED3AC4DF26D3E95C0F133E8024D77D1FD06E0C76C630D6AAC7B81124AA1DCA7CFFAC43BC34252A057414F8C3F8EC63A805323B1EF892B5F6A277D3B
                                                                                                              Malicious:false
                                                                                                              Antivirus:
                                                                                                              • Antivirus: ReversingLabs, Detection: 0%
                                                                                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....8............" ..0................. ........... ..............................U.....`.................................w...O........................*..............T............................................ ............... ..H............text....... ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................H.........................................................................{ ...*..{!...*V.(".....} .....}!...*...0..A........u........4.,/(#....{ ....{ ...o$...,.(%....{!....{!...o&...*.*.*. '.(k )UU.Z(#....{ ...o'...X )UU.Z(%....{!...o(...X*...0..b........r...p......%..{ ......%q.........-.&.+.......o)....%..{!......%q.........-.&.+.......o)....(*...*>..su...%.}^...*...0...........(+...,..*...(....o.....8t....o......-2.{,....{-.....g...%..".o.....(/...s0...sk....88....{,...r

                                                                                                              C:\Program Files\FastestVPN\Flurl.dll (copy)

                                                                                                              Download File
                                                                                                              Process:C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmp
                                                                                                              File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                              Category:dropped
                                                                                                              Size (bytes):49320
                                                                                                              Entropy (8bit):6.325351798150663
                                                                                                              Encrypted:false
                                                                                                              SSDEEP:768:Qmbo2ICFobV6wsLIcUIh/61jCouvi1Ys7ZYiG6K/Y/+Z:QmbrbU6ws0cGjCoei1Ys7Z7G6K/P
                                                                                                              MD5:C22900453EF4B917460ADEA7DE87225B
                                                                                                              SHA1:6878237656DA68C046FB95FAA8CAF3B4C719851B
                                                                                                              SHA-256:9AF8C8105093B7D62FC578DAE3497FF0AD796C9ABD638EB14269DED4270DFF96
                                                                                                              SHA-512:2E7D0EB99E2924FB375AAF8891968228193C65C133E362F66567C044E8B744ABC3A992EF7606644690D1BB81AD13A64A35D8107BDBDD9D5942BEA1DD1074EA3C
                                                                                                              Malicious:false
                                                                                                              Antivirus:
                                                                                                              • Antivirus: ReversingLabs, Detection: 0%
                                                                                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L................." ..0................. ........... ....................................`.................................p...O.......,................*..............T............................................ ............... ..H............text....... ...................... ..`.rsrc...,...........................@..@.reloc..............................@..B........................H........L...\............................................................{"...*..{#...*V.($.....}".....}#...*...0..A........u........4.,/(%....{"....{"...o&...,.('....{#....{#...o(...*.*.*. ?Y.. )UU.Z(%....{"...o)...X )UU.Z('....{#...o*...X*...0..b........r...p......%..{"......%q.........-.&.+.......o+....%..{#......%q.........-.&.+.......o+....(,...*..{-...*..{....*V.($.....}-.....}....*.0..A........u........4.,/(%....{-....{-...o&...,.('....{.....{....o(...*.*.*. (... )UU.

                                                                                                              C:\Program Files\FastestVPN\Hardcodet.NotifyIcon.Wpf.dll (copy)

                                                                                                              Download File
                                                                                                              Process:C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmp
                                                                                                              File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                              Category:dropped
                                                                                                              Size (bytes):108200
                                                                                                              Entropy (8bit):7.332504567097915
                                                                                                              Encrypted:false
                                                                                                              SSDEEP:1536:Gn5VJM3T5szyxa9PuIKb8wmtyYVzH0cfNbQSi/GoP4YNjZ34A7GZK/ZIVQ:GWsEa9GIdyAUKWeYNl34AwK/ZV
                                                                                                              MD5:261A5044C94F318DEEA20D178ED9F36E
                                                                                                              SHA1:2A9704F70A543EE219481A3AA756A0CF151E1999
                                                                                                              SHA-256:D17E9B0C62C224D1BA56E7206D8A44FE382FE99752C511BA211A7725D83FEF43
                                                                                                              SHA-512:E53C320DBF6B2AAEEC01FE5AFF1FAD5A8D75B2483A78BA0E1B510F2A7A8C5C510ACD603541734F4A002748D0781FC11AFBF6967EBCDB41A6FC9A29C828ABC2A3
                                                                                                              Malicious:false
                                                                                                              Antivirus:
                                                                                                              • Antivirus: ReversingLabs, Detection: 0%
                                                                                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...l.g..........." ..0..p.............. ........... ....................................`.....................................O....................|...*..............p............................................ ............... ..H............text....n... ...p.................. ..`.rsrc................r..............@..@.reloc...............z..............@..B........................H........O..|w..................,.......................................V!.)1......s.........*...0..$........u......,...o....*.u......,...o....*.0..&........u......,....o ...*.u......,....o!...*...0..&........u......,....o"...*.u......,....o#...*B.(Y...-.(....*.*..{!...*"..}!...*>.{....o.......*.0..9........(*.....($.....(......,..o%...-..,..o&...-..,..o%...*.*.*....0...........s'...}.....((....(....-..s....+.(....}......{....o....(....}.....(!....{...........s)...o.....{....

                                                                                                              C:\Program Files\FastestVPN\Microsoft.AppCenter.Analytics.dll (copy)

                                                                                                              Download File
                                                                                                              Process:C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmp
                                                                                                              File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                              Category:dropped
                                                                                                              Size (bytes):25976
                                                                                                              Entropy (8bit):6.331152456306087
                                                                                                              Encrypted:false
                                                                                                              SSDEEP:384:Z90ljCvGQJ+GlfmER/asDZ0WN1L4meT6pmOW2ZZWeQMWMLHRN7S37EHR9zCt+:Z9EIGk+GlfmERxcFz2ZSCL+7Ex9zS+
                                                                                                              MD5:3C5DFBB4E3F1AD153EB2E203B56EA0AE
                                                                                                              SHA1:59623BF1D67D87264C165E421F12426DA998AF46
                                                                                                              SHA-256:9E8252429D0E6529B87A2C79A13119F4DF56ABE924949F3750B024C51D747378
                                                                                                              SHA-512:94DF20E98A2E5D7AC93B63EFEBCE4DAAFBF25AB6B4A2B76AF0BB46D9EDE102AC8C8E1147D5813CDB879AADD5A8AA4073FD0E6066286AF4EF4D368FAB983BE3B5
                                                                                                              Malicious:false
                                                                                                              Antivirus:
                                                                                                              • Antivirus: ReversingLabs, Detection: 0%
                                                                                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....w............" ..0..4...........S... ...`....... ....................................`..................................S..O....`...............>..x'..........XR..T............................................ ............... ..H............text....3... ...4.................. ..`.rsrc........`.......6..............@..@.reloc...............<..............@..B.................S......H.......l,..l%...................Q........................................(....*.0..H.........~....,...~....*~..........(......~....%-.&s....%...........,..(......*........#<.......0..%.......~..........(...............,..(.....*....................0..........~..........(....(....o....(...+....,..(......*...........".......0..0.......~..........(....(.....o.....(...+....,..(......*.........$.......0..).......~..........(....(......o.......,..(.....*....................0..b...

                                                                                                              C:\Program Files\FastestVPN\Microsoft.AppCenter.Crashes.dll (copy)

                                                                                                              Download File
                                                                                                              Process:C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmp
                                                                                                              File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                              Category:dropped
                                                                                                              Size (bytes):53624
                                                                                                              Entropy (8bit):6.18841715621451
                                                                                                              Encrypted:false
                                                                                                              SSDEEP:768:mLtojuUUUbf/l0lwELEEEqi8g15qTLT5HGoV0weeezxSoL3G7Yl9zndG:mE17Iw8/i8gM5maee8SoL13zdG
                                                                                                              MD5:B7ABAF6A90E95E585E71C0C22D90AF73
                                                                                                              SHA1:C9756883D1738A9931D0BF58D6F69CBB8DFD5870
                                                                                                              SHA-256:3BA247FDCC6953B5CC672A361983B7B0AF3051A83128970BCEBAB22036D1E859
                                                                                                              SHA-512:3A67EF230A06FAE3095926EAD9AAF329009BC0F2ED6AA1E6683C426ADA29DDD9CB77EC3BE134DFC4CD10A1F675D518FB4986363C4FE649D4247770B96DBC7A56
                                                                                                              Malicious:false
                                                                                                              Antivirus:
                                                                                                              • Antivirus: ReversingLabs, Detection: 0%
                                                                                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....#2..........." ..0.................. ........... ...............................0....`.....................................O.......................x'..........t...T............................................ ............... ..H............text........ ...................... ..`.rsrc...............................@..@.reloc..............................@..B.......................H........E...w..........................................................&...(....*2.r...p(....*V.(......}......}....*..{....*..{....*..{....*..(......}......}......}.......}.......}....*..{....*..{....*..{....*..{....*..{....*...0..'.......~.........(....t............(...+...3.*..0..'.......~.........(....t............(...+...3.*..0..'.......~.........(....t............(...+...3.*..0..'.......~.........(....t............(...+...3.*..0..'.......~.........(....t............(...

                                                                                                              C:\Program Files\FastestVPN\Microsoft.AppCenter.dll (copy)

                                                                                                              Download File
                                                                                                              Process:C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmp
                                                                                                              File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                              Category:dropped
                                                                                                              Size (bytes):147848
                                                                                                              Entropy (8bit):6.032707503792338
                                                                                                              Encrypted:false
                                                                                                              SSDEEP:3072:yiq8kuub1o2/5pds7tUMZNFxtPwVrHlGZ6U1SiWUwBpXtNpTE1MNniv:WFwzFQ9FGZ1SityhtNpTECU
                                                                                                              MD5:B6DB385295FA78A6AABCF217FD3C3F83
                                                                                                              SHA1:71E2A93223A6B8204EED6B9834284C0FA1D7EBD0
                                                                                                              SHA-256:ABF40F07643E6D29D0817021991F9D27410B7DCAEF80980D849634ACEF255BDC
                                                                                                              SHA-512:122FDB77C0AC6A7A2ECF5519BB059097EF119390E6D3C34F9FAB303D60279EE8649175617E3B6FC2A3D118B422CE8BC1BFFC208332D0A9F012271325AC0A0EE7
                                                                                                              Malicious:false
                                                                                                              Antivirus:
                                                                                                              • Antivirus: ReversingLabs, Detection: 0%
                                                                                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....@..........." ..0..............1... ...@....... ..............................0b....`.................................71..O....@...................'...`.......0..T............................................ ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B................k1......H.......8...d].................../.......................................0..s........r...p(......(....,.r...psK...z.rW..po....-.r[..pro..p(X....*s.....~.....o....o......+8..o....t.........o.....o ...o!.....o.....o ...o!...o".....o#...-.....u........,...o$.....r...po%...,.r[..pr...p(X....*.rS..po%...,.r[..prg..p(X....*~&....~&......o%...,.....o'...&..o%...,.....o'...&.(....,..(....,.r...p.r...p((...sK...z.(....-&.(....-.r...p.r%..p((.....r)..p.((.....*.......U.E........(....*.

                                                                                                              C:\Program Files\FastestVPN\Microsoft.AspNet.SignalR.Client.dll (copy)

                                                                                                              Download File
                                                                                                              Process:C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmp
                                                                                                              File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                              Category:dropped
                                                                                                              Size (bytes):149896
                                                                                                              Entropy (8bit):6.136390335470081
                                                                                                              Encrypted:false
                                                                                                              SSDEEP:1536:PcRKLBm0ELV6Ra+eKBL24YzRk2XDuzEdnp+4WSspmfxPapkwN5RGV5xz/OEYW58R:qI0KRHeKBszRk2aApjsp7pBtZGh9
                                                                                                              MD5:70B1C15FDBBFB88F91965DC7BBC5527F
                                                                                                              SHA1:A473571DAC42819933CD7EF0C604F1EA0614D2F3
                                                                                                              SHA-256:109878A7A6F6BD13637B7E3A2EBC22D37423716ECD4E954CC09BACB84B92F62B
                                                                                                              SHA-512:C496EE2DDF6C401E9E48FB6D739C44200EBFE36B516E7608CECB3E32FEB620CE1531CC5DE26B1A4CD033C65FD002D6B6315B746CFB8B4D047A2954F6F33CA0A4
                                                                                                              Malicious:false
                                                                                                              Antivirus:
                                                                                                              • Antivirus: ReversingLabs, Detection: 0%
                                                                                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...5A............" ..0..............;... ...@....... ..............................Ri....`.................................N;..O....@...............&...#...`......X:..T............................................ ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`.......$..............@..B.................;......H.......h....Y..........H'.......9........................................(...+*.~....*.~....*.~....*..%-.&(....*..%-.&~ ...*....0..........(!......o"......(7.......*...................0..........(!......o...+...(...+....*....................~$...%-.&~%.....&...s'...%.$....(...+*.0..D.............,:......o(.....,......o(....3.........o)....(....+.....(...+.*.0..9.......s*......}+.....},.....}-................s/... ....(B...&*....0..$........,...r...p......%.....o~......o0...*

                                                                                                              C:\Program Files\FastestVPN\Microsoft.Bcl.AsyncInterfaces.dll (copy)

                                                                                                              Download File
                                                                                                              Process:C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmp
                                                                                                              File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                              Category:dropped
                                                                                                              Size (bytes):26752
                                                                                                              Entropy (8bit):6.512503595653532
                                                                                                              Encrypted:false
                                                                                                              SSDEEP:768:DulwnBhYlTVv2wK5idcgF4of1n6K9zUYJ:ywHYFtKYdcg/f1nXzUYJ
                                                                                                              MD5:970B6E6478AE3AB699F277D77DE0CD19
                                                                                                              SHA1:5475CB28998D419B4714343FFA9511FF46322AC2
                                                                                                              SHA-256:5DC372A10F345B1F00EC6A8FA1A2CE569F7E5D63E4F1F8631BE367E46BFA34F4
                                                                                                              SHA-512:F3AD2088C5D3FCB770C6D8212650EED95507E107A34F9468CA9DB99DEFD8838443A95E0B59A5A6CB65A18EBBC529110C5348513A321B44223F537096C6D7D6E0
                                                                                                              Malicious:false
                                                                                                              Antivirus:
                                                                                                              • Antivirus: ReversingLabs, Detection: 0%
                                                                                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...$:............" ..0..4...........S... ...`....... ....................................`..................................S..O....`...............@...(...........R..T............................................ ............... ..H............text....3... ...4.................. ..`.rsrc........`.......6..............@..@.reloc...............>..............@..B.................S......H........'..P*..................,R........................................(....*..(....*^.(.......1...%...}....*:.(......}....*:.(......}....*:.(......}....*:.(......}....*..(....*..(....*..(....*..(....*:.(......}....*..{....*:.(......}....*..{....*:.(......}....*..{....*..(....*:.(......}....*..{....*^.(.......2...%...}....*:.(......}....*..{....*z.(......}.......2...%...}....*V.(......}......}....*..{....*..{....*:.(......}....*..{....*..{....*"..}....*..{....*"..}....*..{

                                                                                                              C:\Program Files\FastestVPN\Microsoft.Extensions.DependencyInjection.Abstractions.dll (copy)

                                                                                                              Download File
                                                                                                              Process:C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmp
                                                                                                              File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                              Category:dropped
                                                                                                              Size (bytes):48256
                                                                                                              Entropy (8bit):6.234996524588368
                                                                                                              Encrypted:false
                                                                                                              SSDEEP:768:AMWC5N7mKWPKz4VJ4e0jeuTGlBh0JzqPPxofk3l9z2I:Y67hCfV8j3TGlB+JsafkHzP
                                                                                                              MD5:37EB7CCE6E282D3572D64C880E1AC3C8
                                                                                                              SHA1:9A2952589A19D650932E7C633577EB9AFC04F959
                                                                                                              SHA-256:039155F155C5D14F5B73F4EE2CD1FBD9290F391B88A1D2A0BA815569205EDB74
                                                                                                              SHA-512:E3C2EF1CC52E3AA5BD77B74DEC93A4FC9E908DF823426F13CA304265D41605DE51970CC8C7E18C2E76319D3225707B2EA2D8613402A25C4FBD3951E70FCFD521
                                                                                                              Malicious:false
                                                                                                              Antivirus:
                                                                                                              • Antivirus: ReversingLabs, Detection: 0%
                                                                                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....v..........." ..0.................. ........... ....................................`.....................................O........................(..............T............................................ ............... ..H............text........ ...................... ..`.rsrc...............................@..@.reloc..............................@..B.......................H........=..da..........0.................................................(....*..(....*^.(.......>...%...}....*:.(......}....*:.(......}....*:.(......}....*:.(......}....**.-..(....*..s....z.~....*...0..........(....,..*..(.....o.......&...*...................0...........(.......(....-..,..*.*.(....,.r...p......%...%...(....*..( ...*.(....,.r...p......%...%...%...(....*...(!...*.(....,!r...p......%...%...%...%...(....*....("...*..,&(....,..r...pr...p.(....(#...*..($...*.*.(.

                                                                                                              C:\Program Files\FastestVPN\Microsoft.Extensions.DependencyInjection.dll (copy)

                                                                                                              Download File
                                                                                                              Process:C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmp
                                                                                                              File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                              Category:dropped
                                                                                                              Size (bytes):88192
                                                                                                              Entropy (8bit):6.25584016939133
                                                                                                              Encrypted:false
                                                                                                              SSDEEP:1536:0kUuBN7CjSkp9oa++t1BVryVKXDORdDeCNia6Lj4Fu/qSGnJdo0Wzs:ju/t/VryVKXeDezVLj4F/JdWQ
                                                                                                              MD5:4186A905DC180A0CC2110403727BD792
                                                                                                              SHA1:E0563D20CA7E95688A60F4BFC1AB0127EAE1F651
                                                                                                              SHA-256:40DCB80A87A762745D0A15294B5CA7783A9EAD1D93AD352D25B5EDAF4994651E
                                                                                                              SHA-512:1C3459232B41C531F01BCCE54E46799F2FB3FCD6C87D7F908C633ABCC718D9726D98E65F964B1A870D416A38F545971779054FE65F7C1299905FC7DC24FA2DEC
                                                                                                              Malicious:false
                                                                                                              Antivirus:
                                                                                                              • Antivirus: ReversingLabs, Detection: 0%
                                                                                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L................." ..0..&..........>E... ...`....... ....................................`..................................D..O....`...............0...(...........C..T............................................ ............... ..H............text...D%... ...&.................. ..`.rsrc........`.......(..............@..@.reloc..............................@..B.................E......H........l..@...........02..0...`C........................................(....*..(....*^.(.......k...%...}....*:.(......}....*:.(......}....*:.(......}....*:.(......}....*.~....*..0..........(....,..*..(.....o ......&...*...................0...........(.......(!...-..,..*.*.(....,.r...p......%...%...("...*..(#...*.(....,.r...p......%...%...%...("...*...($...*.(....,!r...p......%...%...%...%...("...*....(%...*..,&(....,..r...pr...p.("...(&...*..('...*.*.(....,.r...p......%...

                                                                                                              C:\Program Files\FastestVPN\Newtonsoft.Json.dll (copy)

                                                                                                              Download File
                                                                                                              Process:C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmp
                                                                                                              File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                              Category:dropped
                                                                                                              Size (bytes):711952
                                                                                                              Entropy (8bit):5.967185619483575
                                                                                                              Encrypted:false
                                                                                                              SSDEEP:12288:GBja5bBvR8Q0TE2HB0WLmvXbsVG1Gw03RzxNHgKhwFBkjSHXP36RMGy1NqTUO:GBjk38WuBcAbwoA/BkjSHXP36RMG/
                                                                                                              MD5:195FFB7167DB3219B217C4FD439EEDD6
                                                                                                              SHA1:1E76E6099570EDE620B76ED47CF8D03A936D49F8
                                                                                                              SHA-256:E1E27AF7B07EEEDF5CE71A9255F0422816A6FC5849A483C6714E1B472044FA9D
                                                                                                              SHA-512:56EB7F070929B239642DAB729537DDE2C2287BDB852AD9E80B5358C74B14BC2B2DDED910D0E3B6304EA27EB587E5F19DB0A92E1CBAE6A70FB20B4EF05057E4AC
                                                                                                              Malicious:false
                                                                                                              Antivirus:
                                                                                                              • Antivirus: ReversingLabs, Detection: 0%
                                                                                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...p$?..........." ..0.............B.... ........... ....................... ............`....................................O......................../.......... ...T............................................ ............... ..H............text........ ...................... ..`.rsrc...............................@..@.reloc..............................@..B................$.......H.......x...(9............................................................(....*..(....*^.(...........%...}....*:.(......}....*:.(......}....*..(....*:.(......}....*..{....*..(....*..(....*:.(......}....*..{....*.(.........*....}.....(......{.....X.....}....*..0...........-.~....*.~....X....b...aX...X...X..+....b....aX....X.....2.....cY.....cY....cY..|....(......._..{........+,..{|....3...{{......(....,...{{...*..{}.......-..*...0...........-.r...ps....z.o......-.~....*.~....

                                                                                                              C:\Program Files\FastestVPN\Resources\ComDebug.exe (copy)

                                                                                                              Download File
                                                                                                              Process:C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmp
                                                                                                              File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                              Category:dropped
                                                                                                              Size (bytes):196157514
                                                                                                              Entropy (8bit):0.9790898435836601
                                                                                                              Encrypted:false
                                                                                                              SSDEEP:196608:hqw2hVGlR9fHUTW9kG0Pktx+PSRFZyqMpBeD63RmTtGtqQY6lgJTXdrb4acJ7AuN:hohVgRxmP8k
                                                                                                              MD5:F892887D8532D19F74884CDC48B1AC8B
                                                                                                              SHA1:BD20AFCD00D7C5A46CC1C5399BDC15A185F815D3
                                                                                                              SHA-256:2E7FA00A4C0EA04EF0ABCD658BDE323DB0FDFFCA1C5402592CB2197EE3126383
                                                                                                              SHA-512:7A610425A58C24815D6731C04BBD2DC919799AE36D95184B567C3A86ED1733B542F7D5F523DF6E4577BB69D755100597E815815378A4F103232FAD7ACF2E9F67
                                                                                                              Malicious:true
                                                                                                              Antivirus:
                                                                                                              • Antivirus: ReversingLabs, Detection: 3%
                                                                                                              Preview:MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L...w..e..................P... ...... P......0P...@..........................pt.....CO....@......@...................PV.......V..=...p].................`(....V..............................pV.......................V......@V......................text...D.O.......O................. ..`.itext...1....O..2....O............. ..`.data...l....0P.......P.............@....bss....\0....R..........................idata...=....V..>....R.............@....didata......@V.......R.............@....edata.......PV.......R.............@..@.tls....\....`V..........................rdata..]....pV.......R.............@..@.reloc........V.......R.............@..B.rsrc........p].......Y.............@..@..............d......>a.............@..@................

                                                                                                              C:\Program Files\FastestVPN\Resources\Setup.Ps1 (copy)

                                                                                                              Download File
                                                                                                              Process:C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmp
                                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                                              Category:dropped
                                                                                                              Size (bytes):359
                                                                                                              Entropy (8bit):5.09733291062762
                                                                                                              Encrypted:false
                                                                                                              SSDEEP:6:i4Z2TyUdkl9WUyUdkwc1+XMoHkyUdk3LASg0TqeXMFXA98XfFZ/FvjCzISMOmEm:jZELklIULktkXxELk35q0MhA98vFZ/FV
                                                                                                              MD5:777B3CBF81DDD8B238BDEDDDEA17AFED
                                                                                                              SHA1:C72F46715DCBC9BDA1E2BEEAC8AF2A64E7B48D08
                                                                                                              SHA-256:DACE14B4A5268728E67A9E78D8F0877F4C87F6B87DDD40DFF28A11E9E42945CF
                                                                                                              SHA-512:5C6D302F93381EBF65ADD3DAA0EB4813270C5D9A042AD9B8A48A575ADC4E751D3834292BB61AEF6A5458036AE6E3C83C8EDFAE5CF828D81317ACAE6675B8E619
                                                                                                              Malicious:false
                                                                                                              Preview:If (-NOT ([Security.Principal.WindowsPrincipal][Security.Principal.WindowsIdentity]::GetCurrent()).IsInRole([Security.Principal.WindowsBuiltInRole] "Administrator"))..{ ..$arguments = "& '" + $myinvocation.mycommand.definition + "'"..Start-Process powershell -Verb runAs -ArgumentList $arguments..Break..}.. Set-NetConnectionProfile -NetworkCategory Private

                                                                                                              C:\Program Files\FastestVPN\Resources\data\ca1.ca (copy)

                                                                                                              Download File
                                                                                                              Process:C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmp
                                                                                                              File Type:PEM certificate
                                                                                                              Category:dropped
                                                                                                              Size (bytes):1912
                                                                                                              Entropy (8bit):6.013187457463572
                                                                                                              Encrypted:false
                                                                                                              SSDEEP:48:LrZOGn3n3+NKHqtdSLuARqhs9WWRR21mB4LearXRvW:Lrz3nnYhhfwc1eCearhvW
                                                                                                              MD5:94F25D41487F654EF2371FA92544003C
                                                                                                              SHA1:41A561AA773A21C240F74AF4F14DB7FB2479F630
                                                                                                              SHA-256:E6A1EEFBCA63DDCE20065B080C202BF63686F473B91F2C64461434AFD071018C
                                                                                                              SHA-512:281DCBF7852E3B81B3E09A889045C2B4357F684B4F511835A874BC98DEC7D4A77AD1EC1C0FE1D55D9616670278715FBFE9772F2518C3861933F6C392B6A939A4
                                                                                                              Malicious:false
                                                                                                              Preview:-----BEGIN CERTIFICATE-----..MIIFQjCCAyqgAwIBAgIIUfxepT+rr8owDQYJKoZIhvcNAQEMBQAwPzELMAkGA1UE..BhMCS1kxEzARBgNVBAoTCkZhc3Rlc3RWUE4xGzAZBgNVBAMTEkZhc3Rlc3RWUE4g..Um9vdCBDQTAeFw0xNzA5MTYwMDAxNDZaFw0yNzA5MTQwMDAxNDZaMD8xCzAJBgNV..BAYTAktZMRMwEQYDVQQKEwpGYXN0ZXN0VlBOMRswGQYDVQQDExJGYXN0ZXN0VlBO..IFJvb3QgQ0EwggIiMA0GCSqGSIb3DQEBAQUAA4ICDwAwggIKAoICAQC1Xj+WfPTo..zFynFqc+c3CVrggIllaXEl5bY5VgFynXkqCTM6lSrfC4pNjGXUbqWe6RnGJbM4/6..kUn+lQDjFSQV1rzP2eDS8+r5+X2WXh4AoeNRUWhvSG+HiHD/B2EFK+Nd5BRSdUjp..KWAtsCmT2bBt7nT0jN1OdeNrLJeyF8siAqv/oQzKznF9aIe/N01b2M8ZOFTzoXi2..fZAckgGWui8NB/lzkVIJqSkAPRL8qiJLuRCPVOX1PFD8vV//R8/QumtfbcYBMo6v..Ck2HmWdrh5OQHPxb3KJtbtG+Z1j8x6HGEAe17djYepBiRMyCEQvYgfD6tvFylc4I..quhqE9yaP60PJod5TxpWnRQ6HIGSeBm+S+rYSMalTZ8+pUqOOA+IQCYpfpx6EKIJ..L/VsW2C7cXdvudxDhXPI5lR/QidCb9Ohq3WkfxXaYwzrngdg2avmNqId9R4KESuM..9GoHW0dszfyBCh5wYfeaffMElfDam3B92NUwyhZwtIiv623WVXY9PPz+EDjSJsIA..u2Vi1vdJyA4nD4k9Lwmx/1zTc/UaYVLsiBqL2WdfvFTeoWoV+dNxQXSEPhB8gwi8..x4O4lZW0cwVy/6fa8KMY8gZbcbSTr7U5bRERfW8l+jY+mYK

                                                                                                              C:\Program Files\FastestVPN\Resources\data\ca2.ca (copy)

                                                                                                              Download File
                                                                                                              Process:C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmp
                                                                                                              File Type:PEM certificate
                                                                                                              Category:dropped
                                                                                                              Size (bytes):1912
                                                                                                              Entropy (8bit):6.013187457463572
                                                                                                              Encrypted:false
                                                                                                              SSDEEP:48:LrZOGn3n3+NKHqtdSLuARqhs9WWRR21mB4LearXRvW:Lrz3nnYhhfwc1eCearhvW
                                                                                                              MD5:94F25D41487F654EF2371FA92544003C
                                                                                                              SHA1:41A561AA773A21C240F74AF4F14DB7FB2479F630
                                                                                                              SHA-256:E6A1EEFBCA63DDCE20065B080C202BF63686F473B91F2C64461434AFD071018C
                                                                                                              SHA-512:281DCBF7852E3B81B3E09A889045C2B4357F684B4F511835A874BC98DEC7D4A77AD1EC1C0FE1D55D9616670278715FBFE9772F2518C3861933F6C392B6A939A4
                                                                                                              Malicious:false
                                                                                                              Preview:-----BEGIN CERTIFICATE-----..MIIFQjCCAyqgAwIBAgIIUfxepT+rr8owDQYJKoZIhvcNAQEMBQAwPzELMAkGA1UE..BhMCS1kxEzARBgNVBAoTCkZhc3Rlc3RWUE4xGzAZBgNVBAMTEkZhc3Rlc3RWUE4g..Um9vdCBDQTAeFw0xNzA5MTYwMDAxNDZaFw0yNzA5MTQwMDAxNDZaMD8xCzAJBgNV..BAYTAktZMRMwEQYDVQQKEwpGYXN0ZXN0VlBOMRswGQYDVQQDExJGYXN0ZXN0VlBO..IFJvb3QgQ0EwggIiMA0GCSqGSIb3DQEBAQUAA4ICDwAwggIKAoICAQC1Xj+WfPTo..zFynFqc+c3CVrggIllaXEl5bY5VgFynXkqCTM6lSrfC4pNjGXUbqWe6RnGJbM4/6..kUn+lQDjFSQV1rzP2eDS8+r5+X2WXh4AoeNRUWhvSG+HiHD/B2EFK+Nd5BRSdUjp..KWAtsCmT2bBt7nT0jN1OdeNrLJeyF8siAqv/oQzKznF9aIe/N01b2M8ZOFTzoXi2..fZAckgGWui8NB/lzkVIJqSkAPRL8qiJLuRCPVOX1PFD8vV//R8/QumtfbcYBMo6v..Ck2HmWdrh5OQHPxb3KJtbtG+Z1j8x6HGEAe17djYepBiRMyCEQvYgfD6tvFylc4I..quhqE9yaP60PJod5TxpWnRQ6HIGSeBm+S+rYSMalTZ8+pUqOOA+IQCYpfpx6EKIJ..L/VsW2C7cXdvudxDhXPI5lR/QidCb9Ohq3WkfxXaYwzrngdg2avmNqId9R4KESuM..9GoHW0dszfyBCh5wYfeaffMElfDam3B92NUwyhZwtIiv623WVXY9PPz+EDjSJsIA..u2Vi1vdJyA4nD4k9Lwmx/1zTc/UaYVLsiBqL2WdfvFTeoWoV+dNxQXSEPhB8gwi8..x4O4lZW0cwVy/6fa8KMY8gZbcbSTr7U5bRERfW8l+jY+mYK

                                                                                                              C:\Program Files\FastestVPN\Resources\data\is-6ID8J.tmp

                                                                                                              Download File
                                                                                                              Process:C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmp
                                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                                              Category:dropped
                                                                                                              Size (bytes):618
                                                                                                              Entropy (8bit):4.532694766524299
                                                                                                              Encrypted:false
                                                                                                              SSDEEP:12:LrkTt/+xYnhEKMhS64Ar24EgJroQXj2OrcV7TdRwPXYGFc6895C1v:LrkTtcYnhEKoP4AK4EgJkCj2OrnoGFFx
                                                                                                              MD5:005BF2A1B29FB74EF9ED7402A69D5CD5
                                                                                                              SHA1:ADEFC73E4B4F34F304E78FD4DB2D3B6AD09C6AF7
                                                                                                              SHA-256:F7FE79400908B148EB8E8AF16B0F1AFDF7CBCD33DCE23F96177473D0BF11DAFF
                                                                                                              SHA-512:381CA1E2146A66D1ACC46F7E9F9081962BB96014C10EB5AA0AE60478B8DD902F1975D63AEE18675B95A71D90594338753D8C91CD21ED0939237562E61D0D3D69
                                                                                                              Malicious:false
                                                                                                              Preview:-----BEGIN OpenVPN Static key V1-----..697fe793b32cb5091d30f2326d5d124a..9412e93d0a44ef7361395d76528fcbfc..82c3859dccea70a93cfa8fae409709bf..f75f844cf5ff0c237f426d0c20969233..db0e706edb6bdf195ec3dc11b3f76bc8..07a77e74662d9a800c8cd1144ebb67b7..f0d3f1281d1baf522bfe03b7c3f963b1..364fc0769400e413b61ca7b43ab19fac..9e0f77e41efd4bda7fd77b1de2d7d785..5cbbe3e620cecceac72c21a825b243e6..51f44d90e290e09c3ad650de8fca99c8..58bc7caad584bc69b11e5c9fd9381c69..c505ec487a65912c672d83ed0113b5a7..4ddfbd3ab33b3683cec593557520a72c..4d6cce46111f56f3396cc3ce7183edce..553c68ea0796cf6c4375fad00aaa2a42..-----END OpenVPN Static key V1-----

                                                                                                              C:\Program Files\FastestVPN\Resources\data\is-8S2T4.tmp

                                                                                                              Download File
                                                                                                              Process:C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmp
                                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                                              Category:dropped
                                                                                                              Size (bytes):618
                                                                                                              Entropy (8bit):4.532694766524299
                                                                                                              Encrypted:false
                                                                                                              SSDEEP:12:LrkTt/+xYnhEKMhS64Ar24EgJroQXj2OrcV7TdRwPXYGFc6895C1v:LrkTtcYnhEKoP4AK4EgJkCj2OrnoGFFx
                                                                                                              MD5:005BF2A1B29FB74EF9ED7402A69D5CD5
                                                                                                              SHA1:ADEFC73E4B4F34F304E78FD4DB2D3B6AD09C6AF7
                                                                                                              SHA-256:F7FE79400908B148EB8E8AF16B0F1AFDF7CBCD33DCE23F96177473D0BF11DAFF
                                                                                                              SHA-512:381CA1E2146A66D1ACC46F7E9F9081962BB96014C10EB5AA0AE60478B8DD902F1975D63AEE18675B95A71D90594338753D8C91CD21ED0939237562E61D0D3D69
                                                                                                              Malicious:false
                                                                                                              Preview:-----BEGIN OpenVPN Static key V1-----..697fe793b32cb5091d30f2326d5d124a..9412e93d0a44ef7361395d76528fcbfc..82c3859dccea70a93cfa8fae409709bf..f75f844cf5ff0c237f426d0c20969233..db0e706edb6bdf195ec3dc11b3f76bc8..07a77e74662d9a800c8cd1144ebb67b7..f0d3f1281d1baf522bfe03b7c3f963b1..364fc0769400e413b61ca7b43ab19fac..9e0f77e41efd4bda7fd77b1de2d7d785..5cbbe3e620cecceac72c21a825b243e6..51f44d90e290e09c3ad650de8fca99c8..58bc7caad584bc69b11e5c9fd9381c69..c505ec487a65912c672d83ed0113b5a7..4ddfbd3ab33b3683cec593557520a72c..4d6cce46111f56f3396cc3ce7183edce..553c68ea0796cf6c4375fad00aaa2a42..-----END OpenVPN Static key V1-----

                                                                                                              C:\Program Files\FastestVPN\Resources\data\is-BVC6U.tmp

                                                                                                              Download File
                                                                                                              Process:C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmp
                                                                                                              File Type:PEM certificate
                                                                                                              Category:dropped
                                                                                                              Size (bytes):1912
                                                                                                              Entropy (8bit):6.013187457463572
                                                                                                              Encrypted:false
                                                                                                              SSDEEP:48:LrZOGn3n3+NKHqtdSLuARqhs9WWRR21mB4LearXRvW:Lrz3nnYhhfwc1eCearhvW
                                                                                                              MD5:94F25D41487F654EF2371FA92544003C
                                                                                                              SHA1:41A561AA773A21C240F74AF4F14DB7FB2479F630
                                                                                                              SHA-256:E6A1EEFBCA63DDCE20065B080C202BF63686F473B91F2C64461434AFD071018C
                                                                                                              SHA-512:281DCBF7852E3B81B3E09A889045C2B4357F684B4F511835A874BC98DEC7D4A77AD1EC1C0FE1D55D9616670278715FBFE9772F2518C3861933F6C392B6A939A4
                                                                                                              Malicious:false
                                                                                                              Preview:-----BEGIN CERTIFICATE-----..MIIFQjCCAyqgAwIBAgIIUfxepT+rr8owDQYJKoZIhvcNAQEMBQAwPzELMAkGA1UE..BhMCS1kxEzARBgNVBAoTCkZhc3Rlc3RWUE4xGzAZBgNVBAMTEkZhc3Rlc3RWUE4g..Um9vdCBDQTAeFw0xNzA5MTYwMDAxNDZaFw0yNzA5MTQwMDAxNDZaMD8xCzAJBgNV..BAYTAktZMRMwEQYDVQQKEwpGYXN0ZXN0VlBOMRswGQYDVQQDExJGYXN0ZXN0VlBO..IFJvb3QgQ0EwggIiMA0GCSqGSIb3DQEBAQUAA4ICDwAwggIKAoICAQC1Xj+WfPTo..zFynFqc+c3CVrggIllaXEl5bY5VgFynXkqCTM6lSrfC4pNjGXUbqWe6RnGJbM4/6..kUn+lQDjFSQV1rzP2eDS8+r5+X2WXh4AoeNRUWhvSG+HiHD/B2EFK+Nd5BRSdUjp..KWAtsCmT2bBt7nT0jN1OdeNrLJeyF8siAqv/oQzKznF9aIe/N01b2M8ZOFTzoXi2..fZAckgGWui8NB/lzkVIJqSkAPRL8qiJLuRCPVOX1PFD8vV//R8/QumtfbcYBMo6v..Ck2HmWdrh5OQHPxb3KJtbtG+Z1j8x6HGEAe17djYepBiRMyCEQvYgfD6tvFylc4I..quhqE9yaP60PJod5TxpWnRQ6HIGSeBm+S+rYSMalTZ8+pUqOOA+IQCYpfpx6EKIJ..L/VsW2C7cXdvudxDhXPI5lR/QidCb9Ohq3WkfxXaYwzrngdg2avmNqId9R4KESuM..9GoHW0dszfyBCh5wYfeaffMElfDam3B92NUwyhZwtIiv623WVXY9PPz+EDjSJsIA..u2Vi1vdJyA4nD4k9Lwmx/1zTc/UaYVLsiBqL2WdfvFTeoWoV+dNxQXSEPhB8gwi8..x4O4lZW0cwVy/6fa8KMY8gZbcbSTr7U5bRERfW8l+jY+mYK

                                                                                                              C:\Program Files\FastestVPN\Resources\data\is-OKD1B.tmp

                                                                                                              Download File
                                                                                                              Process:C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmp
                                                                                                              File Type:PEM certificate
                                                                                                              Category:dropped
                                                                                                              Size (bytes):1912
                                                                                                              Entropy (8bit):6.013187457463572
                                                                                                              Encrypted:false
                                                                                                              SSDEEP:48:LrZOGn3n3+NKHqtdSLuARqhs9WWRR21mB4LearXRvW:Lrz3nnYhhfwc1eCearhvW
                                                                                                              MD5:94F25D41487F654EF2371FA92544003C
                                                                                                              SHA1:41A561AA773A21C240F74AF4F14DB7FB2479F630
                                                                                                              SHA-256:E6A1EEFBCA63DDCE20065B080C202BF63686F473B91F2C64461434AFD071018C
                                                                                                              SHA-512:281DCBF7852E3B81B3E09A889045C2B4357F684B4F511835A874BC98DEC7D4A77AD1EC1C0FE1D55D9616670278715FBFE9772F2518C3861933F6C392B6A939A4
                                                                                                              Malicious:false
                                                                                                              Preview:-----BEGIN CERTIFICATE-----..MIIFQjCCAyqgAwIBAgIIUfxepT+rr8owDQYJKoZIhvcNAQEMBQAwPzELMAkGA1UE..BhMCS1kxEzARBgNVBAoTCkZhc3Rlc3RWUE4xGzAZBgNVBAMTEkZhc3Rlc3RWUE4g..Um9vdCBDQTAeFw0xNzA5MTYwMDAxNDZaFw0yNzA5MTQwMDAxNDZaMD8xCzAJBgNV..BAYTAktZMRMwEQYDVQQKEwpGYXN0ZXN0VlBOMRswGQYDVQQDExJGYXN0ZXN0VlBO..IFJvb3QgQ0EwggIiMA0GCSqGSIb3DQEBAQUAA4ICDwAwggIKAoICAQC1Xj+WfPTo..zFynFqc+c3CVrggIllaXEl5bY5VgFynXkqCTM6lSrfC4pNjGXUbqWe6RnGJbM4/6..kUn+lQDjFSQV1rzP2eDS8+r5+X2WXh4AoeNRUWhvSG+HiHD/B2EFK+Nd5BRSdUjp..KWAtsCmT2bBt7nT0jN1OdeNrLJeyF8siAqv/oQzKznF9aIe/N01b2M8ZOFTzoXi2..fZAckgGWui8NB/lzkVIJqSkAPRL8qiJLuRCPVOX1PFD8vV//R8/QumtfbcYBMo6v..Ck2HmWdrh5OQHPxb3KJtbtG+Z1j8x6HGEAe17djYepBiRMyCEQvYgfD6tvFylc4I..quhqE9yaP60PJod5TxpWnRQ6HIGSeBm+S+rYSMalTZ8+pUqOOA+IQCYpfpx6EKIJ..L/VsW2C7cXdvudxDhXPI5lR/QidCb9Ohq3WkfxXaYwzrngdg2avmNqId9R4KESuM..9GoHW0dszfyBCh5wYfeaffMElfDam3B92NUwyhZwtIiv623WVXY9PPz+EDjSJsIA..u2Vi1vdJyA4nD4k9Lwmx/1zTc/UaYVLsiBqL2WdfvFTeoWoV+dNxQXSEPhB8gwi8..x4O4lZW0cwVy/6fa8KMY8gZbcbSTr7U5bRERfW8l+jY+mYK

                                                                                                              C:\Program Files\FastestVPN\Resources\data\tcp.tls (copy)

                                                                                                              Download File
                                                                                                              Process:C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmp
                                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                                              Category:dropped
                                                                                                              Size (bytes):618
                                                                                                              Entropy (8bit):4.532694766524299
                                                                                                              Encrypted:false
                                                                                                              SSDEEP:12:LrkTt/+xYnhEKMhS64Ar24EgJroQXj2OrcV7TdRwPXYGFc6895C1v:LrkTtcYnhEKoP4AK4EgJkCj2OrnoGFFx
                                                                                                              MD5:005BF2A1B29FB74EF9ED7402A69D5CD5
                                                                                                              SHA1:ADEFC73E4B4F34F304E78FD4DB2D3B6AD09C6AF7
                                                                                                              SHA-256:F7FE79400908B148EB8E8AF16B0F1AFDF7CBCD33DCE23F96177473D0BF11DAFF
                                                                                                              SHA-512:381CA1E2146A66D1ACC46F7E9F9081962BB96014C10EB5AA0AE60478B8DD902F1975D63AEE18675B95A71D90594338753D8C91CD21ED0939237562E61D0D3D69
                                                                                                              Malicious:false
                                                                                                              Preview:-----BEGIN OpenVPN Static key V1-----..697fe793b32cb5091d30f2326d5d124a..9412e93d0a44ef7361395d76528fcbfc..82c3859dccea70a93cfa8fae409709bf..f75f844cf5ff0c237f426d0c20969233..db0e706edb6bdf195ec3dc11b3f76bc8..07a77e74662d9a800c8cd1144ebb67b7..f0d3f1281d1baf522bfe03b7c3f963b1..364fc0769400e413b61ca7b43ab19fac..9e0f77e41efd4bda7fd77b1de2d7d785..5cbbe3e620cecceac72c21a825b243e6..51f44d90e290e09c3ad650de8fca99c8..58bc7caad584bc69b11e5c9fd9381c69..c505ec487a65912c672d83ed0113b5a7..4ddfbd3ab33b3683cec593557520a72c..4d6cce46111f56f3396cc3ce7183edce..553c68ea0796cf6c4375fad00aaa2a42..-----END OpenVPN Static key V1-----

                                                                                                              C:\Program Files\FastestVPN\Resources\data\udp.tls (copy)

                                                                                                              Download File
                                                                                                              Process:C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmp
                                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                                              Category:dropped
                                                                                                              Size (bytes):618
                                                                                                              Entropy (8bit):4.532694766524299
                                                                                                              Encrypted:false
                                                                                                              SSDEEP:12:LrkTt/+xYnhEKMhS64Ar24EgJroQXj2OrcV7TdRwPXYGFc6895C1v:LrkTtcYnhEKoP4AK4EgJkCj2OrnoGFFx
                                                                                                              MD5:005BF2A1B29FB74EF9ED7402A69D5CD5
                                                                                                              SHA1:ADEFC73E4B4F34F304E78FD4DB2D3B6AD09C6AF7
                                                                                                              SHA-256:F7FE79400908B148EB8E8AF16B0F1AFDF7CBCD33DCE23F96177473D0BF11DAFF
                                                                                                              SHA-512:381CA1E2146A66D1ACC46F7E9F9081962BB96014C10EB5AA0AE60478B8DD902F1975D63AEE18675B95A71D90594338753D8C91CD21ED0939237562E61D0D3D69
                                                                                                              Malicious:false
                                                                                                              Preview:-----BEGIN OpenVPN Static key V1-----..697fe793b32cb5091d30f2326d5d124a..9412e93d0a44ef7361395d76528fcbfc..82c3859dccea70a93cfa8fae409709bf..f75f844cf5ff0c237f426d0c20969233..db0e706edb6bdf195ec3dc11b3f76bc8..07a77e74662d9a800c8cd1144ebb67b7..f0d3f1281d1baf522bfe03b7c3f963b1..364fc0769400e413b61ca7b43ab19fac..9e0f77e41efd4bda7fd77b1de2d7d785..5cbbe3e620cecceac72c21a825b243e6..51f44d90e290e09c3ad650de8fca99c8..58bc7caad584bc69b11e5c9fd9381c69..c505ec487a65912c672d83ed0113b5a7..4ddfbd3ab33b3683cec593557520a72c..4d6cce46111f56f3396cc3ce7183edce..553c68ea0796cf6c4375fad00aaa2a42..-----END OpenVPN Static key V1-----

                                                                                                              C:\Program Files\FastestVPN\Resources\devcon.exe (copy)

                                                                                                              Download File
                                                                                                              Process:C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmp
                                                                                                              File Type:PE32+ executable (console) x86-64, for MS Windows
                                                                                                              Category:dropped
                                                                                                              Size (bytes):93832
                                                                                                              Entropy (8bit):5.48517352660103
                                                                                                              Encrypted:false
                                                                                                              SSDEEP:1536:kP2K0pa0WfEYp9Y/XQhpgnbP212YCJpDhiF4O7WGHK/CT:kePOYe4bu1epDh8RWGHK/M
                                                                                                              MD5:A2ADF4897942B99FE0738F8C37FD15C0
                                                                                                              SHA1:4192A2221F5C48A16427BF1898C0443CA27A29BB
                                                                                                              SHA-256:B339B9A93A93B52F3EA0A5F2161E4B16BDA0CA7396D53ECA14C7D7F3E963A3A3
                                                                                                              SHA-512:DF383B4B70C980C613F3C3EC4E99980DA6DB15F123D617197B644314233D1E2ADEC9F9162D6DBB7B874D885119082E01840102F0976F3CC767A78B5E467EF4A8
                                                                                                              Malicious:false
                                                                                                              Antivirus:
                                                                                                              • Antivirus: ReversingLabs, Detection: 0%
                                                                                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........X...9...9...9...AF..9...AW..9...A@..9...9..f9...AP.9...AY..9.......9...AG..9...AB..9..Rich.9..........................PE..d.....pK.........."......~...........s.......................................p......r.....@.......... ......................................X}..........p.......T....@.......`......0................................................................................text....|.......~.................. ..`.data...x...........................@....pdata..T...........................@..@.rsrc...p...........................@..@.reloc..p....`.......>..............@..B................................................................................................................................................................................................................................................................................................

                                                                                                              C:\Program Files\FastestVPN\Resources\driver\install_tap.bat (copy)

                                                                                                              Download File
                                                                                                              Process:C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmp
                                                                                                              File Type:DOS batch file, ASCII text, with CRLF line terminators
                                                                                                              Category:dropped
                                                                                                              Size (bytes):316
                                                                                                              Entropy (8bit):5.3985610361996965
                                                                                                              Encrypted:false
                                                                                                              SSDEEP:6:kCaFvHBvyXOBS7WFNiKGWxtfGT26BuXFoAyzyFEQRFQ1jt0V09:k9vBv5Y7WCKGWXOT7/+iQjOh0W
                                                                                                              MD5:259CE13E63C08F5198A5D7337DCCC0C0
                                                                                                              SHA1:E25C50EFBC8AF1D70BB42C72CB0D0246EBF6BCBC
                                                                                                              SHA-256:CE97CB0477C8F8F626A50B6935EB817062EC69136443E1F62691700CBC0D4456
                                                                                                              SHA-512:AD5319E8941E90D9C2FA60AD18B8061CAC31D0EE39DFDC1494E1A2B0A1F57AB661F034E6D60D8421FE07FB395B4FAF4F72B1C3C6E9459277A13961FC5EDB2CCC
                                                                                                              Malicious:false
                                                                                                              Preview:@echo OFF..@cd /d %~dp0..set OS=windows;....reg Query "HKLM\Hardware\Description\System\CentralProcessor\0" | find /i "x86" > NUL && set ARCH=i386 || set ARCH=amd64....for /f "tokens=4-5 delims=. " %%i in ('ver') do set VERSION=%%i.%%j..if "%version%" == "10.0" set OS=windows10......call %OS%\%ARCH%\install_tap.bat

                                                                                                              C:\Program Files\FastestVPN\Resources\driver\is-7QK33.tmp

                                                                                                              Download File
                                                                                                              Process:C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmp
                                                                                                              File Type:DOS batch file, ASCII text, with CRLF line terminators
                                                                                                              Category:dropped
                                                                                                              Size (bytes):302
                                                                                                              Entropy (8bit):5.3909078265911585
                                                                                                              Encrypted:false
                                                                                                              SSDEEP:6:6vyXOBS7WFNiKGWxtfGT26BuXFoAyzyFEQRFQ1OoKG9:6v5Y7WCKGWXOT7/+iQjOOo1
                                                                                                              MD5:6D857A141F9C245E6ACD7012120A0704
                                                                                                              SHA1:66666950BDB2486C58B1C2D11132A98BF3A54EA8
                                                                                                              SHA-256:992D1891016B4C45BACB4DB700195096F438BB10070484D63088F52E8063EEF7
                                                                                                              SHA-512:8ACE3FA96B4FDA7B036A12EBF8DFC3E8C1FFCF212ED8F2A60FEB64806C26AABF926FF3D02D656EECE10B6F760F846E4196A9116FFF83BC00408697F7C3EEE180
                                                                                                              Malicious:false
                                                                                                              Preview:@echo OFF..set OS=windows;....reg Query "HKLM\Hardware\Description\System\CentralProcessor\0" | find /i "x86" > NUL && set ARCH=i386 || set ARCH=amd64....for /f "tokens=4-5 delims=. " %%i in ('ver') do set VERSION=%%i.%%j..if "%version%" == "10.0" set OS=windows10....call %OS%\%ARCH%\uninstall_tap.bat

                                                                                                              C:\Program Files\FastestVPN\Resources\driver\is-C6TL3.tmp

                                                                                                              Download File
                                                                                                              Process:C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmp
                                                                                                              File Type:DOS batch file, ASCII text, with CRLF line terminators
                                                                                                              Category:dropped
                                                                                                              Size (bytes):316
                                                                                                              Entropy (8bit):5.3985610361996965
                                                                                                              Encrypted:false
                                                                                                              SSDEEP:6:kCaFvHBvyXOBS7WFNiKGWxtfGT26BuXFoAyzyFEQRFQ1jt0V09:k9vBv5Y7WCKGWXOT7/+iQjOh0W
                                                                                                              MD5:259CE13E63C08F5198A5D7337DCCC0C0
                                                                                                              SHA1:E25C50EFBC8AF1D70BB42C72CB0D0246EBF6BCBC
                                                                                                              SHA-256:CE97CB0477C8F8F626A50B6935EB817062EC69136443E1F62691700CBC0D4456
                                                                                                              SHA-512:AD5319E8941E90D9C2FA60AD18B8061CAC31D0EE39DFDC1494E1A2B0A1F57AB661F034E6D60D8421FE07FB395B4FAF4F72B1C3C6E9459277A13961FC5EDB2CCC
                                                                                                              Malicious:false
                                                                                                              Preview:@echo OFF..@cd /d %~dp0..set OS=windows;....reg Query "HKLM\Hardware\Description\System\CentralProcessor\0" | find /i "x86" > NUL && set ARCH=i386 || set ARCH=amd64....for /f "tokens=4-5 delims=. " %%i in ('ver') do set VERSION=%%i.%%j..if "%version%" == "10.0" set OS=windows10......call %OS%\%ARCH%\install_tap.bat

                                                                                                              C:\Program Files\FastestVPN\Resources\driver\uninstall_tap.bat (copy)

                                                                                                              Download File
                                                                                                              Process:C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmp
                                                                                                              File Type:DOS batch file, ASCII text, with CRLF line terminators
                                                                                                              Category:dropped
                                                                                                              Size (bytes):302
                                                                                                              Entropy (8bit):5.3909078265911585
                                                                                                              Encrypted:false
                                                                                                              SSDEEP:6:6vyXOBS7WFNiKGWxtfGT26BuXFoAyzyFEQRFQ1OoKG9:6v5Y7WCKGWXOT7/+iQjOOo1
                                                                                                              MD5:6D857A141F9C245E6ACD7012120A0704
                                                                                                              SHA1:66666950BDB2486C58B1C2D11132A98BF3A54EA8
                                                                                                              SHA-256:992D1891016B4C45BACB4DB700195096F438BB10070484D63088F52E8063EEF7
                                                                                                              SHA-512:8ACE3FA96B4FDA7B036A12EBF8DFC3E8C1FFCF212ED8F2A60FEB64806C26AABF926FF3D02D656EECE10B6F760F846E4196A9116FFF83BC00408697F7C3EEE180
                                                                                                              Malicious:false
                                                                                                              Preview:@echo OFF..set OS=windows;....reg Query "HKLM\Hardware\Description\System\CentralProcessor\0" | find /i "x86" > NUL && set ARCH=i386 || set ARCH=amd64....for /f "tokens=4-5 delims=. " %%i in ('ver') do set VERSION=%%i.%%j..if "%version%" == "10.0" set OS=windows10....call %OS%\%ARCH%\uninstall_tap.bat

                                                                                                              C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\OemVista.inf (copy)

                                                                                                              Download File
                                                                                                              Process:C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmp
                                                                                                              File Type:Windows setup INFormation
                                                                                                              Category:dropped
                                                                                                              Size (bytes):7537
                                                                                                              Entropy (8bit):5.046488463217706
                                                                                                              Encrypted:false
                                                                                                              SSDEEP:192:wr8tW9yCTi3K4vlQd22bjR+iAUC7bdP+io3DcNSj6jvKFkinuEQTXvzLd4Z:LWlGMdkxzo3DcNSj6jvKFkinuEQTXvzq
                                                                                                              MD5:50D29CA2E3DDB8A696923420EC2AC4FA
                                                                                                              SHA1:D85F4E65FE10F13DED1780DDBD074EDFC75F2D25
                                                                                                              SHA-256:817DFF7F4944A255A0A33B8D74EB60A755D8D268CC7AFD46FCE41E102E0A004B
                                                                                                              SHA-512:03778A9CDDD23639C88E24BB5D0446DA3A400BB6B3321FB35887CD23D88D0F7AD3FE911642CC7F8D16D29CD9E42106851B0028379E8DBCB3C6721C238FC4A0D3
                                                                                                              Malicious:false
                                                                                                              Preview:; ****************************************************************************..; * Copyright (C) 2002-2014 OpenVPN Technologies, Inc. *..; * This program is free software; you can redistribute it and/or modify *..; * it under the terms of the GNU General Public License version 2 *..; * as published by the Free Software Foundation. *..; ****************************************************************************....; SYNTAX CHECKER..; cd \WINDDK\3790\tools\chkinf..; chkinf c:\src\openvpn\tap-win32\i386\oemvista.inf..; OUTPUT -> file:///c:/WINDDK/3790/tools/chkinf/htm/c%23+src+openvpn+tap-win32+i386+__OemWin2k.htm....; INSTALL/REMOVE DRIVER..; tapinstall install OemVista.inf tapoas..; tapinstall update OemVista.inf tapoas..; tapinstall remove tapoas....;*********************************************************..; Note to Developers:..;..; If you are bundling the TAP-Windows driver with your app,..; you should try

                                                                                                              C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\install_tap.bat (copy)

                                                                                                              Download File
                                                                                                              Process:C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmp
                                                                                                              File Type:DOS batch file, ASCII text, with CRLF line terminators
                                                                                                              Category:dropped
                                                                                                              Size (bytes):228
                                                                                                              Entropy (8bit):4.832057381123706
                                                                                                              Encrypted:false
                                                                                                              SSDEEP:6:hiPFvPuaYkVVkZ0BNLllYYLV3GZ0Q/RLQ8NGN8BP:E9HuaYcyZcNLllYbZh/a8NGNc
                                                                                                              MD5:939DFFC36D36E4C85EE6703C812987E5
                                                                                                              SHA1:3BA5F451B1F5C269B4F51E847DA79A3C619CB9C9
                                                                                                              SHA-256:843C2DFB5FE8DFE7C5266F8F79D1E0AC0BA3E40D5C883D4AF879B6F273B7499E
                                                                                                              SHA-512:8958432897981533C2822AC7355D56FC490EB89157423FAA5DF13A5EC00E75A9E791A3ECF478561C3B13988C553FD739FD2047C37EF91972DBF61AB55D475314
                                                                                                              Malicious:false
                                                                                                              Preview:@echo off..@cd /d %~dp0..echo Removing old TAP driver.....tapinstall.exe remove tap0901 ..echo Installing TAP driver.....tapinstall.exe install OemVista.inf tap0901 ..echo TAP Driver Re-Installation completed successfully!..exit

                                                                                                              C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\is-4K729.tmp

                                                                                                              Download File
                                                                                                              Process:C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmp
                                                                                                              File Type:PE32+ executable (native) x86-64, for MS Windows
                                                                                                              Category:dropped
                                                                                                              Size (bytes):39920
                                                                                                              Entropy (8bit):6.333649052940754
                                                                                                              Encrypted:false
                                                                                                              SSDEEP:768:bCxLEO/+ApBG35KBOXZZoZmTD11a+uiExMFYQjdJxh63NOe:tCI46F1a+jExMFFjzv69
                                                                                                              MD5:059E578D456043A8C3B76EC365B375F3
                                                                                                              SHA1:42189B6A1B8C736397113BFC2283F5E1E1A44E8E
                                                                                                              SHA-256:A0170CF78105CE757E0549D79E4AE7C412240E8B81D262A24D76A047F181F881
                                                                                                              SHA-512:99E6B6AF018D0E3509D9DBE00301A7D5D6645A2070A8144ACFF04842F8BBACCD81E7651578D08F47639CD2B7D00EB64ACDDFA8725BCE9A073580B7FCF7964E6A
                                                                                                              Malicious:false
                                                                                                              Antivirus:
                                                                                                              • Antivirus: ReversingLabs, Detection: 0%
                                                                                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........~..[...[...[....w..Z....w..^...[...m....w.._....w..^.../t..Q.../t..Z.../t..Z...Rich[...........................PE..d......].........."......Z.....................@....................................P.....`A....................................................<.......X....p..H....x...#...........R..8............................S...............P...............................text...W>.......@.................. ..h.rdata..|....P.......D..............@..H.data........`.......P..............@....pdata..H....p.......R..............@..HPAGE.................V.............. ..`INIT.................d.............. ..b.rsrc...X............p..............@..B.reloc...............v..............@..B................................................................................................................................................................................

                                                                                                              C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\is-63E5N.tmp

                                                                                                              Download File
                                                                                                              Process:C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmp
                                                                                                              File Type:data
                                                                                                              Category:dropped
                                                                                                              Size (bytes):10711
                                                                                                              Entropy (8bit):7.2254581318251425
                                                                                                              Encrypted:false
                                                                                                              SSDEEP:192:PqDhDNF748XJCO39JnxrEwJqKkhYCxXA6qnaj/rHr:OXPJxXxkh3xXhlzX
                                                                                                              MD5:225E7BA0E5E2D46813E5C858A4D0D5B0
                                                                                                              SHA1:5DD49014764F634164520583FD0CEC87AB1A1625
                                                                                                              SHA-256:B0BAF5CB84FA4ACB34B77A6231052061DA6B8676D216833724B7A602622161FB
                                                                                                              SHA-512:9C77ADF7E71ACA94489DFEB536F796A017B7C05771962274BAE2C614E2AE6799CCEB36CC58AC470184C37F52DEAC75988BB14E6A329F432C6D7CEDBCA18272A8
                                                                                                              Malicious:false
                                                                                                              Preview:0.)...*.H........).0.)....1.0...`.H.e......0..M..+.....7.....>0..:0...+.....7..........dG.'$....g..191023085812Z0...+.....7.....0..T0.... .}..ID.U..;.t.`.U..h.z.F.......K1..0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.:.1.0...0...0<..+.....7...1.0,...F.i.l.e........o.e.m.v.i.s.t.a...i.n.f...0U..+.....7...1G0E0...+.....7.......010...`.H.e....... .}..ID.U..;.t.`.U..h.z.F.......K0....._Ne...=.....N.._-%1..0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.:.1.0...0...0<..+.....7...1.0,...F.i.l.e........o.e.m.v.i.s.t.a...i.n.f...0.....D.......L..S.4..b.1..0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.:.1.0...0...0:..+.....7...1,0*...F.i.l.e........t.a.p.0.9.0.1...s.y.s...0.... .?;..{.x....H..4...k).VB.......1..0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.:.1.0...0...0:..+.....7...1,0*...F.i.l.e........t.a.p.0.9.0.1...s.y.s...0]..+.....7...1O0M0...+.....7...0...........010...`.H.e....... .?;..{.x....H..4...k).VB...........0...0....+.

                                                                                                              C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\is-A6FEM.tmp

                                                                                                              Download File
                                                                                                              Process:C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmp
                                                                                                              File Type:DOS batch file, ASCII text, with CRLF line terminators
                                                                                                              Category:dropped
                                                                                                              Size (bytes):228
                                                                                                              Entropy (8bit):4.832057381123706
                                                                                                              Encrypted:false
                                                                                                              SSDEEP:6:hiPFvPuaYkVVkZ0BNLllYYLV3GZ0Q/RLQ8NGN8BP:E9HuaYcyZcNLllYbZh/a8NGNc
                                                                                                              MD5:939DFFC36D36E4C85EE6703C812987E5
                                                                                                              SHA1:3BA5F451B1F5C269B4F51E847DA79A3C619CB9C9
                                                                                                              SHA-256:843C2DFB5FE8DFE7C5266F8F79D1E0AC0BA3E40D5C883D4AF879B6F273B7499E
                                                                                                              SHA-512:8958432897981533C2822AC7355D56FC490EB89157423FAA5DF13A5EC00E75A9E791A3ECF478561C3B13988C553FD739FD2047C37EF91972DBF61AB55D475314
                                                                                                              Malicious:false
                                                                                                              Preview:@echo off..@cd /d %~dp0..echo Removing old TAP driver.....tapinstall.exe remove tap0901 ..echo Installing TAP driver.....tapinstall.exe install OemVista.inf tap0901 ..echo TAP Driver Re-Installation completed successfully!..exit

                                                                                                              C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\is-KVOIK.tmp

                                                                                                              Download File
                                                                                                              Process:C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmp
                                                                                                              File Type:DOS batch file, ASCII text, with CRLF line terminators
                                                                                                              Category:dropped
                                                                                                              Size (bytes):142
                                                                                                              Entropy (8bit):4.838122400792552
                                                                                                              Encrypted:false
                                                                                                              SSDEEP:3:mKDD2G2FuyPuCkjLoOMXrHt9QVVkUoYmdFwLMiREl32AGN8BvAOA:hiPFvPullYkVVkxYmQLNREVNGN8B6
                                                                                                              MD5:012961E4DD4402DA78BC174AF09B77F9
                                                                                                              SHA1:900CA53983FAA217DD134664A9E694138E9A6FDF
                                                                                                              SHA-256:E7D73C9323599320AFA243DB5313F1A55ADFC34EDE66A4A656CA9172BF3C273D
                                                                                                              SHA-512:332A6BA6D1923A020DDB36E6E6FA80141B737ECC51EE52EE0D147B85DBC95DD3E97DA20083EAB3F5218DD9F4CA37DA986D35989F251F72C2512A42CBB6B462B9
                                                                                                              Malicious:false
                                                                                                              Preview:@echo off..@cd /d %~dp0..echo Removing TAP driver.....tapinstall.exe remove tap0901..echo TAP Driver Uninstall completed successfully!..exit..

                                                                                                              C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\is-KVT7L.tmp

                                                                                                              Download File
                                                                                                              Process:C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmp
                                                                                                              File Type:Windows setup INFormation
                                                                                                              Category:dropped
                                                                                                              Size (bytes):7537
                                                                                                              Entropy (8bit):5.046488463217706
                                                                                                              Encrypted:false
                                                                                                              SSDEEP:192:wr8tW9yCTi3K4vlQd22bjR+iAUC7bdP+io3DcNSj6jvKFkinuEQTXvzLd4Z:LWlGMdkxzo3DcNSj6jvKFkinuEQTXvzq
                                                                                                              MD5:50D29CA2E3DDB8A696923420EC2AC4FA
                                                                                                              SHA1:D85F4E65FE10F13DED1780DDBD074EDFC75F2D25
                                                                                                              SHA-256:817DFF7F4944A255A0A33B8D74EB60A755D8D268CC7AFD46FCE41E102E0A004B
                                                                                                              SHA-512:03778A9CDDD23639C88E24BB5D0446DA3A400BB6B3321FB35887CD23D88D0F7AD3FE911642CC7F8D16D29CD9E42106851B0028379E8DBCB3C6721C238FC4A0D3
                                                                                                              Malicious:false
                                                                                                              Preview:; ****************************************************************************..; * Copyright (C) 2002-2014 OpenVPN Technologies, Inc. *..; * This program is free software; you can redistribute it and/or modify *..; * it under the terms of the GNU General Public License version 2 *..; * as published by the Free Software Foundation. *..; ****************************************************************************....; SYNTAX CHECKER..; cd \WINDDK\3790\tools\chkinf..; chkinf c:\src\openvpn\tap-win32\i386\oemvista.inf..; OUTPUT -> file:///c:/WINDDK/3790/tools/chkinf/htm/c%23+src+openvpn+tap-win32+i386+__OemWin2k.htm....; INSTALL/REMOVE DRIVER..; tapinstall install OemVista.inf tapoas..; tapinstall update OemVista.inf tapoas..; tapinstall remove tapoas....;*********************************************************..; Note to Developers:..;..; If you are bundling the TAP-Windows driver with your app,..; you should try

                                                                                                              C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\is-OI0G9.tmp

                                                                                                              Download File
                                                                                                              Process:C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmp
                                                                                                              File Type:PE32+ executable (console) x86-64, for MS Windows
                                                                                                              Category:dropped
                                                                                                              Size (bytes):507728
                                                                                                              Entropy (8bit):6.351404653031349
                                                                                                              Encrypted:false
                                                                                                              SSDEEP:3072:6VF7vR03+4YnfLU6wXnSmZb3lKm34AJ9Qvtk1Ai8mTnu5gtZXqg7VcoyUyHi6/Cw:6VXU/3TNfAkTnrZqkyh/agGxwNdUo1h
                                                                                                              MD5:E313336C82EB265542664CC7A360C5FF
                                                                                                              SHA1:184211A456E09AC606DB76F814332CC912C0F5EB
                                                                                                              SHA-256:B6B33F4CD19C606E4C616F08C11FD4AE775ACCB24B78EF66EB31C279CA403381
                                                                                                              SHA-512:F156F2F55AF7026F5B3D2C5634806C5764FD230521D71969E80BBF6F6571730636DD5F6FE6C1138FA742E12003E5CC5F7D82E729EF7506057F8B510384E52386
                                                                                                              Malicious:false
                                                                                                              Antivirus:
                                                                                                              • Antivirus: ReversingLabs, Detection: 0%
                                                                                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......N....cv..cv..cv.Q.r..cv.Q.u..cv.Q.s..cv...s.#cv...r..cv...u..cv.Q.w..cv..cw..cv.~.s..cv.~....cv..c...cv.~.t..cv.Rich.cv.................PE..d......].........."......*...d.......z.........@..........................................`..................................................S..x............... L...x..PG......D.......T............................................@...............................text....).......*.................. ..`.rdata...%...@...&..................@..@.data....(...p.......T..............@....pdata.. L.......N...d..............@..@_RDATA..............................@..@.rsrc...............................@..@.reloc..D............n..............@..B................................................................................................................................................................................................

                                                                                                              C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tap0901.cat (copy)

                                                                                                              Download File
                                                                                                              Process:C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmp
                                                                                                              File Type:data
                                                                                                              Category:dropped
                                                                                                              Size (bytes):10711
                                                                                                              Entropy (8bit):7.2254581318251425
                                                                                                              Encrypted:false
                                                                                                              SSDEEP:192:PqDhDNF748XJCO39JnxrEwJqKkhYCxXA6qnaj/rHr:OXPJxXxkh3xXhlzX
                                                                                                              MD5:225E7BA0E5E2D46813E5C858A4D0D5B0
                                                                                                              SHA1:5DD49014764F634164520583FD0CEC87AB1A1625
                                                                                                              SHA-256:B0BAF5CB84FA4ACB34B77A6231052061DA6B8676D216833724B7A602622161FB
                                                                                                              SHA-512:9C77ADF7E71ACA94489DFEB536F796A017B7C05771962274BAE2C614E2AE6799CCEB36CC58AC470184C37F52DEAC75988BB14E6A329F432C6D7CEDBCA18272A8
                                                                                                              Malicious:false
                                                                                                              Preview:0.)...*.H........).0.)....1.0...`.H.e......0..M..+.....7.....>0..:0...+.....7..........dG.'$....g..191023085812Z0...+.....7.....0..T0.... .}..ID.U..;.t.`.U..h.z.F.......K1..0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.:.1.0...0...0<..+.....7...1.0,...F.i.l.e........o.e.m.v.i.s.t.a...i.n.f...0U..+.....7...1G0E0...+.....7.......010...`.H.e....... .}..ID.U..;.t.`.U..h.z.F.......K0....._Ne...=.....N.._-%1..0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.:.1.0...0...0<..+.....7...1.0,...F.i.l.e........o.e.m.v.i.s.t.a...i.n.f...0.....D.......L..S.4..b.1..0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.:.1.0...0...0:..+.....7...1,0*...F.i.l.e........t.a.p.0.9.0.1...s.y.s...0.... .?;..{.x....H..4...k).VB.......1..0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.:.1.0...0...0:..+.....7...1,0*...F.i.l.e........t.a.p.0.9.0.1...s.y.s...0]..+.....7...1O0M0...+.....7...0...........010...`.H.e....... .?;..{.x....H..4...k).VB...........0...0....+.

                                                                                                              C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tap0901.sys (copy)

                                                                                                              Download File
                                                                                                              Process:C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmp
                                                                                                              File Type:PE32+ executable (native) x86-64, for MS Windows
                                                                                                              Category:dropped
                                                                                                              Size (bytes):39920
                                                                                                              Entropy (8bit):6.333649052940754
                                                                                                              Encrypted:false
                                                                                                              SSDEEP:768:bCxLEO/+ApBG35KBOXZZoZmTD11a+uiExMFYQjdJxh63NOe:tCI46F1a+jExMFFjzv69
                                                                                                              MD5:059E578D456043A8C3B76EC365B375F3
                                                                                                              SHA1:42189B6A1B8C736397113BFC2283F5E1E1A44E8E
                                                                                                              SHA-256:A0170CF78105CE757E0549D79E4AE7C412240E8B81D262A24D76A047F181F881
                                                                                                              SHA-512:99E6B6AF018D0E3509D9DBE00301A7D5D6645A2070A8144ACFF04842F8BBACCD81E7651578D08F47639CD2B7D00EB64ACDDFA8725BCE9A073580B7FCF7964E6A
                                                                                                              Malicious:false
                                                                                                              Antivirus:
                                                                                                              • Antivirus: ReversingLabs, Detection: 0%
                                                                                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........~..[...[...[....w..Z....w..^...[...m....w.._....w..^.../t..Q.../t..Z.../t..Z...Rich[...........................PE..d......].........."......Z.....................@....................................P.....`A....................................................<.......X....p..H....x...#...........R..8............................S...............P...............................text...W>.......@.................. ..h.rdata..|....P.......D..............@..H.data........`.......P..............@....pdata..H....p.......R..............@..HPAGE.................V.............. ..`INIT.................d.............. ..b.rsrc...X............p..............@..B.reloc...............v..............@..B................................................................................................................................................................................

                                                                                                              C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exe (copy)

                                                                                                              Download File
                                                                                                              Process:C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmp
                                                                                                              File Type:PE32+ executable (console) x86-64, for MS Windows
                                                                                                              Category:dropped
                                                                                                              Size (bytes):507728
                                                                                                              Entropy (8bit):6.351404653031349
                                                                                                              Encrypted:false
                                                                                                              SSDEEP:3072:6VF7vR03+4YnfLU6wXnSmZb3lKm34AJ9Qvtk1Ai8mTnu5gtZXqg7VcoyUyHi6/Cw:6VXU/3TNfAkTnrZqkyh/agGxwNdUo1h
                                                                                                              MD5:E313336C82EB265542664CC7A360C5FF
                                                                                                              SHA1:184211A456E09AC606DB76F814332CC912C0F5EB
                                                                                                              SHA-256:B6B33F4CD19C606E4C616F08C11FD4AE775ACCB24B78EF66EB31C279CA403381
                                                                                                              SHA-512:F156F2F55AF7026F5B3D2C5634806C5764FD230521D71969E80BBF6F6571730636DD5F6FE6C1138FA742E12003E5CC5F7D82E729EF7506057F8B510384E52386
                                                                                                              Malicious:false
                                                                                                              Antivirus:
                                                                                                              • Antivirus: ReversingLabs, Detection: 0%
                                                                                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......N....cv..cv..cv.Q.r..cv.Q.u..cv.Q.s..cv...s.#cv...r..cv...u..cv.Q.w..cv..cw..cv.~.s..cv.~....cv..c...cv.~.t..cv.Rich.cv.................PE..d......].........."......*...d.......z.........@..........................................`..................................................S..x............... L...x..PG......D.......T............................................@...............................text....).......*.................. ..`.rdata...%...@...&..................@..@.data....(...p.......T..............@....pdata.. L.......N...d..............@..@_RDATA..............................@..@.rsrc...............................@..@.reloc..D............n..............@..B................................................................................................................................................................................................

                                                                                                              C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\uninstall_tap.bat (copy)

                                                                                                              Download File
                                                                                                              Process:C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmp
                                                                                                              File Type:DOS batch file, ASCII text, with CRLF line terminators
                                                                                                              Category:dropped
                                                                                                              Size (bytes):142
                                                                                                              Entropy (8bit):4.838122400792552
                                                                                                              Encrypted:false
                                                                                                              SSDEEP:3:mKDD2G2FuyPuCkjLoOMXrHt9QVVkUoYmdFwLMiREl32AGN8BvAOA:hiPFvPullYkVVkxYmQLNREVNGN8B6
                                                                                                              MD5:012961E4DD4402DA78BC174AF09B77F9
                                                                                                              SHA1:900CA53983FAA217DD134664A9E694138E9A6FDF
                                                                                                              SHA-256:E7D73C9323599320AFA243DB5313F1A55ADFC34EDE66A4A656CA9172BF3C273D
                                                                                                              SHA-512:332A6BA6D1923A020DDB36E6E6FA80141B737ECC51EE52EE0D147B85DBC95DD3E97DA20083EAB3F5218DD9F4CA37DA986D35989F251F72C2512A42CBB6B462B9
                                                                                                              Malicious:false
                                                                                                              Preview:@echo off..@cd /d %~dp0..echo Removing TAP driver.....tapinstall.exe remove tap0901..echo TAP Driver Uninstall completed successfully!..exit..

                                                                                                              C:\Program Files\FastestVPN\Resources\driver\windows10\i386\OemVista.inf (copy)

                                                                                                              Download File
                                                                                                              Process:C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmp
                                                                                                              File Type:Windows setup INFormation
                                                                                                              Category:dropped
                                                                                                              Size (bytes):7533
                                                                                                              Entropy (8bit):5.046821594517318
                                                                                                              Encrypted:false
                                                                                                              SSDEEP:192:wr8tW9yCTi3K4vlP2bjR+iAUC7bdP+io3DcNSj6jvKFkinuEQTXvzLd4Z:LWlGTxzo3DcNSj6jvKFkinuEQTXvzaZ
                                                                                                              MD5:3A541F2BF9842CDE6F0C95E83DE14FFA
                                                                                                              SHA1:12C074F03AA19968893F2BE48FDEF42A293B7EE4
                                                                                                              SHA-256:598EAD8481136AB0C8C99E67CA30841DB3C32417B45D6FEEDE04802DB0C4C320
                                                                                                              SHA-512:F060851D26E978AFA6AC632E74C221FB837FDEEE7752762BEE210D7BE144195A27514E108EF8C19A642BC03486E94721BD1B9D4AC69DB26BD892DCAA7894D3D2
                                                                                                              Malicious:false
                                                                                                              Preview:; ****************************************************************************..; * Copyright (C) 2002-2014 OpenVPN Technologies, Inc. *..; * This program is free software; you can redistribute it and/or modify *..; * it under the terms of the GNU General Public License version 2 *..; * as published by the Free Software Foundation. *..; ****************************************************************************....; SYNTAX CHECKER..; cd \WINDDK\3790\tools\chkinf..; chkinf c:\src\openvpn\tap-win32\i386\oemvista.inf..; OUTPUT -> file:///c:/WINDDK/3790/tools/chkinf/htm/c%23+src+openvpn+tap-win32+i386+__OemWin2k.htm....; INSTALL/REMOVE DRIVER..; tapinstall install OemVista.inf tapoas..; tapinstall update OemVista.inf tapoas..; tapinstall remove tapoas....;*********************************************************..; Note to Developers:..;..; If you are bundling the TAP-Windows driver with your app,..; you should try

                                                                                                              C:\Program Files\FastestVPN\Resources\driver\windows10\i386\install_tap.bat (copy)

                                                                                                              Download File
                                                                                                              Process:C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmp
                                                                                                              File Type:DOS batch file, ASCII text, with CRLF line terminators
                                                                                                              Category:dropped
                                                                                                              Size (bytes):228
                                                                                                              Entropy (8bit):4.832057381123706
                                                                                                              Encrypted:false
                                                                                                              SSDEEP:6:hiPFvPuaYkVVkZ0BNLllYYLV3GZ0Q/RLQ8NGN8BP:E9HuaYcyZcNLllYbZh/a8NGNc
                                                                                                              MD5:939DFFC36D36E4C85EE6703C812987E5
                                                                                                              SHA1:3BA5F451B1F5C269B4F51E847DA79A3C619CB9C9
                                                                                                              SHA-256:843C2DFB5FE8DFE7C5266F8F79D1E0AC0BA3E40D5C883D4AF879B6F273B7499E
                                                                                                              SHA-512:8958432897981533C2822AC7355D56FC490EB89157423FAA5DF13A5EC00E75A9E791A3ECF478561C3B13988C553FD739FD2047C37EF91972DBF61AB55D475314
                                                                                                              Malicious:false
                                                                                                              Preview:@echo off..@cd /d %~dp0..echo Removing old TAP driver.....tapinstall.exe remove tap0901 ..echo Installing TAP driver.....tapinstall.exe install OemVista.inf tap0901 ..echo TAP Driver Re-Installation completed successfully!..exit

                                                                                                              C:\Program Files\FastestVPN\Resources\driver\windows10\i386\is-6GBPO.tmp

                                                                                                              Download File
                                                                                                              Process:C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmp
                                                                                                              File Type:PE32 executable (console) Intel 80386, for MS Windows
                                                                                                              Category:dropped
                                                                                                              Size (bytes):396840
                                                                                                              Entropy (8bit):6.504700092936786
                                                                                                              Encrypted:false
                                                                                                              SSDEEP:12288:mkska7m3uFm4uy6b10MtxnOrPdmBe3oIkm:mAawb109dmBK5
                                                                                                              MD5:D680D27DCC19546B721F731384EE56DD
                                                                                                              SHA1:B418C1B8CB5E8259F9C8CBED29676AD101A15425
                                                                                                              SHA-256:E64E59A011D45C5D9D93AC79305A060244796040FCFBA112D7F8218F945C7602
                                                                                                              SHA-512:B495D60E97A782EDA01833F3A45AC03E5F2E6E629D7117ED34E6EA411E85FD8A012C21BD793ED59D7B352F3AA7552209F46203680974CCB57D003A1C690F476B
                                                                                                              Malicious:false
                                                                                                              Antivirus:
                                                                                                              • Antivirus: ReversingLabs, Detection: 0%
                                                                                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........b...1...1...1..0...1..0{..1..0.1C.0..1C.0.1C.0.1..0...1...1b..1..0...1..p1...1...1...1..0...1Rich...1........PE..L......].................<..........`m.......P....@.......................................@.....................................x.......................(H.......$......T...........................(...@............P..h............................text....;.......<.................. ..`.rdata..J....P.......@..............@..@.data...l...........................@....rsrc...............................@..@.reloc...$.......&..................@..B........................................................................................................................................................................................................................................................................................................

                                                                                                              C:\Program Files\FastestVPN\Resources\driver\windows10\i386\is-GT2CF.tmp

                                                                                                              Download File
                                                                                                              Process:C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmp
                                                                                                              File Type:DOS batch file, ASCII text, with CRLF line terminators
                                                                                                              Category:dropped
                                                                                                              Size (bytes):142
                                                                                                              Entropy (8bit):4.838122400792552
                                                                                                              Encrypted:false
                                                                                                              SSDEEP:3:mKDD2G2FuyPuCkjLoOMXrHt9QVVkUoYmdFwLMiREl32AGN8BvAOA:hiPFvPullYkVVkxYmQLNREVNGN8B6
                                                                                                              MD5:012961E4DD4402DA78BC174AF09B77F9
                                                                                                              SHA1:900CA53983FAA217DD134664A9E694138E9A6FDF
                                                                                                              SHA-256:E7D73C9323599320AFA243DB5313F1A55ADFC34EDE66A4A656CA9172BF3C273D
                                                                                                              SHA-512:332A6BA6D1923A020DDB36E6E6FA80141B737ECC51EE52EE0D147B85DBC95DD3E97DA20083EAB3F5218DD9F4CA37DA986D35989F251F72C2512A42CBB6B462B9
                                                                                                              Malicious:false
                                                                                                              Preview:@echo off..@cd /d %~dp0..echo Removing TAP driver.....tapinstall.exe remove tap0901..echo TAP Driver Uninstall completed successfully!..exit..

                                                                                                              C:\Program Files\FastestVPN\Resources\driver\windows10\i386\is-MJ3AR.tmp

                                                                                                              Download File
                                                                                                              Process:C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmp
                                                                                                              File Type:Windows setup INFormation
                                                                                                              Category:dropped
                                                                                                              Size (bytes):7533
                                                                                                              Entropy (8bit):5.046821594517318
                                                                                                              Encrypted:false
                                                                                                              SSDEEP:192:wr8tW9yCTi3K4vlP2bjR+iAUC7bdP+io3DcNSj6jvKFkinuEQTXvzLd4Z:LWlGTxzo3DcNSj6jvKFkinuEQTXvzaZ
                                                                                                              MD5:3A541F2BF9842CDE6F0C95E83DE14FFA
                                                                                                              SHA1:12C074F03AA19968893F2BE48FDEF42A293B7EE4
                                                                                                              SHA-256:598EAD8481136AB0C8C99E67CA30841DB3C32417B45D6FEEDE04802DB0C4C320
                                                                                                              SHA-512:F060851D26E978AFA6AC632E74C221FB837FDEEE7752762BEE210D7BE144195A27514E108EF8C19A642BC03486E94721BD1B9D4AC69DB26BD892DCAA7894D3D2
                                                                                                              Malicious:false
                                                                                                              Preview:; ****************************************************************************..; * Copyright (C) 2002-2014 OpenVPN Technologies, Inc. *..; * This program is free software; you can redistribute it and/or modify *..; * it under the terms of the GNU General Public License version 2 *..; * as published by the Free Software Foundation. *..; ****************************************************************************....; SYNTAX CHECKER..; cd \WINDDK\3790\tools\chkinf..; chkinf c:\src\openvpn\tap-win32\i386\oemvista.inf..; OUTPUT -> file:///c:/WINDDK/3790/tools/chkinf/htm/c%23+src+openvpn+tap-win32+i386+__OemWin2k.htm....; INSTALL/REMOVE DRIVER..; tapinstall install OemVista.inf tapoas..; tapinstall update OemVista.inf tapoas..; tapinstall remove tapoas....;*********************************************************..; Note to Developers:..;..; If you are bundling the TAP-Windows driver with your app,..; you should try

                                                                                                              C:\Program Files\FastestVPN\Resources\driver\windows10\i386\is-O4LBK.tmp

                                                                                                              Download File
                                                                                                              Process:C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmp
                                                                                                              File Type:DOS batch file, ASCII text, with CRLF line terminators
                                                                                                              Category:dropped
                                                                                                              Size (bytes):228
                                                                                                              Entropy (8bit):4.832057381123706
                                                                                                              Encrypted:false
                                                                                                              SSDEEP:6:hiPFvPuaYkVVkZ0BNLllYYLV3GZ0Q/RLQ8NGN8BP:E9HuaYcyZcNLllYbZh/a8NGNc
                                                                                                              MD5:939DFFC36D36E4C85EE6703C812987E5
                                                                                                              SHA1:3BA5F451B1F5C269B4F51E847DA79A3C619CB9C9
                                                                                                              SHA-256:843C2DFB5FE8DFE7C5266F8F79D1E0AC0BA3E40D5C883D4AF879B6F273B7499E
                                                                                                              SHA-512:8958432897981533C2822AC7355D56FC490EB89157423FAA5DF13A5EC00E75A9E791A3ECF478561C3B13988C553FD739FD2047C37EF91972DBF61AB55D475314
                                                                                                              Malicious:false
                                                                                                              Preview:@echo off..@cd /d %~dp0..echo Removing old TAP driver.....tapinstall.exe remove tap0901 ..echo Installing TAP driver.....tapinstall.exe install OemVista.inf tap0901 ..echo TAP Driver Re-Installation completed successfully!..exit

                                                                                                              C:\Program Files\FastestVPN\Resources\driver\windows10\i386\is-SJ7I7.tmp

                                                                                                              Download File
                                                                                                              Process:C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmp
                                                                                                              File Type:data
                                                                                                              Category:dropped
                                                                                                              Size (bytes):10866
                                                                                                              Entropy (8bit):7.241389894622462
                                                                                                              Encrypted:false
                                                                                                              SSDEEP:192:LBDMDT23rJCeS39JnxrEwJqKkhYC9jOVKEwkqnajNkwIetug:LXdoJxXxkh39qVKtklJGNg
                                                                                                              MD5:6A3C291EB986A23B427ECF92779C6902
                                                                                                              SHA1:C96B9791A0F5AC27F84E2F3E06E64C8513168477
                                                                                                              SHA-256:C996AA42A022F1DE293F14445FEC7038A7CDC6AA2C4632C5CCA07ED53F88F762
                                                                                                              SHA-512:1FC247B10FB3717344174FC66EDD6ACC5DF171EDF9F70081715CA4C62499D6673B777B635EA043B397F6933201150E8D8EE28309BFA7F6F96326562D43BB6640
                                                                                                              Malicious:false
                                                                                                              Preview:0.*n..*.H........*_0.*[...1.0...`.H.e......0.....+.....7......0...0...+.....7.....atM...lN....n>....191023090129Z0...+.....7.....0..T0......t.:..h.?+...*);~.1..0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.:.1.0...0...0<..+.....7...1.0,...F.i.l.e........o.e.m.v.i.s.t.a...i.n.f...0.... Y.....j...g.0....$..]o....-... 1..0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.:.1.0...0...0<..+.....7...1.0,...F.i.l.e........o.e.m.v.i.s.t.a...i.n.f...0U..+.....7...1G0E0...+.....7.......010...`.H.e....... Y.....j...g.0....$..]o....-... 0.......R.....Q.8Y....1..0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.:.1.0...0...0:..+.....7...1,0*...F.i.l.e........t.a.p.0.9.0.1...s.y.s...0.... ..xq....X.QO@....|s6..*.xV. .,.1..0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.:.1.0...0...0:..+.....7...1,0*...F.i.l.e........t.a.p.0.9.0.1...s.y.s...0]..+.....7...1O0M0...+.....7...0...........010...`.H.e....... ..xq....X.QO@....|s6..*.xV. .,...e0..a0....+.

                                                                                                              C:\Program Files\FastestVPN\Resources\driver\windows10\i386\is-SUSF8.tmp

                                                                                                              Download File
                                                                                                              Process:C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmp
                                                                                                              File Type:PE32 executable (native) Intel 80386, for MS Windows
                                                                                                              Category:dropped
                                                                                                              Size (bytes):35008
                                                                                                              Entropy (8bit):6.574406479237283
                                                                                                              Encrypted:false
                                                                                                              SSDEEP:768:nNoBjjOOA4dR/uEvBbuALxQbaxJxh639o:No9jyGu+BxLObev6No
                                                                                                              MD5:77E134EBCD2C8EA7D217EBD61DAAA7B6
                                                                                                              SHA1:F907526D7F1ED81A6F05BA040DE9E5DBEA421C52
                                                                                                              SHA-256:CDC110B59A650CF576D7E059DDB1E171BDE50789DD14ABE1199340312177EEDE
                                                                                                              SHA-512:57C6FFBB7D6D45EB461E2EAFDFA7B01FAAD0130511ED0C07931112FB72F7B1B18829BE3EBF1577DE4337B271F13C5F16528E588807F47A5B483A9BB4BFE6790C
                                                                                                              Malicious:false
                                                                                                              Antivirus:
                                                                                                              • Antivirus: ReversingLabs, Detection: 0%
                                                                                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........C..."..."..."...J..."...J..."...J..."..."..."...J..."...I..."...I."...I..."..Rich."..................PE..L...g..].................N...................P....@.......................................@A....................................P.......X............d...$.......... R..8...........................XR..@............P...............................text....7.......8.................. ..h.rdata..,....P.......<..............@..H.data........`.......B..............@...PAGE....[....p.......D.............. ..`INIT....T............P.............. ..b.rsrc...X............Z..............@..B.reloc...............`..............@..B................................................................................................................................................................................................................................................

                                                                                                              C:\Program Files\FastestVPN\Resources\driver\windows10\i386\tap0901.cat (copy)

                                                                                                              Download File
                                                                                                              Process:C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmp
                                                                                                              File Type:data
                                                                                                              Category:dropped
                                                                                                              Size (bytes):10866
                                                                                                              Entropy (8bit):7.241389894622462
                                                                                                              Encrypted:false
                                                                                                              SSDEEP:192:LBDMDT23rJCeS39JnxrEwJqKkhYC9jOVKEwkqnajNkwIetug:LXdoJxXxkh39qVKtklJGNg
                                                                                                              MD5:6A3C291EB986A23B427ECF92779C6902
                                                                                                              SHA1:C96B9791A0F5AC27F84E2F3E06E64C8513168477
                                                                                                              SHA-256:C996AA42A022F1DE293F14445FEC7038A7CDC6AA2C4632C5CCA07ED53F88F762
                                                                                                              SHA-512:1FC247B10FB3717344174FC66EDD6ACC5DF171EDF9F70081715CA4C62499D6673B777B635EA043B397F6933201150E8D8EE28309BFA7F6F96326562D43BB6640
                                                                                                              Malicious:false
                                                                                                              Preview:0.*n..*.H........*_0.*[...1.0...`.H.e......0.....+.....7......0...0...+.....7.....atM...lN....n>....191023090129Z0...+.....7.....0..T0......t.:..h.?+...*);~.1..0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.:.1.0...0...0<..+.....7...1.0,...F.i.l.e........o.e.m.v.i.s.t.a...i.n.f...0.... Y.....j...g.0....$..]o....-... 1..0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.:.1.0...0...0<..+.....7...1.0,...F.i.l.e........o.e.m.v.i.s.t.a...i.n.f...0U..+.....7...1G0E0...+.....7.......010...`.H.e....... Y.....j...g.0....$..]o....-... 0.......R.....Q.8Y....1..0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.:.1.0...0...0:..+.....7...1,0*...F.i.l.e........t.a.p.0.9.0.1...s.y.s...0.... ..xq....X.QO@....|s6..*.xV. .,.1..0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.:.1.0...0...0:..+.....7...1,0*...F.i.l.e........t.a.p.0.9.0.1...s.y.s...0]..+.....7...1O0M0...+.....7...0...........010...`.H.e....... ..xq....X.QO@....|s6..*.xV. .,...e0..a0....+.

                                                                                                              C:\Program Files\FastestVPN\Resources\driver\windows10\i386\tap0901.sys (copy)

                                                                                                              Download File
                                                                                                              Process:C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmp
                                                                                                              File Type:PE32 executable (native) Intel 80386, for MS Windows
                                                                                                              Category:dropped
                                                                                                              Size (bytes):35008
                                                                                                              Entropy (8bit):6.574406479237283
                                                                                                              Encrypted:false
                                                                                                              SSDEEP:768:nNoBjjOOA4dR/uEvBbuALxQbaxJxh639o:No9jyGu+BxLObev6No
                                                                                                              MD5:77E134EBCD2C8EA7D217EBD61DAAA7B6
                                                                                                              SHA1:F907526D7F1ED81A6F05BA040DE9E5DBEA421C52
                                                                                                              SHA-256:CDC110B59A650CF576D7E059DDB1E171BDE50789DD14ABE1199340312177EEDE
                                                                                                              SHA-512:57C6FFBB7D6D45EB461E2EAFDFA7B01FAAD0130511ED0C07931112FB72F7B1B18829BE3EBF1577DE4337B271F13C5F16528E588807F47A5B483A9BB4BFE6790C
                                                                                                              Malicious:false
                                                                                                              Antivirus:
                                                                                                              • Antivirus: ReversingLabs, Detection: 0%
                                                                                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........C..."..."..."...J..."...J..."...J..."..."..."...J..."...I..."...I."...I..."..Rich."..................PE..L...g..].................N...................P....@.......................................@A....................................P.......X............d...$.......... R..8...........................XR..@............P...............................text....7.......8.................. ..h.rdata..,....P.......<..............@..H.data........`.......B..............@...PAGE....[....p.......D.............. ..`INIT....T............P.............. ..b.rsrc...X............Z..............@..B.reloc...............`..............@..B................................................................................................................................................................................................................................................

                                                                                                              C:\Program Files\FastestVPN\Resources\driver\windows10\i386\tapinstall.exe (copy)

                                                                                                              Download File
                                                                                                              Process:C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmp
                                                                                                              File Type:PE32 executable (console) Intel 80386, for MS Windows
                                                                                                              Category:dropped
                                                                                                              Size (bytes):396840
                                                                                                              Entropy (8bit):6.504700092936786
                                                                                                              Encrypted:false
                                                                                                              SSDEEP:12288:mkska7m3uFm4uy6b10MtxnOrPdmBe3oIkm:mAawb109dmBK5
                                                                                                              MD5:D680D27DCC19546B721F731384EE56DD
                                                                                                              SHA1:B418C1B8CB5E8259F9C8CBED29676AD101A15425
                                                                                                              SHA-256:E64E59A011D45C5D9D93AC79305A060244796040FCFBA112D7F8218F945C7602
                                                                                                              SHA-512:B495D60E97A782EDA01833F3A45AC03E5F2E6E629D7117ED34E6EA411E85FD8A012C21BD793ED59D7B352F3AA7552209F46203680974CCB57D003A1C690F476B
                                                                                                              Malicious:false
                                                                                                              Antivirus:
                                                                                                              • Antivirus: ReversingLabs, Detection: 0%
                                                                                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........b...1...1...1..0...1..0{..1..0.1C.0..1C.0.1C.0.1..0...1...1b..1..0...1..p1...1...1...1..0...1Rich...1........PE..L......].................<..........`m.......P....@.......................................@.....................................x.......................(H.......$......T...........................(...@............P..h............................text....;.......<.................. ..`.rdata..J....P.......@..............@..@.data...l...........................@....rsrc...............................@..@.reloc...$.......&..................@..B........................................................................................................................................................................................................................................................................................................

                                                                                                              C:\Program Files\FastestVPN\Resources\driver\windows10\i386\uninstall_tap.bat (copy)

                                                                                                              Download File
                                                                                                              Process:C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmp
                                                                                                              File Type:DOS batch file, ASCII text, with CRLF line terminators
                                                                                                              Category:dropped
                                                                                                              Size (bytes):142
                                                                                                              Entropy (8bit):4.838122400792552
                                                                                                              Encrypted:false
                                                                                                              SSDEEP:3:mKDD2G2FuyPuCkjLoOMXrHt9QVVkUoYmdFwLMiREl32AGN8BvAOA:hiPFvPullYkVVkxYmQLNREVNGN8B6
                                                                                                              MD5:012961E4DD4402DA78BC174AF09B77F9
                                                                                                              SHA1:900CA53983FAA217DD134664A9E694138E9A6FDF
                                                                                                              SHA-256:E7D73C9323599320AFA243DB5313F1A55ADFC34EDE66A4A656CA9172BF3C273D
                                                                                                              SHA-512:332A6BA6D1923A020DDB36E6E6FA80141B737ECC51EE52EE0D147B85DBC95DD3E97DA20083EAB3F5218DD9F4CA37DA986D35989F251F72C2512A42CBB6B462B9
                                                                                                              Malicious:false
                                                                                                              Preview:@echo off..@cd /d %~dp0..echo Removing TAP driver.....tapinstall.exe remove tap0901..echo TAP Driver Uninstall completed successfully!..exit..

                                                                                                              C:\Program Files\FastestVPN\Resources\driver\windows\amd64\OemVista.inf (copy)

                                                                                                              Download File
                                                                                                              Process:C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmp
                                                                                                              File Type:Windows setup INFormation
                                                                                                              Category:dropped
                                                                                                              Size (bytes):7537
                                                                                                              Entropy (8bit):5.046488463217706
                                                                                                              Encrypted:false
                                                                                                              SSDEEP:192:wr8tW9yCTi3K4vlQd22bjR+iAUC7bdP+io3DcNSj6jvKFkinuEQTXvzLd4Z:LWlGMdkxzo3DcNSj6jvKFkinuEQTXvzq
                                                                                                              MD5:50D29CA2E3DDB8A696923420EC2AC4FA
                                                                                                              SHA1:D85F4E65FE10F13DED1780DDBD074EDFC75F2D25
                                                                                                              SHA-256:817DFF7F4944A255A0A33B8D74EB60A755D8D268CC7AFD46FCE41E102E0A004B
                                                                                                              SHA-512:03778A9CDDD23639C88E24BB5D0446DA3A400BB6B3321FB35887CD23D88D0F7AD3FE911642CC7F8D16D29CD9E42106851B0028379E8DBCB3C6721C238FC4A0D3
                                                                                                              Malicious:false
                                                                                                              Preview:; ****************************************************************************..; * Copyright (C) 2002-2014 OpenVPN Technologies, Inc. *..; * This program is free software; you can redistribute it and/or modify *..; * it under the terms of the GNU General Public License version 2 *..; * as published by the Free Software Foundation. *..; ****************************************************************************....; SYNTAX CHECKER..; cd \WINDDK\3790\tools\chkinf..; chkinf c:\src\openvpn\tap-win32\i386\oemvista.inf..; OUTPUT -> file:///c:/WINDDK/3790/tools/chkinf/htm/c%23+src+openvpn+tap-win32+i386+__OemWin2k.htm....; INSTALL/REMOVE DRIVER..; tapinstall install OemVista.inf tapoas..; tapinstall update OemVista.inf tapoas..; tapinstall remove tapoas....;*********************************************************..; Note to Developers:..;..; If you are bundling the TAP-Windows driver with your app,..; you should try

                                                                                                              C:\Program Files\FastestVPN\Resources\driver\windows\amd64\install_tap.bat (copy)

                                                                                                              Download File
                                                                                                              Process:C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmp
                                                                                                              File Type:DOS batch file, ASCII text, with CRLF line terminators
                                                                                                              Category:dropped
                                                                                                              Size (bytes):228
                                                                                                              Entropy (8bit):4.832057381123706
                                                                                                              Encrypted:false
                                                                                                              SSDEEP:6:hiPFvPuaYkVVkZ0BNLllYYLV3GZ0Q/RLQ8NGN8BP:E9HuaYcyZcNLllYbZh/a8NGNc
                                                                                                              MD5:939DFFC36D36E4C85EE6703C812987E5
                                                                                                              SHA1:3BA5F451B1F5C269B4F51E847DA79A3C619CB9C9
                                                                                                              SHA-256:843C2DFB5FE8DFE7C5266F8F79D1E0AC0BA3E40D5C883D4AF879B6F273B7499E
                                                                                                              SHA-512:8958432897981533C2822AC7355D56FC490EB89157423FAA5DF13A5EC00E75A9E791A3ECF478561C3B13988C553FD739FD2047C37EF91972DBF61AB55D475314
                                                                                                              Malicious:false
                                                                                                              Preview:@echo off..@cd /d %~dp0..echo Removing old TAP driver.....tapinstall.exe remove tap0901 ..echo Installing TAP driver.....tapinstall.exe install OemVista.inf tap0901 ..echo TAP Driver Re-Installation completed successfully!..exit

                                                                                                              C:\Program Files\FastestVPN\Resources\driver\windows\amd64\is-9R4TG.tmp

                                                                                                              Download File
                                                                                                              Process:C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmp
                                                                                                              File Type:PE32+ executable (console) x86-64, for MS Windows
                                                                                                              Category:dropped
                                                                                                              Size (bytes):498504
                                                                                                              Entropy (8bit):6.313132779768202
                                                                                                              Encrypted:false
                                                                                                              SSDEEP:3072:iVF7vR03+4YnfLU6wXnSmZb3lKm34AJ9Qvtk1Ai8mTnu5gtZXqg7VcoyUyHi6/Cz:iVXU/3TNfAkTnrZqkyh/agGKwNdUo15
                                                                                                              MD5:F19CFFFF76FF48E98F060A563DD8345B
                                                                                                              SHA1:C77F3FE9FFBA02DE288661FBB66656791196EDBC
                                                                                                              SHA-256:16D1FF6409065D9C0BC50FC2ADE61B3299A141CF2553749D8891BEDBEA43DE70
                                                                                                              SHA-512:0D4A53FA4B0D4FF71AF1FFF5888005570404BF5309942F477B1D754073F6D200ABADE20DAAFFA3FB6DA55F2B23588CA439273BD9268257B83B00F973B7B61841
                                                                                                              Malicious:false
                                                                                                              Antivirus:
                                                                                                              • Antivirus: ReversingLabs, Detection: 0%
                                                                                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......N....cv..cv..cv.Q.r..cv.Q.u..cv.Q.s..cv...s.#cv...r..cv...u..cv.Q.w..cv..cw..cv.~.s..cv.~....cv..c...cv.~.t..cv.Rich.cv.................PE..d....z.].........."......*...d.......z.........@..........................................`..................................................S..x............... L...x..H#......D.......T............................................@...............................text....).......*.................. ..`.rdata...%...@...&..................@..@.data....(...p.......T..............@....pdata.. L.......N...d..............@..@_RDATA..............................@..@.rsrc...............................@..@.reloc..D............n..............@..B................................................................................................................................................................................................

                                                                                                              C:\Program Files\FastestVPN\Resources\driver\windows\amd64\is-C4BRK.tmp

                                                                                                              Download File
                                                                                                              Process:C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmp
                                                                                                              File Type:DOS batch file, ASCII text, with CRLF line terminators
                                                                                                              Category:dropped
                                                                                                              Size (bytes):142
                                                                                                              Entropy (8bit):4.838122400792552
                                                                                                              Encrypted:false
                                                                                                              SSDEEP:3:mKDD2G2FuyPuCkjLoOMXrHt9QVVkUoYmdFwLMiREl32AGN8BvAOA:hiPFvPullYkVVkxYmQLNREVNGN8B6
                                                                                                              MD5:012961E4DD4402DA78BC174AF09B77F9
                                                                                                              SHA1:900CA53983FAA217DD134664A9E694138E9A6FDF
                                                                                                              SHA-256:E7D73C9323599320AFA243DB5313F1A55ADFC34EDE66A4A656CA9172BF3C273D
                                                                                                              SHA-512:332A6BA6D1923A020DDB36E6E6FA80141B737ECC51EE52EE0D147B85DBC95DD3E97DA20083EAB3F5218DD9F4CA37DA986D35989F251F72C2512A42CBB6B462B9
                                                                                                              Malicious:false
                                                                                                              Preview:@echo off..@cd /d %~dp0..echo Removing TAP driver.....tapinstall.exe remove tap0901..echo TAP Driver Uninstall completed successfully!..exit..

                                                                                                              C:\Program Files\FastestVPN\Resources\driver\windows\amd64\is-HM6P4.tmp

                                                                                                              Download File
                                                                                                              Process:C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmp
                                                                                                              File Type:PE32+ executable (native) x86-64, for MS Windows
                                                                                                              Category:dropped
                                                                                                              Size (bytes):39384
                                                                                                              Entropy (8bit):6.220766637489946
                                                                                                              Encrypted:false
                                                                                                              SSDEEP:768:7CxLEO/+ApBG35KBOXZZoZmTf11a+uiExMFYQjEPKgz:NCI46R1a+jExMFFjWR
                                                                                                              MD5:2CCA8DC5DA7F197C8C97A2EEBCBFA908
                                                                                                              SHA1:1A463168F91A6AE254A3E99CE2691F9E7DBC2D46
                                                                                                              SHA-256:AA1EA00EA7D1FD8E404FB5FEFF948CFB86642F803BDF23D8262B8A0C1151B643
                                                                                                              SHA-512:AFBF92EA4A3C21048DC25FDC59779A0F20D6687CE9B2D0291268ED2D82A7020595AF2633EAE8623706162C36B24F6E8E70FA73F9D1088E2AB91BA8EAFB8E948F
                                                                                                              Malicious:false
                                                                                                              Antivirus:
                                                                                                              • Antivirus: ReversingLabs, Detection: 0%
                                                                                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........~..[...[...[....w..Z....w..^...[...m....w.._....w..^.../t..Q.../t..Z.../t..Z...Rich[...........................PE..d....z.].........."......Z.....................@....................................:.....`A....................................................<.......X....p..H....x...!...........R..8............................S...............P...............................text...W>.......@.................. ..h.rdata..|....P.......D..............@..H.data........`.......P..............@....pdata..H....p.......R..............@..HPAGE.................V.............. ..`INIT.................d.............. ..b.rsrc...X............p..............@..B.reloc...............v..............@..B................................................................................................................................................................................

                                                                                                              C:\Program Files\FastestVPN\Resources\driver\windows\amd64\is-JEVOC.tmp

                                                                                                              Download File
                                                                                                              Process:C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmp
                                                                                                              File Type:DOS batch file, ASCII text, with CRLF line terminators
                                                                                                              Category:dropped
                                                                                                              Size (bytes):228
                                                                                                              Entropy (8bit):4.832057381123706
                                                                                                              Encrypted:false
                                                                                                              SSDEEP:6:hiPFvPuaYkVVkZ0BNLllYYLV3GZ0Q/RLQ8NGN8BP:E9HuaYcyZcNLllYbZh/a8NGNc
                                                                                                              MD5:939DFFC36D36E4C85EE6703C812987E5
                                                                                                              SHA1:3BA5F451B1F5C269B4F51E847DA79A3C619CB9C9
                                                                                                              SHA-256:843C2DFB5FE8DFE7C5266F8F79D1E0AC0BA3E40D5C883D4AF879B6F273B7499E
                                                                                                              SHA-512:8958432897981533C2822AC7355D56FC490EB89157423FAA5DF13A5EC00E75A9E791A3ECF478561C3B13988C553FD739FD2047C37EF91972DBF61AB55D475314
                                                                                                              Malicious:false
                                                                                                              Preview:@echo off..@cd /d %~dp0..echo Removing old TAP driver.....tapinstall.exe remove tap0901 ..echo Installing TAP driver.....tapinstall.exe install OemVista.inf tap0901 ..echo TAP Driver Re-Installation completed successfully!..exit

                                                                                                              C:\Program Files\FastestVPN\Resources\driver\windows\amd64\is-K5BF2.tmp

                                                                                                              Download File
                                                                                                              Process:C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmp
                                                                                                              File Type:Windows setup INFormation
                                                                                                              Category:dropped
                                                                                                              Size (bytes):7537
                                                                                                              Entropy (8bit):5.046488463217706
                                                                                                              Encrypted:false
                                                                                                              SSDEEP:192:wr8tW9yCTi3K4vlQd22bjR+iAUC7bdP+io3DcNSj6jvKFkinuEQTXvzLd4Z:LWlGMdkxzo3DcNSj6jvKFkinuEQTXvzq
                                                                                                              MD5:50D29CA2E3DDB8A696923420EC2AC4FA
                                                                                                              SHA1:D85F4E65FE10F13DED1780DDBD074EDFC75F2D25
                                                                                                              SHA-256:817DFF7F4944A255A0A33B8D74EB60A755D8D268CC7AFD46FCE41E102E0A004B
                                                                                                              SHA-512:03778A9CDDD23639C88E24BB5D0446DA3A400BB6B3321FB35887CD23D88D0F7AD3FE911642CC7F8D16D29CD9E42106851B0028379E8DBCB3C6721C238FC4A0D3
                                                                                                              Malicious:false
                                                                                                              Preview:; ****************************************************************************..; * Copyright (C) 2002-2014 OpenVPN Technologies, Inc. *..; * This program is free software; you can redistribute it and/or modify *..; * it under the terms of the GNU General Public License version 2 *..; * as published by the Free Software Foundation. *..; ****************************************************************************....; SYNTAX CHECKER..; cd \WINDDK\3790\tools\chkinf..; chkinf c:\src\openvpn\tap-win32\i386\oemvista.inf..; OUTPUT -> file:///c:/WINDDK/3790/tools/chkinf/htm/c%23+src+openvpn+tap-win32+i386+__OemWin2k.htm....; INSTALL/REMOVE DRIVER..; tapinstall install OemVista.inf tapoas..; tapinstall update OemVista.inf tapoas..; tapinstall remove tapoas....;*********************************************************..; Note to Developers:..;..; If you are bundling the TAP-Windows driver with your app,..; you should try

                                                                                                              C:\Program Files\FastestVPN\Resources\driver\windows\amd64\is-PS4TM.tmp

                                                                                                              Download File
                                                                                                              Process:C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmp
                                                                                                              File Type:data
                                                                                                              Category:dropped
                                                                                                              Size (bytes):10042
                                                                                                              Entropy (8bit):7.139091215265505
                                                                                                              Encrypted:false
                                                                                                              SSDEEP:192:rrIa34E9odZubhd95wRLeOup+ZscF8Bd1LEqsa9sgfxIZH54o:nCZYQA9+ZsHLEhDgf2h54o
                                                                                                              MD5:685D08D5E2A2450648A40B518E2046FC
                                                                                                              SHA1:D99E38968DE1CA1850971A2B81BFDAB49626AAED
                                                                                                              SHA-256:56A658934ACC55AD665D685AE05913B4710E053A8FD385C0798B96041DA161B2
                                                                                                              SHA-512:619D08317328B351FEEA51C08C57B4704EEA0A92836D6ED3BE850478EA6A9C2A14DFA30C763581608E16983010AB2E12B51E3BEC68F3480EE45A04C0E857FDB7
                                                                                                              Malicious:false
                                                                                                              Preview:0.'6..*.H........''0.'#...1.0...`.H.e......0..Z..+.....7.....K0..G0...+.....7........N.u.C...y].7...191031061137Z0...+.....7.....0...0....R0.5.1.7.3.7.1.7.7.5.6.C.F.1.9.7.8.D.3.7.8.6.4.5.A.D.A.C.6.D.6.F.3.3.5.3.C.7.C.B...1../0:..+.....7...1,0*...F.i.l.e........t.a.p.0.9.0.1...s.y.s...0>..+.....7...100....O.S.A.t.t.r........2.:.6...0.,.2.:.6...1...0M..+.....7...1?0=0...+.....7...0...........0!0...+..........7.ul.7.E..mo3S..0b..+.....7...1T0R.L.{.C.6.8.9.A.A.B.8.-.8.E.7.8.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}....0....RD.8.5.F.4.E.6.5.F.E.1.0.F.1.3.D.E.D.1.7.8.0.D.D.B.D.0.7.4.E.D.F.C.7.5.F.2.D.2.5...1..)0<..+.....7...1.0,...F.i.l.e........o.e.m.v.i.s.t.a...i.n.f...0>..+.....7...100....O.S.A.t.t.r........2.:.6...0.,.2.:.6...1...0E..+.....7...17050...+.....7.......0!0...+........._Ne...=.....N.._-%0b..+.....7...1T0R.L.{.D.E.3.5.1.A.4.2.-.8.E.5.9.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}.......0..0v..+.....7....h0f...O.S.......XV.i.s.t.a.X.6.4.,.S.e.r.v.e.r.2.0.0.8.X.6.4.,

                                                                                                              C:\Program Files\FastestVPN\Resources\driver\windows\amd64\tap0901.cat (copy)

                                                                                                              Download File
                                                                                                              Process:C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmp
                                                                                                              File Type:data
                                                                                                              Category:dropped
                                                                                                              Size (bytes):10042
                                                                                                              Entropy (8bit):7.139091215265505
                                                                                                              Encrypted:false
                                                                                                              SSDEEP:192:rrIa34E9odZubhd95wRLeOup+ZscF8Bd1LEqsa9sgfxIZH54o:nCZYQA9+ZsHLEhDgf2h54o
                                                                                                              MD5:685D08D5E2A2450648A40B518E2046FC
                                                                                                              SHA1:D99E38968DE1CA1850971A2B81BFDAB49626AAED
                                                                                                              SHA-256:56A658934ACC55AD665D685AE05913B4710E053A8FD385C0798B96041DA161B2
                                                                                                              SHA-512:619D08317328B351FEEA51C08C57B4704EEA0A92836D6ED3BE850478EA6A9C2A14DFA30C763581608E16983010AB2E12B51E3BEC68F3480EE45A04C0E857FDB7
                                                                                                              Malicious:false
                                                                                                              Preview:0.'6..*.H........''0.'#...1.0...`.H.e......0..Z..+.....7.....K0..G0...+.....7........N.u.C...y].7...191031061137Z0...+.....7.....0...0....R0.5.1.7.3.7.1.7.7.5.6.C.F.1.9.7.8.D.3.7.8.6.4.5.A.D.A.C.6.D.6.F.3.3.5.3.C.7.C.B...1../0:..+.....7...1,0*...F.i.l.e........t.a.p.0.9.0.1...s.y.s...0>..+.....7...100....O.S.A.t.t.r........2.:.6...0.,.2.:.6...1...0M..+.....7...1?0=0...+.....7...0...........0!0...+..........7.ul.7.E..mo3S..0b..+.....7...1T0R.L.{.C.6.8.9.A.A.B.8.-.8.E.7.8.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}....0....RD.8.5.F.4.E.6.5.F.E.1.0.F.1.3.D.E.D.1.7.8.0.D.D.B.D.0.7.4.E.D.F.C.7.5.F.2.D.2.5...1..)0<..+.....7...1.0,...F.i.l.e........o.e.m.v.i.s.t.a...i.n.f...0>..+.....7...100....O.S.A.t.t.r........2.:.6...0.,.2.:.6...1...0E..+.....7...17050...+.....7.......0!0...+........._Ne...=.....N.._-%0b..+.....7...1T0R.L.{.D.E.3.5.1.A.4.2.-.8.E.5.9.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}.......0..0v..+.....7....h0f...O.S.......XV.i.s.t.a.X.6.4.,.S.e.r.v.e.r.2.0.0.8.X.6.4.,

                                                                                                              C:\Program Files\FastestVPN\Resources\driver\windows\amd64\tap0901.sys (copy)

                                                                                                              Download File
                                                                                                              Process:C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmp
                                                                                                              File Type:PE32+ executable (native) x86-64, for MS Windows
                                                                                                              Category:dropped
                                                                                                              Size (bytes):39384
                                                                                                              Entropy (8bit):6.220766637489946
                                                                                                              Encrypted:false
                                                                                                              SSDEEP:768:7CxLEO/+ApBG35KBOXZZoZmTf11a+uiExMFYQjEPKgz:NCI46R1a+jExMFFjWR
                                                                                                              MD5:2CCA8DC5DA7F197C8C97A2EEBCBFA908
                                                                                                              SHA1:1A463168F91A6AE254A3E99CE2691F9E7DBC2D46
                                                                                                              SHA-256:AA1EA00EA7D1FD8E404FB5FEFF948CFB86642F803BDF23D8262B8A0C1151B643
                                                                                                              SHA-512:AFBF92EA4A3C21048DC25FDC59779A0F20D6687CE9B2D0291268ED2D82A7020595AF2633EAE8623706162C36B24F6E8E70FA73F9D1088E2AB91BA8EAFB8E948F
                                                                                                              Malicious:false
                                                                                                              Antivirus:
                                                                                                              • Antivirus: ReversingLabs, Detection: 0%
                                                                                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........~..[...[...[....w..Z....w..^...[...m....w.._....w..^.../t..Q.../t..Z.../t..Z...Rich[...........................PE..d....z.].........."......Z.....................@....................................:.....`A....................................................<.......X....p..H....x...!...........R..8............................S...............P...............................text...W>.......@.................. ..h.rdata..|....P.......D..............@..H.data........`.......P..............@....pdata..H....p.......R..............@..HPAGE.................V.............. ..`INIT.................d.............. ..b.rsrc...X............p..............@..B.reloc...............v..............@..B................................................................................................................................................................................

                                                                                                              C:\Program Files\FastestVPN\Resources\driver\windows\amd64\tapinstall.exe (copy)

                                                                                                              Download File
                                                                                                              Process:C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmp
                                                                                                              File Type:PE32+ executable (console) x86-64, for MS Windows
                                                                                                              Category:dropped
                                                                                                              Size (bytes):498504
                                                                                                              Entropy (8bit):6.313132779768202
                                                                                                              Encrypted:false
                                                                                                              SSDEEP:3072:iVF7vR03+4YnfLU6wXnSmZb3lKm34AJ9Qvtk1Ai8mTnu5gtZXqg7VcoyUyHi6/Cz:iVXU/3TNfAkTnrZqkyh/agGKwNdUo15
                                                                                                              MD5:F19CFFFF76FF48E98F060A563DD8345B
                                                                                                              SHA1:C77F3FE9FFBA02DE288661FBB66656791196EDBC
                                                                                                              SHA-256:16D1FF6409065D9C0BC50FC2ADE61B3299A141CF2553749D8891BEDBEA43DE70
                                                                                                              SHA-512:0D4A53FA4B0D4FF71AF1FFF5888005570404BF5309942F477B1D754073F6D200ABADE20DAAFFA3FB6DA55F2B23588CA439273BD9268257B83B00F973B7B61841
                                                                                                              Malicious:false
                                                                                                              Antivirus:
                                                                                                              • Antivirus: ReversingLabs, Detection: 0%
                                                                                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......N....cv..cv..cv.Q.r..cv.Q.u..cv.Q.s..cv...s.#cv...r..cv...u..cv.Q.w..cv..cw..cv.~.s..cv.~....cv..c...cv.~.t..cv.Rich.cv.................PE..d....z.].........."......*...d.......z.........@..........................................`..................................................S..x............... L...x..H#......D.......T............................................@...............................text....).......*.................. ..`.rdata...%...@...&..................@..@.data....(...p.......T..............@....pdata.. L.......N...d..............@..@_RDATA..............................@..@.rsrc...............................@..@.reloc..D............n..............@..B................................................................................................................................................................................................

                                                                                                              C:\Program Files\FastestVPN\Resources\driver\windows\amd64\uninstall_tap.bat (copy)

                                                                                                              Download File
                                                                                                              Process:C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmp
                                                                                                              File Type:DOS batch file, ASCII text, with CRLF line terminators
                                                                                                              Category:dropped
                                                                                                              Size (bytes):142
                                                                                                              Entropy (8bit):4.838122400792552
                                                                                                              Encrypted:false
                                                                                                              SSDEEP:3:mKDD2G2FuyPuCkjLoOMXrHt9QVVkUoYmdFwLMiREl32AGN8BvAOA:hiPFvPullYkVVkxYmQLNREVNGN8B6
                                                                                                              MD5:012961E4DD4402DA78BC174AF09B77F9
                                                                                                              SHA1:900CA53983FAA217DD134664A9E694138E9A6FDF
                                                                                                              SHA-256:E7D73C9323599320AFA243DB5313F1A55ADFC34EDE66A4A656CA9172BF3C273D
                                                                                                              SHA-512:332A6BA6D1923A020DDB36E6E6FA80141B737ECC51EE52EE0D147B85DBC95DD3E97DA20083EAB3F5218DD9F4CA37DA986D35989F251F72C2512A42CBB6B462B9
                                                                                                              Malicious:false
                                                                                                              Preview:@echo off..@cd /d %~dp0..echo Removing TAP driver.....tapinstall.exe remove tap0901..echo TAP Driver Uninstall completed successfully!..exit..

                                                                                                              C:\Program Files\FastestVPN\Resources\driver\windows\i386\OemVista.inf (copy)

                                                                                                              Download File
                                                                                                              Process:C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmp
                                                                                                              File Type:Windows setup INFormation
                                                                                                              Category:dropped
                                                                                                              Size (bytes):7533
                                                                                                              Entropy (8bit):5.046821594517318
                                                                                                              Encrypted:false
                                                                                                              SSDEEP:192:wr8tW9yCTi3K4vlP2bjR+iAUC7bdP+io3DcNSj6jvKFkinuEQTXvzLd4Z:LWlGTxzo3DcNSj6jvKFkinuEQTXvzaZ
                                                                                                              MD5:3A541F2BF9842CDE6F0C95E83DE14FFA
                                                                                                              SHA1:12C074F03AA19968893F2BE48FDEF42A293B7EE4
                                                                                                              SHA-256:598EAD8481136AB0C8C99E67CA30841DB3C32417B45D6FEEDE04802DB0C4C320
                                                                                                              SHA-512:F060851D26E978AFA6AC632E74C221FB837FDEEE7752762BEE210D7BE144195A27514E108EF8C19A642BC03486E94721BD1B9D4AC69DB26BD892DCAA7894D3D2
                                                                                                              Malicious:false
                                                                                                              Preview:; ****************************************************************************..; * Copyright (C) 2002-2014 OpenVPN Technologies, Inc. *..; * This program is free software; you can redistribute it and/or modify *..; * it under the terms of the GNU General Public License version 2 *..; * as published by the Free Software Foundation. *..; ****************************************************************************....; SYNTAX CHECKER..; cd \WINDDK\3790\tools\chkinf..; chkinf c:\src\openvpn\tap-win32\i386\oemvista.inf..; OUTPUT -> file:///c:/WINDDK/3790/tools/chkinf/htm/c%23+src+openvpn+tap-win32+i386+__OemWin2k.htm....; INSTALL/REMOVE DRIVER..; tapinstall install OemVista.inf tapoas..; tapinstall update OemVista.inf tapoas..; tapinstall remove tapoas....;*********************************************************..; Note to Developers:..;..; If you are bundling the TAP-Windows driver with your app,..; you should try

                                                                                                              C:\Program Files\FastestVPN\Resources\driver\windows\i386\install_tap.bat (copy)

                                                                                                              Download File
                                                                                                              Process:C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmp
                                                                                                              File Type:DOS batch file, ASCII text, with CRLF line terminators
                                                                                                              Category:dropped
                                                                                                              Size (bytes):228
                                                                                                              Entropy (8bit):4.832057381123706
                                                                                                              Encrypted:false
                                                                                                              SSDEEP:6:hiPFvPuaYkVVkZ0BNLllYYLV3GZ0Q/RLQ8NGN8BP:E9HuaYcyZcNLllYbZh/a8NGNc
                                                                                                              MD5:939DFFC36D36E4C85EE6703C812987E5
                                                                                                              SHA1:3BA5F451B1F5C269B4F51E847DA79A3C619CB9C9
                                                                                                              SHA-256:843C2DFB5FE8DFE7C5266F8F79D1E0AC0BA3E40D5C883D4AF879B6F273B7499E
                                                                                                              SHA-512:8958432897981533C2822AC7355D56FC490EB89157423FAA5DF13A5EC00E75A9E791A3ECF478561C3B13988C553FD739FD2047C37EF91972DBF61AB55D475314
                                                                                                              Malicious:false
                                                                                                              Preview:@echo off..@cd /d %~dp0..echo Removing old TAP driver.....tapinstall.exe remove tap0901 ..echo Installing TAP driver.....tapinstall.exe install OemVista.inf tap0901 ..echo TAP Driver Re-Installation completed successfully!..exit

                                                                                                              C:\Program Files\FastestVPN\Resources\driver\windows\i386\is-3L7RG.tmp

                                                                                                              Download File
                                                                                                              Process:C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmp
                                                                                                              File Type:DOS batch file, ASCII text, with CRLF line terminators
                                                                                                              Category:dropped
                                                                                                              Size (bytes):228
                                                                                                              Entropy (8bit):4.832057381123706
                                                                                                              Encrypted:false
                                                                                                              SSDEEP:6:hiPFvPuaYkVVkZ0BNLllYYLV3GZ0Q/RLQ8NGN8BP:E9HuaYcyZcNLllYbZh/a8NGNc
                                                                                                              MD5:939DFFC36D36E4C85EE6703C812987E5
                                                                                                              SHA1:3BA5F451B1F5C269B4F51E847DA79A3C619CB9C9
                                                                                                              SHA-256:843C2DFB5FE8DFE7C5266F8F79D1E0AC0BA3E40D5C883D4AF879B6F273B7499E
                                                                                                              SHA-512:8958432897981533C2822AC7355D56FC490EB89157423FAA5DF13A5EC00E75A9E791A3ECF478561C3B13988C553FD739FD2047C37EF91972DBF61AB55D475314
                                                                                                              Malicious:false
                                                                                                              Preview:@echo off..@cd /d %~dp0..echo Removing old TAP driver.....tapinstall.exe remove tap0901 ..echo Installing TAP driver.....tapinstall.exe install OemVista.inf tap0901 ..echo TAP Driver Re-Installation completed successfully!..exit

                                                                                                              C:\Program Files\FastestVPN\Resources\driver\windows\i386\is-6S3SU.tmp

                                                                                                              Download File
                                                                                                              Process:C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmp
                                                                                                              File Type:DOS batch file, ASCII text, with CRLF line terminators
                                                                                                              Category:dropped
                                                                                                              Size (bytes):142
                                                                                                              Entropy (8bit):4.838122400792552
                                                                                                              Encrypted:false
                                                                                                              SSDEEP:3:mKDD2G2FuyPuCkjLoOMXrHt9QVVkUoYmdFwLMiREl32AGN8BvAOA:hiPFvPullYkVVkxYmQLNREVNGN8B6
                                                                                                              MD5:012961E4DD4402DA78BC174AF09B77F9
                                                                                                              SHA1:900CA53983FAA217DD134664A9E694138E9A6FDF
                                                                                                              SHA-256:E7D73C9323599320AFA243DB5313F1A55ADFC34EDE66A4A656CA9172BF3C273D
                                                                                                              SHA-512:332A6BA6D1923A020DDB36E6E6FA80141B737ECC51EE52EE0D147B85DBC95DD3E97DA20083EAB3F5218DD9F4CA37DA986D35989F251F72C2512A42CBB6B462B9
                                                                                                              Malicious:false
                                                                                                              Preview:@echo off..@cd /d %~dp0..echo Removing TAP driver.....tapinstall.exe remove tap0901..echo TAP Driver Uninstall completed successfully!..exit..

                                                                                                              C:\Program Files\FastestVPN\Resources\driver\windows\i386\is-C8Q95.tmp

                                                                                                              Download File
                                                                                                              Process:C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmp
                                                                                                              File Type:Windows setup INFormation
                                                                                                              Category:dropped
                                                                                                              Size (bytes):7533
                                                                                                              Entropy (8bit):5.046821594517318
                                                                                                              Encrypted:false
                                                                                                              SSDEEP:192:wr8tW9yCTi3K4vlP2bjR+iAUC7bdP+io3DcNSj6jvKFkinuEQTXvzLd4Z:LWlGTxzo3DcNSj6jvKFkinuEQTXvzaZ
                                                                                                              MD5:3A541F2BF9842CDE6F0C95E83DE14FFA
                                                                                                              SHA1:12C074F03AA19968893F2BE48FDEF42A293B7EE4
                                                                                                              SHA-256:598EAD8481136AB0C8C99E67CA30841DB3C32417B45D6FEEDE04802DB0C4C320
                                                                                                              SHA-512:F060851D26E978AFA6AC632E74C221FB837FDEEE7752762BEE210D7BE144195A27514E108EF8C19A642BC03486E94721BD1B9D4AC69DB26BD892DCAA7894D3D2
                                                                                                              Malicious:false
                                                                                                              Preview:; ****************************************************************************..; * Copyright (C) 2002-2014 OpenVPN Technologies, Inc. *..; * This program is free software; you can redistribute it and/or modify *..; * it under the terms of the GNU General Public License version 2 *..; * as published by the Free Software Foundation. *..; ****************************************************************************....; SYNTAX CHECKER..; cd \WINDDK\3790\tools\chkinf..; chkinf c:\src\openvpn\tap-win32\i386\oemvista.inf..; OUTPUT -> file:///c:/WINDDK/3790/tools/chkinf/htm/c%23+src+openvpn+tap-win32+i386+__OemWin2k.htm....; INSTALL/REMOVE DRIVER..; tapinstall install OemVista.inf tapoas..; tapinstall update OemVista.inf tapoas..; tapinstall remove tapoas....;*********************************************************..; Note to Developers:..;..; If you are bundling the TAP-Windows driver with your app,..; you should try

                                                                                                              C:\Program Files\FastestVPN\Resources\driver\windows\i386\is-DP5T8.tmp

                                                                                                              Download File
                                                                                                              Process:C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmp
                                                                                                              File Type:PE32 executable (console) Intel 80386, for MS Windows
                                                                                                              Category:dropped
                                                                                                              Size (bytes):387400
                                                                                                              Entropy (8bit):6.458236487570103
                                                                                                              Encrypted:false
                                                                                                              SSDEEP:6144:UTksWxn+v8a7/e3uFm4uy6b1aptMtx1IAOrPdmB4SS4Vw3VTBZiA916NkW:Akska7m3uFm4uy6b10MtxnOrPdmBe3XE
                                                                                                              MD5:46F33BBA03FF35C0A777B5875E832559
                                                                                                              SHA1:C4B5487307DB1B715EDA5C233DBD346EF44ABF02
                                                                                                              SHA-256:72D329B11A240403A74990F7F05CDDA684F53FBFC1E45EE3E565E38000C6FDA1
                                                                                                              SHA-512:7130F9DEE420D2A377E3CDAE0C47D1F8446E2DA4E021274A15F4FD00583F79C0DBF05819216ABBAAE5493BF1CB1E4FA08EFA673CCDA1BC3A623BAEC828DFC413
                                                                                                              Malicious:false
                                                                                                              Antivirus:
                                                                                                              • Antivirus: ReversingLabs, Detection: 0%
                                                                                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........b...1...1...1..0...1..0{..1..0.1C.0..1C.0.1C.0.1..0...1...1b..1..0...1..p1...1...1...1..0...1Rich...1........PE..L....z.].................<..........`m.......P....@.................................~.....@.....................................x.......................H#.......$......T...........................(...@............P..h............................text....;.......<.................. ..`.rdata..J....P.......@..............@..@.data...l...........................@....rsrc...............................@..@.reloc...$.......&..................@..B........................................................................................................................................................................................................................................................................................................

                                                                                                              C:\Program Files\FastestVPN\Resources\driver\windows\i386\is-ESUKM.tmp

                                                                                                              Download File
                                                                                                              Process:C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmp
                                                                                                              File Type:data
                                                                                                              Category:dropped
                                                                                                              Size (bytes):10010
                                                                                                              Entropy (8bit):7.143392930093258
                                                                                                              Encrypted:false
                                                                                                              SSDEEP:192:bdOUGdndfdZubhd95wRLeOup+ZscF8Bd1LELx8a9sgfxIZH3:p7oFZYQA9+ZsHLE98Dgf2h3
                                                                                                              MD5:BEE546D1A9EE2F74F4C9B0A347DBAB7C
                                                                                                              SHA1:BB655AEDDFACE5C498DC8EC5A3E68685FDFE6D50
                                                                                                              SHA-256:DBC0D9D157718C90227D527A9BFC87C9135426A7A1A7C0ECD3F43825AAA2EE0E
                                                                                                              SHA-512:B68F5F6572BB881B116746AB1BF90AE1E16449E0797D482B1D5A551241ED37A30EF105AECA7B1CEB62CB38962B285D29159B9E68DC1BC3B457B2A14531A80F44
                                                                                                              Malicious:false
                                                                                                              Preview:0.'...*.H........'.0.'....1.0...`.H.e......0..:..+.....7.....+0..'0...+.....7.....\.6.D..E..Wm(.p...191031061137Z0...+.....7.....0...0....R1.2.C.0.7.4.F.0.3.A.A.1.9.9.6.8.8.9.3.F.2.B.E.4.8.F.D.E.F.4.2.A.2.9.3.B.7.E.E.4...1..)0<..+.....7...1.0,...F.i.l.e........o.e.m.v.i.s.t.a...i.n.f...0>..+.....7...100....O.S.A.t.t.r........2.:.6...0.,.2.:.6...1...0E..+.....7...17050...+.....7.......0!0...+..........t.:..h.?+...*);~.0b..+.....7...1T0R.L.{.D.E.3.5.1.A.4.2.-.8.E.5.9.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}....0....RA.F.B.A.B.0.D.E.D.C.D.F.C.2.1.F.3.6.4.E.D.0.2.4.6.9.0.4.8.1.A.F.D.C.8.D.3.6.E.1...1../0:..+.....7...1,0*...F.i.l.e........t.a.p.0.9.0.1...s.y.s...0>..+.....7...100....O.S.A.t.t.r........2.:.6...0.,.2.:.6...1...0M..+.....7...1?0=0...+.....7...0...........0!0...+................6N.$i....6.0b..+.....7...1T0R.L.{.C.6.8.9.A.A.B.8.-.8.E.7.8.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}.......0..0V..+.....7....H0F...O.S.......8V.i.s.t.a.X.8.6.,.S.e.r.v.e.r.2.0.0.8.X.8.6.,

                                                                                                              C:\Program Files\FastestVPN\Resources\driver\windows\i386\is-LC5II.tmp

                                                                                                              Download File
                                                                                                              Process:C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmp
                                                                                                              File Type:PE32 executable (native) Intel 80386, for MS Windows
                                                                                                              Category:dropped
                                                                                                              Size (bytes):34264
                                                                                                              Entropy (8bit):6.451114076364161
                                                                                                              Encrypted:false
                                                                                                              SSDEEP:384:nToflu9IisjjMJvOA4hKtbAwut9l/AxkDur/MvBhLwI7PKA+bkxQJ7XakZSZ4dS5:nToBjjOOA4dR/uQvBbuALxQbagPKgzW
                                                                                                              MD5:EF55CAAABD0E13C304587D941C343F77
                                                                                                              SHA1:F0E323EF510E00FC925A7FB37C625D077FECA8A3
                                                                                                              SHA-256:A4E2E4194E15BC93A53FFAB121CCE22CC76EDBC18DFB83132A95F92C9220509F
                                                                                                              SHA-512:D2C61CCB73C90D26A4D39EBADE87A6F7F23CAA34B29AE14FFA08CA48A32086C6553CA12D38362B6179E82776F3D76F4B05FDD2238B5E7BE4FEEC98A4D8D52573
                                                                                                              Malicious:false
                                                                                                              Antivirus:
                                                                                                              • Antivirus: ReversingLabs, Detection: 0%
                                                                                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........C..."..."..."...J..."...J..."...J..."..."..."...J..."...I..."...I."...I..."..Rich."..................PE..L....z.].................N...................P....@.......................................@A....................................P.......X............d...!.......... R..8...........................XR..@............P...............................text....7.......8.................. ..h.rdata..,....P.......<..............@..H.data........`.......B..............@...PAGE....[....p.......D.............. ..`INIT....T............P.............. ..b.rsrc...X............Z..............@..B.reloc...............`..............@..B................................................................................................................................................................................................................................................

                                                                                                              C:\Program Files\FastestVPN\Resources\driver\windows\i386\tap0901.cat (copy)

                                                                                                              Download File
                                                                                                              Process:C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmp
                                                                                                              File Type:data
                                                                                                              Category:dropped
                                                                                                              Size (bytes):10010
                                                                                                              Entropy (8bit):7.143392930093258
                                                                                                              Encrypted:false
                                                                                                              SSDEEP:192:bdOUGdndfdZubhd95wRLeOup+ZscF8Bd1LELx8a9sgfxIZH3:p7oFZYQA9+ZsHLE98Dgf2h3
                                                                                                              MD5:BEE546D1A9EE2F74F4C9B0A347DBAB7C
                                                                                                              SHA1:BB655AEDDFACE5C498DC8EC5A3E68685FDFE6D50
                                                                                                              SHA-256:DBC0D9D157718C90227D527A9BFC87C9135426A7A1A7C0ECD3F43825AAA2EE0E
                                                                                                              SHA-512:B68F5F6572BB881B116746AB1BF90AE1E16449E0797D482B1D5A551241ED37A30EF105AECA7B1CEB62CB38962B285D29159B9E68DC1BC3B457B2A14531A80F44
                                                                                                              Malicious:false
                                                                                                              Preview:0.'...*.H........'.0.'....1.0...`.H.e......0..:..+.....7.....+0..'0...+.....7.....\.6.D..E..Wm(.p...191031061137Z0...+.....7.....0...0....R1.2.C.0.7.4.F.0.3.A.A.1.9.9.6.8.8.9.3.F.2.B.E.4.8.F.D.E.F.4.2.A.2.9.3.B.7.E.E.4...1..)0<..+.....7...1.0,...F.i.l.e........o.e.m.v.i.s.t.a...i.n.f...0>..+.....7...100....O.S.A.t.t.r........2.:.6...0.,.2.:.6...1...0E..+.....7...17050...+.....7.......0!0...+..........t.:..h.?+...*);~.0b..+.....7...1T0R.L.{.D.E.3.5.1.A.4.2.-.8.E.5.9.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}....0....RA.F.B.A.B.0.D.E.D.C.D.F.C.2.1.F.3.6.4.E.D.0.2.4.6.9.0.4.8.1.A.F.D.C.8.D.3.6.E.1...1../0:..+.....7...1,0*...F.i.l.e........t.a.p.0.9.0.1...s.y.s...0>..+.....7...100....O.S.A.t.t.r........2.:.6...0.,.2.:.6...1...0M..+.....7...1?0=0...+.....7...0...........0!0...+................6N.$i....6.0b..+.....7...1T0R.L.{.C.6.8.9.A.A.B.8.-.8.E.7.8.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}.......0..0V..+.....7....H0F...O.S.......8V.i.s.t.a.X.8.6.,.S.e.r.v.e.r.2.0.0.8.X.8.6.,

                                                                                                              C:\Program Files\FastestVPN\Resources\driver\windows\i386\tap0901.sys (copy)

                                                                                                              Download File
                                                                                                              Process:C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmp
                                                                                                              File Type:PE32 executable (native) Intel 80386, for MS Windows
                                                                                                              Category:dropped
                                                                                                              Size (bytes):34264
                                                                                                              Entropy (8bit):6.451114076364161
                                                                                                              Encrypted:false
                                                                                                              SSDEEP:384:nToflu9IisjjMJvOA4hKtbAwut9l/AxkDur/MvBhLwI7PKA+bkxQJ7XakZSZ4dS5:nToBjjOOA4dR/uQvBbuALxQbagPKgzW
                                                                                                              MD5:EF55CAAABD0E13C304587D941C343F77
                                                                                                              SHA1:F0E323EF510E00FC925A7FB37C625D077FECA8A3
                                                                                                              SHA-256:A4E2E4194E15BC93A53FFAB121CCE22CC76EDBC18DFB83132A95F92C9220509F
                                                                                                              SHA-512:D2C61CCB73C90D26A4D39EBADE87A6F7F23CAA34B29AE14FFA08CA48A32086C6553CA12D38362B6179E82776F3D76F4B05FDD2238B5E7BE4FEEC98A4D8D52573
                                                                                                              Malicious:false
                                                                                                              Antivirus:
                                                                                                              • Antivirus: ReversingLabs, Detection: 0%
                                                                                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........C..."..."..."...J..."...J..."...J..."..."..."...J..."...I..."...I."...I..."..Rich."..................PE..L....z.].................N...................P....@.......................................@A....................................P.......X............d...!.......... R..8...........................XR..@............P...............................text....7.......8.................. ..h.rdata..,....P.......<..............@..H.data........`.......B..............@...PAGE....[....p.......D.............. ..`INIT....T............P.............. ..b.rsrc...X............Z..............@..B.reloc...............`..............@..B................................................................................................................................................................................................................................................

                                                                                                              C:\Program Files\FastestVPN\Resources\driver\windows\i386\tapinstall.exe (copy)

                                                                                                              Download File
                                                                                                              Process:C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmp
                                                                                                              File Type:PE32 executable (console) Intel 80386, for MS Windows
                                                                                                              Category:dropped
                                                                                                              Size (bytes):387400
                                                                                                              Entropy (8bit):6.458236487570103
                                                                                                              Encrypted:false
                                                                                                              SSDEEP:6144:UTksWxn+v8a7/e3uFm4uy6b1aptMtx1IAOrPdmB4SS4Vw3VTBZiA916NkW:Akska7m3uFm4uy6b10MtxnOrPdmBe3XE
                                                                                                              MD5:46F33BBA03FF35C0A777B5875E832559
                                                                                                              SHA1:C4B5487307DB1B715EDA5C233DBD346EF44ABF02
                                                                                                              SHA-256:72D329B11A240403A74990F7F05CDDA684F53FBFC1E45EE3E565E38000C6FDA1
                                                                                                              SHA-512:7130F9DEE420D2A377E3CDAE0C47D1F8446E2DA4E021274A15F4FD00583F79C0DBF05819216ABBAAE5493BF1CB1E4FA08EFA673CCDA1BC3A623BAEC828DFC413
                                                                                                              Malicious:false
                                                                                                              Antivirus:
                                                                                                              • Antivirus: ReversingLabs, Detection: 0%
                                                                                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........b...1...1...1..0...1..0{..1..0.1C.0..1C.0.1C.0.1..0...1...1b..1..0...1..p1...1...1...1..0...1Rich...1........PE..L....z.].................<..........`m.......P....@.................................~.....@.....................................x.......................H#.......$......T...........................(...@............P..h............................text....;.......<.................. ..`.rdata..J....P.......@..............@..@.data...l...........................@....rsrc...............................@..@.reloc...$.......&..................@..B........................................................................................................................................................................................................................................................................................................

                                                                                                              C:\Program Files\FastestVPN\Resources\driver\windows\i386\uninstall_tap.bat (copy)

                                                                                                              Download File
                                                                                                              Process:C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmp
                                                                                                              File Type:DOS batch file, ASCII text, with CRLF line terminators
                                                                                                              Category:dropped
                                                                                                              Size (bytes):142
                                                                                                              Entropy (8bit):4.838122400792552
                                                                                                              Encrypted:false
                                                                                                              SSDEEP:3:mKDD2G2FuyPuCkjLoOMXrHt9QVVkUoYmdFwLMiREl32AGN8BvAOA:hiPFvPullYkVVkxYmQLNREVNGN8B6
                                                                                                              MD5:012961E4DD4402DA78BC174AF09B77F9
                                                                                                              SHA1:900CA53983FAA217DD134664A9E694138E9A6FDF
                                                                                                              SHA-256:E7D73C9323599320AFA243DB5313F1A55ADFC34EDE66A4A656CA9172BF3C273D
                                                                                                              SHA-512:332A6BA6D1923A020DDB36E6E6FA80141B737ECC51EE52EE0D147B85DBC95DD3E97DA20083EAB3F5218DD9F4CA37DA986D35989F251F72C2512A42CBB6B462B9
                                                                                                              Malicious:false
                                                                                                              Preview:@echo off..@cd /d %~dp0..echo Removing TAP driver.....tapinstall.exe remove tap0901..echo TAP Driver Uninstall completed successfully!..exit..

                                                                                                              C:\Program Files\FastestVPN\Resources\is-2225N.tmp

                                                                                                              Download File
                                                                                                              Process:C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmp
                                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                                              Category:dropped
                                                                                                              Size (bytes):359
                                                                                                              Entropy (8bit):5.09733291062762
                                                                                                              Encrypted:false
                                                                                                              SSDEEP:6:i4Z2TyUdkl9WUyUdkwc1+XMoHkyUdk3LASg0TqeXMFXA98XfFZ/FvjCzISMOmEm:jZELklIULktkXxELk35q0MhA98vFZ/FV
                                                                                                              MD5:777B3CBF81DDD8B238BDEDDDEA17AFED
                                                                                                              SHA1:C72F46715DCBC9BDA1E2BEEAC8AF2A64E7B48D08
                                                                                                              SHA-256:DACE14B4A5268728E67A9E78D8F0877F4C87F6B87DDD40DFF28A11E9E42945CF
                                                                                                              SHA-512:5C6D302F93381EBF65ADD3DAA0EB4813270C5D9A042AD9B8A48A575ADC4E751D3834292BB61AEF6A5458036AE6E3C83C8EDFAE5CF828D81317ACAE6675B8E619
                                                                                                              Malicious:false
                                                                                                              Preview:If (-NOT ([Security.Principal.WindowsPrincipal][Security.Principal.WindowsIdentity]::GetCurrent()).IsInRole([Security.Principal.WindowsBuiltInRole] "Administrator"))..{ ..$arguments = "& '" + $myinvocation.mycommand.definition + "'"..Start-Process powershell -Verb runAs -ArgumentList $arguments..Break..}.. Set-NetConnectionProfile -NetworkCategory Private

                                                                                                              C:\Program Files\FastestVPN\Resources\is-2FSRR.tmp

                                                                                                              Download File
                                                                                                              Process:C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmp
                                                                                                              File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                              Category:dropped
                                                                                                              Size (bytes):700040
                                                                                                              Entropy (8bit):5.552155208041958
                                                                                                              Encrypted:false
                                                                                                              SSDEEP:12288:UB4x/cH7gueaxFi00ZoPqETRzRnYhUpfakLaugPoDhTMY98c8mvVfU2lvzpi/O:avziRZoXuugCtD8JmvNU2lvzpiG
                                                                                                              MD5:6EE5C92E2918B27974086A6F24D79043
                                                                                                              SHA1:40595B75A513BBF1BE16780784E13EFDAD2E40C7
                                                                                                              SHA-256:86F3A19221C710CFF12607FEB00D8CD0AF932873430AD1B59C990593010EC3CF
                                                                                                              SHA-512:F07BBE5D367D6F7474E08507F3827BDCAC5503673F2027CA139303FA573F4EEB7D82A9D88EE0F3291F53629C0644B39E2C81380B45F8E2A286FFCC326AE0E4B7
                                                                                                              Malicious:false
                                                                                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.............]...]...]..M]...]..\...]...\...]..\...]..\...]..\...]H..\...]...]o..]H..\...]H..\...]H.!]...]H..\...]Rich...]........PE..d...g..b.........." .....:...L......<.....................................................`..........................................+...N..@E..........s........L..............h.......8...........................@...8............0..@............................text....8.......:.................. ..`.rdata...)...P...*...>..............@..@.data...QM.......D...h..............@....pdata...T.......V..................@..@.idata..*W...0...X..................@..@.00cfg..Q............Z..............@..@.rsrc...s............\..............@..@.reloc..]............d..............@..B................................................................................................................................................................

                                                                                                              C:\Program Files\FastestVPN\Resources\is-4NIRM.tmp

                                                                                                              Download File
                                                                                                              Process:C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmp
                                                                                                              File Type:PE32+ executable (console) x86-64, for MS Windows
                                                                                                              Category:dropped
                                                                                                              Size (bytes):865416
                                                                                                              Entropy (8bit):6.558002511161394
                                                                                                              Encrypted:false
                                                                                                              SSDEEP:24576:dxRZrLEvOx+pFpQlzLyPkET7c5zaSjLUVaoNkUNBKsEpX:dtUmxmpQFLyPkEixWi
                                                                                                              MD5:A151697A9F14639BFA2CB3E470CEA355
                                                                                                              SHA1:FA45D614ABFF2ED9A707E3DFC02F404CFC18A89F
                                                                                                              SHA-256:4794C710A3E624B1A0D956CFE21EC0433FD85BD2D8EB96ACE3F2B5E5302E225C
                                                                                                              SHA-512:888CFD3919482BB56A15E23A73C868C277CA925EED122327E3399C23D0D647F07B9CD67CCAE28AFD1048A41710DA50126B38E75D7455F56AA95BBECA42D228BF
                                                                                                              Malicious:false
                                                                                                              Preview:MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$........*.w.K.$.K.$.K.$.3.$.K.$.>.%.K.$.$l$.K.$.>.%.K.$.>.%.K.$.>.%.K.$w>.%.K.$w>.%.K.$. .%.K.$. .%.K.$.K.$.I.$w>.%.K.$w>.%.K.$w>n$.K.$w>.%.K.$Rich.K.$................PE..d.....b.........."...........................@....................................q.....`.........................................Pd..P....d..........8....P...^..................................................`...8............................................text.............................. ..`.rdata..^...........................@..@.data...............................@....pdata...^...P...`..................@..@.rsrc...8...........................@..@.reloc..............................@..B................................................................................................................................................................................................................

                                                                                                              C:\Program Files\FastestVPN\Resources\is-56EGR.tmp

                                                                                                              Download File
                                                                                                              Process:C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmp
                                                                                                              File Type:PE32 executable (console) Intel 80386, for MS Windows
                                                                                                              Category:dropped
                                                                                                              Size (bytes):918536
                                                                                                              Entropy (8bit):6.038516348303836
                                                                                                              Encrypted:false
                                                                                                              SSDEEP:12288:Kts+IUZyyi1sznLRjH0qawdB1iT7jwq7Kjn+o/J:KtLIUZPyaVH0qawP1iDwjn+oh
                                                                                                              MD5:6F1B7C24C5FF662F4364B323F42C101A
                                                                                                              SHA1:B74949B7A809F8139BD89BD5B96E230108A6615D
                                                                                                              SHA-256:034248CEFD5BC35A927682E44B79C354A0AEE25E800CF99D86EC591FD8722B5A
                                                                                                              SHA-512:B13B4A46FB14C687925DE21982C4DE66C201E9FE16D7C03B2C65900CEF47C5E6DB338545E868EE6216C2A92453557BEA6C0D084B5D76A731CAA00BA821FA40E0
                                                                                                              Malicious:false
                                                                                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....$.Y...../...................H................@.................................n.....@... .........................N.......(................................a...................................................#..`............................text...............................`.P`.data....%.......&..................@.`..rdata..D...........................@.`@.bss.....G............................`..edata..N...........................@.0@.idata..(...........................@.0..CRT....4...........................@.0..tls.... ............0..............@.0..reloc...a.......b...2..............@.0B/4...........P......................@..B/19..........`......................@..B/31.....]............8..............@..B/45.......... .......T..............@..B/57..........@.......p..............@.0B/70..........P.......x..............@..B/81..........`.......~..

                                                                                                              C:\Program Files\FastestVPN\Resources\is-6403S.tmp

                                                                                                              Download File
                                                                                                              Process:C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmp
                                                                                                              File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                              Category:dropped
                                                                                                              Size (bytes):113800
                                                                                                              Entropy (8bit):6.497871168162335
                                                                                                              Encrypted:false
                                                                                                              SSDEEP:3072:NADrSog8rBPCmGxRmZZlfzaag8fPrZyEOE9toSK/G:qDl9PQTmZ53rZyEOE92L/G
                                                                                                              MD5:C966B6A5F0143199FF16F8E491E2B44D
                                                                                                              SHA1:A47ECE66964E5432551E782EC53EBFEA42845256
                                                                                                              SHA-256:EA7E53C74D1E66FB0363A16DCCB2B893183937BF4A69770EA44D6BCD6C1A15D6
                                                                                                              SHA-512:54292A35794B0E147BDCDE724D7101FEDD499F5799175545C5E2BB4362D6387B713EBF511EBF25B4D7E41086073E167524C401936623BB3AE8E337E3D5ADE5CF
                                                                                                              Malicious:false
                                                                                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........hw...........q......|......|......|......|.....P|.....b............P|.....P|.....P|.....P|.....Rich............PE..d......b.........." ................................................................."....`..........................................p.......}.......................................Y...............................Z..8............................................text............................... ..`.rdata..z...........................@..@.data...(............t..............@....pdata...............v..............@..@.rsrc...............................@..@.reloc..............................@..B................................................................................................................................................................................................................................................

                                                                                                              C:\Program Files\FastestVPN\Resources\is-6SU3B.tmp

                                                                                                              Download File
                                                                                                              Process:C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmp
                                                                                                              File Type:PE32 executable (DLL) (console) Intel 80386 (stripped to external PDB), for MS Windows
                                                                                                              Category:dropped
                                                                                                              Size (bytes):178552
                                                                                                              Entropy (8bit):6.1636094237053305
                                                                                                              Encrypted:false
                                                                                                              SSDEEP:3072:2h5CDZ37FRuI7hDEjQ777RZ7B7T7N55Fjh/YAWFOEBhzFJEB55jKTrK/T:J3bRn9ZNnB5NfKTW/T
                                                                                                              MD5:3D0E093C2EA9BE7460BFBAD86E6FBB58
                                                                                                              SHA1:C36EB5601DF523DE321146CF1853F899921AB519
                                                                                                              SHA-256:810DD30ED0002E2D71937EA818F77E60B0D385D32CC61D92A466FCB6FDCE5526
                                                                                                              SHA-512:CF4A35C0FAA30FE2B96F2A04E91AFCF9CD08ADF021031C1CEFEF8E2F4028381FD1DEABA7B744AB2245B60A623715CDE8B7C8C9D7AE52728701D773F4B26367BB
                                                                                                              Malicious:false
                                                                                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...........-......#.....L...................`.....l......................................@... .........................H.......................................t...................................................................................text....K.......L..................`.p`.data........`.......P..............@.0..rdata..,....p.......R..............@.`@.bss..................................`..edata..H............f..............@.0@.idata...............v..............@.0..CRT....,............|..............@.0..tls.... ............~..............@.0..reloc..t...........................@.0B........................................................................................................................................................................................................................................................................

                                                                                                              C:\Program Files\FastestVPN\Resources\is-79FJ0.tmp

                                                                                                              Download File
                                                                                                              Process:C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmp
                                                                                                              File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                                                                              Category:dropped
                                                                                                              Size (bytes):585512
                                                                                                              Entropy (8bit):6.002108518534667
                                                                                                              Encrypted:false
                                                                                                              SSDEEP:12288:kavF2w273DAx5at3y6/c1M94lh7NX06qkX/0IT7/5:kAF2w2jE5k3y6/cyinNXy4B7h
                                                                                                              MD5:2C700BBCDA59BFE2CD7EBF9BAA5B2626
                                                                                                              SHA1:72EFAA0E8652FB4ADC21E4484E7F63AA968F39D2
                                                                                                              SHA-256:C9C59AB5B3369B97C85129F160491BD743B68DE1AD41EE6EEBA69009407B54E7
                                                                                                              SHA-512:0911C7FED9653D9D50BAD7219E45778367DE4B105B5079A8011415F65465B80782A98A503CEBFB309997BCFB2A8620402579456565A24C69A20CBCBD0130DA20
                                                                                                              Malicious:false
                                                                                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....$.Y...........!..............................`n.........................p......L.....@... .........................m).......3...0..@....................@...)........................... .......................................................text...T...........................`.P`.data....-..........................@.`..rdata..............................@.`@.bss....d.............................`..edata..m).......*...t..............@.0@.idata...3.......4..................@.0..CRT....,...........................@.0..tls.... .... ......................@.0..rsrc...@....0......................@.0..reloc...)...@...*..................@.0B/4...........p......................@..B/19......l.......n..................@..B/31...../............v..............@..B/45.....|...........................@..B/57..........0......................@.0B/70.....2....@..........

                                                                                                              C:\Program Files\FastestVPN\Resources\is-80EU7.tmp

                                                                                                              Download File
                                                                                                              Process:C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmp
                                                                                                              File Type:PE32+ executable (console) x86-64, for MS Windows
                                                                                                              Category:dropped
                                                                                                              Size (bytes):94856
                                                                                                              Entropy (8bit):5.499392443352034
                                                                                                              Encrypted:false
                                                                                                              SSDEEP:1536:RmYSYxGfIZnRnD6M7EFOUakPhtUn6KXF4O7Wm1xK/CpcW:QYFZnRDGdvPXU6K1RWmPK/4h
                                                                                                              MD5:834EE5DA601A6C78C43C64F6C282682F
                                                                                                              SHA1:03920B402B787CA53CD79A66B0B611C899B91F3E
                                                                                                              SHA-256:754B61DA108CC9379585E18DDCE90A8092C1B17DA5D922A6E8D6CE84A90B0F87
                                                                                                              SHA-512:C4A6A49D1EE316FB9EA399487EA17DD813C0A611F473F4FD054D07F6D5C6BB786D40FA478254A499DB3E1D5F0AFDA3B72651EF097945D0C3AA9F0D83D9C0ED06
                                                                                                              Malicious:false
                                                                                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........V........-.....;......<.......+....%......S....%......2....~......,.....)...Rich..........PE..d...<..W..........".................Tv..............................................I.....@.......... ..................................................h.......l....D.......p..........................................................X............................text............................... ..`.data...............................@....pdata..l...........................@..@.rsrc...h...........................@..@.reloc..z....p.......B..............@..B................................................................................................................................................................................................................................................................................................

                                                                                                              C:\Program Files\FastestVPN\Resources\is-9K65C.tmp

                                                                                                              Download File
                                                                                                              Process:C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmp
                                                                                                              File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                              Category:dropped
                                                                                                              Size (bytes):99976
                                                                                                              Entropy (8bit):6.499161413646961
                                                                                                              Encrypted:false
                                                                                                              SSDEEP:1536:yWHL+4KsAzAfadZw+1Hcx8uIYNU5U9H0Q8ecbjt1BHK/CeS:yWr/Z+jPYNV9H0Q8ecbjt1BHK/pS
                                                                                                              MD5:85054BAF6D0A7D31A18183ACC4CBA133
                                                                                                              SHA1:24830C002FFAB31102DFB674B52AFFD74E90E708
                                                                                                              SHA-256:EC86F182F55A338E26F598638F18422E474C6D6C651E1D9955D0303254BF6DDD
                                                                                                              SHA-512:B6B7D9115ED1D734D7C0EB09E7C7C96EEC29E2C59B8943586976F2182E46B660B99C1947ACF2C1DEB75595771A78B7405FDDBB989A2F06CF88E4AD3D8824055A
                                                                                                              Malicious:false
                                                                                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......*..qn.."n.."n.."...#l.."g.."e.."n.."B.."<..#c.."<..#~.."<..#q.."<..#o.."<.g"o.."<..#o.."Richn.."................PE..d.....`.........." .........`......p................................................>....`A.........................................B..4....J...............p..X....X..............h,..T............................,..8............................................text............................... ..`.rdata...@.......B..................@..@.data...@....`.......@..............@....pdata..X....p.......D..............@..@_RDATA...............P..............@..@.rsrc................R..............@..@.reloc...............V..............@..B........................................................................................................................................................................................................................

                                                                                                              C:\Program Files\FastestVPN\Resources\is-B0TRN.tmp

                                                                                                              Download File
                                                                                                              Process:C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmp
                                                                                                              File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                              Category:dropped
                                                                                                              Size (bytes):776328
                                                                                                              Entropy (8bit):6.92032788063544
                                                                                                              Encrypted:false
                                                                                                              SSDEEP:12288:uQmCy3NeRjkpQmj3oaMtQqjoygfXq3kon9IlbgaOxQdVJJ6j5EBKX8hUk/K:vmCy3VQs9MtLjTgfa3kon9FaOdEukC
                                                                                                              MD5:6ECA26F16FEB505B1BD0A0A25DA4AEDB
                                                                                                              SHA1:297A6E0D660FAF9E924B2BE827D9D9DC81E4EB85
                                                                                                              SHA-256:CD9005B83CAB43E566F287D1BB1A3DE33F2D67AD5013DC5213232A5DC5309BDB
                                                                                                              SHA-512:78F749E1D591D9AC2C1BB3A47FA7D4099A18303357F990E97D6E531FA50FE2466C8A203504F599C74EE92DFA179CC4AFBC561C60AFD01FA103A3276E79760A46
                                                                                                              Malicious:false
                                                                                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........ R.HA<.HA<.HA<.A9..KA<.HA=..A<.'7..@<.'7...A<.'7..|A<.'7...A<.'7..IA<.'7..IA<.'7..IA<.RichHA<.........PE..L.....K.........."!................. ....... .....x................................m.....@..........................I......D...(............................... L..h...8...........................pE..@............................................text............................... ..`.data...|Z... ...N..................@....rsrc................X..............@..@.reloc.. L.......N...\..............@..B........................................................................................................................................................................................................................................................................................................................................................................

                                                                                                              C:\Program Files\FastestVPN\Resources\is-CC2NP.tmp

                                                                                                              Download File
                                                                                                              Process:C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmp
                                                                                                              File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                              Category:dropped
                                                                                                              Size (bytes):196157514
                                                                                                              Entropy (8bit):0.9790898435836601
                                                                                                              Encrypted:false
                                                                                                              SSDEEP:196608:hqw2hVGlR9fHUTW9kG0Pktx+PSRFZyqMpBeD63RmTtGtqQY6lgJTXdrb4acJ7AuN:hohVgRxmP8k
                                                                                                              MD5:F892887D8532D19F74884CDC48B1AC8B
                                                                                                              SHA1:BD20AFCD00D7C5A46CC1C5399BDC15A185F815D3
                                                                                                              SHA-256:2E7FA00A4C0EA04EF0ABCD658BDE323DB0FDFFCA1C5402592CB2197EE3126383
                                                                                                              SHA-512:7A610425A58C24815D6731C04BBD2DC919799AE36D95184B567C3A86ED1733B542F7D5F523DF6E4577BB69D755100597E815815378A4F103232FAD7ACF2E9F67
                                                                                                              Malicious:false
                                                                                                              Preview:MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L...w..e..................P... ...... P......0P...@..........................pt.....CO....@......@...................PV.......V..=...p].................`(....V..............................pV.......................V......@V......................text...D.O.......O................. ..`.itext...1....O..2....O............. ..`.data...l....0P.......P.............@....bss....\0....R..........................idata...=....V..>....R.............@....didata......@V.......R.............@....edata.......PV.......R.............@..@.tls....\....`V..........................rdata..]....pV.......R.............@..@.reloc........V.......R.............@..B.rsrc........p].......Y.............@..@..............d......>a.............@..@................

                                                                                                              C:\Program Files\FastestVPN\Resources\is-CDU5N.tmp

                                                                                                              Download File
                                                                                                              Process:C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmp
                                                                                                              File Type:PE32 executable (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                              Category:dropped
                                                                                                              Size (bytes):27784
                                                                                                              Entropy (8bit):6.488306745612165
                                                                                                              Encrypted:false
                                                                                                              SSDEEP:
                                                                                                              MD5:41C55E2A9D5D9B23C08E3DC067780DC7
                                                                                                              SHA1:1FB62C7FCF24F604676896121C1CCAFB628C1BE1
                                                                                                              SHA-256:D76995DCE5A5A3B0D77ABB438C14504F9825A6BC98676F1BA8D0CC18CEBB0545
                                                                                                              SHA-512:396E8878BAFCFC0DF994B9AF23176D343230B6F6EE82A71E14EFA56347EF0C63B4D277C029EF9FB3EF69D6F1B8AE73ECF92D8DCEDC9312E0C8BFA86EC0B611D2
                                                                                                              Malicious:false
                                                                                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....7X.................6...........T... ...`....@.. ....................................@..................................T..K....`...............>............................................................... ............... ..H............text....4... ...6.................. ..`.rsrc........`.......8..............@..@.reloc...............<..............@..B.................T......H........1..."..........|0..p...........................................6.(.....(....*...0..S............(....o.....s.......o....s.......o......o.........&..o............9.....o.....*.......#..6........../E.......0..E............(....o.....s.......o....s.......o.........&........9.....o.....*.........#../..........!7.......0..M.......~....s......o.....;.....o......#......$@(....o.........&........9.....o.....*...........,7..........4?.......0..M.......~....s......o.....;.....

                                                                                                              C:\Program Files\FastestVPN\Resources\is-DJHTV.tmp

                                                                                                              Download File
                                                                                                              Process:C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmp
                                                                                                              File Type:PE32 executable (DLL) (console) Intel 80386 (stripped to external PDB), for MS Windows
                                                                                                              Category:dropped
                                                                                                              Size (bytes):244360
                                                                                                              Entropy (8bit):6.534833630270433
                                                                                                              Encrypted:false
                                                                                                              SSDEEP:
                                                                                                              MD5:92CAE75041DFA888EE8284E7C6BB658E
                                                                                                              SHA1:2632FD77EAEDC09977192CFAA19EAEE66F538041
                                                                                                              SHA-256:ACEB2DBBA3948EF0D2908CAE3B2E1586AC82B700C1DE7E6420FA241EFBBB0ECB
                                                                                                              SHA-512:F01AC04FBD3EA1FD4D39D7654DF7D97EB15D60BC9EDFDF36C92176CF8A66FC148E4ECA480F52B7283AF1B9966983F4275A4E221E2D73056A7F3F4290C4D85C17
                                                                                                              Malicious:false
                                                                                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...R."K...........#...8............`..............k................................Ub........ ......................P.. ....p...$...................................................................................................................text...t...........................`.P`.data...0%.......&..................@.`..rdata..x^.......`..................@.`@.bss.........@........................@..edata.. ....P.......*..............@.0@.idata...$...p...&...H..............@.0..reloc...............n..............@.0B........................................................................................................................................................................................................................................................................................................................................................

                                                                                                              C:\Program Files\FastestVPN\Resources\is-E9ECF.tmp

                                                                                                              Download File
                                                                                                              Process:C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmp
                                                                                                              File Type:PE32 executable (console) Intel 80386, for MS Windows
                                                                                                              Category:dropped
                                                                                                              Size (bytes):89736
                                                                                                              Entropy (8bit):5.522767465825831
                                                                                                              Encrypted:false
                                                                                                              SSDEEP:
                                                                                                              MD5:2CC3AC572A2170108BABD019F0BFE779
                                                                                                              SHA1:AF962245CE32D5801A380FF7F6B8C87AC7772AB2
                                                                                                              SHA-256:755315DFCC9C72CBE4EB33AF34E9AAC0BD1324C6942F4B56AD9FE0135E1A9299
                                                                                                              SHA-512:891D545DDF35BF8C650FE8EB48A5E5F6F7C50036E42BE893417AF2EF886EB37C5BEEE9DD838A8F020728E4BAE803F2753CC8F6DD7958DD31B5B39DAED7EF464B
                                                                                                              Malicious:false
                                                                                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........L..."..."..."....."......"......"...#.S."....."..`\..."......"......".Rich..".................PE..L...#.pK.................l..........Td.......................................P......0a....@...... ..........................lm..........p............0.......@...... ...............................0...@............................................text... j.......l.................. ..`.data...4............p..............@....rsrc...p............v..............@..@.reloc.......@.......&..............@..B........................................................................................................................................................................................................................................................................................................................................................................

                                                                                                              C:\Program Files\FastestVPN\Resources\is-EANN9.tmp

                                                                                                              Download File
                                                                                                              Process:C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmp
                                                                                                              File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                                                                              Category:dropped
                                                                                                              Size (bytes):2276496
                                                                                                              Entropy (8bit):6.2839627604807955
                                                                                                              Encrypted:false
                                                                                                              SSDEEP:
                                                                                                              MD5:A928351F9555A07B7A8DCEA6B209D367
                                                                                                              SHA1:66379948FB082D9EB390B77C4E00EFAD25062C9C
                                                                                                              SHA-256:8993C69DAA63314019E3D33190140ACAC23704D20AB3BDF946B41969DD23B0A7
                                                                                                              SHA-512:099DAD1E89474F449EF9EA35CC93C2C8A643AF9108FD38FFB7B748FE93F0A25553B135AC6C6E33EDB8B1AD55687CDF182C6FA3E2D5018110D0500C3E2CA35EEA
                                                                                                              Malicious:false
                                                                                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....$.Y.p...<.....!.............0................(c.........................@........"...@... .........................A....P..........@.............".....................................p.......................R..h............................text...............................`.p`.data...|d.......f..................@.`..rdata..T............d..............@.`@.bss.........`........................`..edata..A............B..............@.0@.idata.......P......................@.0..CRT....,....`......................@.0..tls.... ....p......................@.0..rsrc...@...........................@.0..reloc.............................@.0B/4...........@......................@..B/19......i...P...j..................@..B/31..................,..............@..B/45..................@..............@..B/57..................R..............@.0B/70.....2............Z..

                                                                                                              C:\Program Files\FastestVPN\Resources\is-EHLQ3.tmp

                                                                                                              Download File
                                                                                                              Process:C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmp
                                                                                                              File Type:PE32+ executable (GUI) x86-64 (stripped to external PDB), for MS Windows
                                                                                                              Category:dropped
                                                                                                              Size (bytes):8184456
                                                                                                              Entropy (8bit):6.15917051663501
                                                                                                              Encrypted:false
                                                                                                              SSDEEP:
                                                                                                              MD5:5850A25689FA1B36CD6B76E2E7F6BDB3
                                                                                                              SHA1:299CEBD4CD448239BF5094DCC0632100287C0B85
                                                                                                              SHA-256:803870B4FCC1A8C0675EE1D5AA5DEB4132514974CDF0F8F7BA40035377FFDCFA
                                                                                                              SHA-512:F64A196D0FE937112604D7B0CFE2099928987ECEAA650728C88ECE9BAEF288AF2E4BCDD52D3199D8787290F5071287DAFA5DC6FD44775E52CA1E04237411888F
                                                                                                              Malicious:false
                                                                                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d.........].......".......'..........=........@.......................................}...`... ...............................................c.|.... d.t.............|...... c.....................................................`SY.@............................text.....'.......'................. ..`.rdata..PC1...(..D1...'.............@..@.data... ....PY......0Y.............@....idata..|.....c.......\.............@....reloc....... c.......\.............@..B.symtab.......d.......]................B.rsrc...t.... d.......].............@..@........................................................................................................................................................................................................................................................................................................................................

                                                                                                              C:\Program Files\FastestVPN\Resources\is-LGI72.tmp

                                                                                                              Download File
                                                                                                              Process:C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmp
                                                                                                              File Type:PE32+ executable (console) x86-64, for MS Windows
                                                                                                              Category:dropped
                                                                                                              Size (bytes):93832
                                                                                                              Entropy (8bit):5.48517352660103
                                                                                                              Encrypted:false
                                                                                                              SSDEEP:
                                                                                                              MD5:A2ADF4897942B99FE0738F8C37FD15C0
                                                                                                              SHA1:4192A2221F5C48A16427BF1898C0443CA27A29BB
                                                                                                              SHA-256:B339B9A93A93B52F3EA0A5F2161E4B16BDA0CA7396D53ECA14C7D7F3E963A3A3
                                                                                                              SHA-512:DF383B4B70C980C613F3C3EC4E99980DA6DB15F123D617197B644314233D1E2ADEC9F9162D6DBB7B874D885119082E01840102F0976F3CC767A78B5E467EF4A8
                                                                                                              Malicious:false
                                                                                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........X...9...9...9...AF..9...AW..9...A@..9...9..f9...AP.9...AY..9.......9...AG..9...AB..9..Rich.9..........................PE..d.....pK.........."......~...........s.......................................p......r.....@.......... ......................................X}..........p.......T....@.......`......0................................................................................text....|.......~.................. ..`.data...x...........................@....pdata..T...........................@..@.rsrc...p...........................@..@.reloc..p....`.......>..............@..B................................................................................................................................................................................................................................................................................................

                                                                                                              C:\Program Files\FastestVPN\Resources\is-O25O5.tmp

                                                                                                              Download File
                                                                                                              Process:C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmp
                                                                                                              File Type:PE32+ executable (console) x86-64, for MS Windows
                                                                                                              Category:dropped
                                                                                                              Size (bytes):68744
                                                                                                              Entropy (8bit):6.03232541602541
                                                                                                              Encrypted:false
                                                                                                              SSDEEP:
                                                                                                              MD5:41E94A80206A87D947CE6CF5823494BE
                                                                                                              SHA1:558214579EE8F2732C36F779E545BA1340191E49
                                                                                                              SHA-256:E4275E6430AE1EC21A5CD0F2FC382998DEBC1E433A66129527C1B69792F09F95
                                                                                                              SHA-512:54B0DD18BA43C48B3FC21E4366D7D1DC65147A84AFA3DC29D94C4CF80B49FA67150B8303F576683F712E648CAFF516BFEA3A6F93435D6B33DCAB2C43BC762E35
                                                                                                              Malicious:false
                                                                                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........z..h...h...h.......h......h......h......h......h......h.......h...h..ih.......h.......h...h...h.......h..Rich.h..........PE..d.....b.........."......r...|.......v.........@.............................@............`.................................................x...T.... .......................0..p...................................@...8............................................text....p.......r.................. ..`.rdata...W.......X...v..............@..@.data...............................@....pdata..............................@..@.rsrc........ ......................@..@.reloc..p....0......................@..B................................................................................................................................................................................................................................................

                                                                                                              C:\Program Files\FastestVPN\Resources\is-OOEI3.tmp

                                                                                                              Download File
                                                                                                              Process:C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmp
                                                                                                              File Type:PE32+ executable (console) x86-64, for MS Windows
                                                                                                              Category:dropped
                                                                                                              Size (bytes):93832
                                                                                                              Entropy (8bit):5.485112927422894
                                                                                                              Encrypted:false
                                                                                                              SSDEEP:
                                                                                                              MD5:8E7EE7C3876683902475753519681407
                                                                                                              SHA1:75FACB7F9C59B284F97956E799E57FB0F606C49D
                                                                                                              SHA-256:6D5041A8EF796C66BA151D8FCFAFDD96BCAA99B57D2777897FD25A87A5E41E13
                                                                                                              SHA-512:523EBF3A4DF9F6D299E72079DEF0A0DA9127601796D9AA613B70AD2F66EE2166F4F8F75083F47E67FFFD892A09FA437F3B12BD1B27065200E90F8617E3E83727
                                                                                                              Malicious:false
                                                                                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........X...9...9...9...AF..9...AW..9...A@..9...9..f9...AP.9...AY..9.......9...AG..9...AB..9..Rich.9..........................PE..d.....pK.........."......~...........s.......................................p............@.......... ......................................X}..........p.......T....@.......`......0................................................................................text....|.......~.................. ..`.data...x...........................@....pdata..T...........................@..@.rsrc...p...........................@..@.reloc..p....`.......>..............@..B................................................................................................................................................................................................................................................................................................

                                                                                                              C:\Program Files\FastestVPN\Resources\is-PHPNK.tmp

                                                                                                              Download File
                                                                                                              Process:C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmp
                                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                                              Category:dropped
                                                                                                              Size (bytes):277
                                                                                                              Entropy (8bit):5.0491979415178765
                                                                                                              Encrypted:false
                                                                                                              SSDEEP:
                                                                                                              MD5:C8768E552ABCA40175C704E4AF1F030C
                                                                                                              SHA1:7B8A3BC3310EE72006FD2C5A4D5F4FC60171C81B
                                                                                                              SHA-256:50259EEA13E0A9CB0AC48181F8F4345E6558EE8536CC71D0F6E2F63AE9D89D33
                                                                                                              SHA-512:09FD06DB34894F1EC79B607217DC70E204793E04C58B846DC495DC915F38C1311AC1EE0D3C5CCDE636D8A3D6CE5631EF7291D3617FB3F900FD072CEA5831B573
                                                                                                              Malicious:false
                                                                                                              Preview:OpenVPN STATISTICS..Updated,2023-09-03 07:45:36..TUN/TAP read bytes,1979..TUN/TAP write bytes,9103..TCP/UDP read bytes,15521..TCP/UDP write bytes,5150..Auth read bytes,9103..pre-compress bytes,0..post-compress bytes,0..pre-decompress bytes,204..post-decompress bytes,213..END..

                                                                                                              C:\Program Files\FastestVPN\Resources\is-QLNQ0.tmp

                                                                                                              Download File
                                                                                                              Process:C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmp
                                                                                                              File Type:PE32+ executable (console) x86-64, for MS Windows
                                                                                                              Category:dropped
                                                                                                              Size (bytes):42120
                                                                                                              Entropy (8bit):6.157445136592099
                                                                                                              Encrypted:false
                                                                                                              SSDEEP:
                                                                                                              MD5:F6AFD5499FCC5D464085AD889BAE09B7
                                                                                                              SHA1:287C540655FCED0C09DDA2D9C4EADD3F3E210B17
                                                                                                              SHA-256:6EDA54D746C092A45395399319DFC878E5674C84FAB8147821524A0042C03F47
                                                                                                              SHA-512:BFD5ED90D0F16A2F0BCC22B0E847D5781A7B11D6912A51CDC8FCAAD80BF191D821418F7544BF52BF6E1AAA47D06A5442601543E9C25B2352D4E23AFC0C4668F9
                                                                                                              Malicious:false
                                                                                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......kT../5../5../5..&M<.#5..}@..-5..}@..=5..}@..%5..}@..,5..;^..$5../5..p5...@..,5...@P..5...@...5..Rich/5..........PE..d.....b.........."......0...H.......4.........@....................................e.....`.................................................4g..........@............v..........8...P]...............................]..8............@...............................text..../.......0.................. ..`.rdata...3...@...4...4..............@..@.data...H............h..............@....pdata...............j..............@..@.rsrc...@............n..............@..@.reloc..8............t..............@..B................................................................................................................................................................................................................................................................

                                                                                                              C:\Program Files\FastestVPN\Resources\is-RFTSN.tmp

                                                                                                              Download File
                                                                                                              Process:C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmp
                                                                                                              File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                              Category:dropped
                                                                                                              Size (bytes):3490952
                                                                                                              Entropy (8bit):6.105770368598401
                                                                                                              Encrypted:false
                                                                                                              SSDEEP:
                                                                                                              MD5:474D774A60BCBDBB326C248D1B86C785
                                                                                                              SHA1:C8611E2BEA720BB3B8768BB7F347DE04EAB8B00D
                                                                                                              SHA-256:4FB11C716E57A352D0C40B83F00B73A23B16F4418247AFB0E8CA114C20ED7414
                                                                                                              SHA-512:D25EFAE915E303AB98F86A3131E5C128BFFB0FEE7317C2F28D7A9C9836186C46FDB64008BE98EBF1B7C97F809AD4A170929583B5B899427C405C90503D3D39E0
                                                                                                              Malicious:false
                                                                                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......q.Q.5.?.5.?.5.?.<..'.?.g.>.7.?.g.:.>.?.g.;.=.?.g.<.1.?.!.>.8.?.5.>.?.5.?.+.?...;.N.?...?.4.?.....4.?...=.4.?.Rich5.?.........................PE..d...g..b.........." .....p%...................................................5.......5...`...........................................0..h....4.T.....5.|.....3.......5...... 5..P..T.-.8.............................-.8.............4..............................text....o%......p%................. ..`.rdata........%......t%.............@..@.data....~....2..0...t2.............@....pdata........3.......2.............@..@.idata..T'....4..(...h4.............@..@.00cfg..Q.....5.......4.............@..@.rsrc...|.....5.......4.............@..@.reloc...z... 5..|....4.............@..B................................................................................................................................................

                                                                                                              C:\Program Files\FastestVPN\Resources\libcrypto-1_1-x64.dll (copy)

                                                                                                              Download File
                                                                                                              Process:C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmp
                                                                                                              File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                              Category:dropped
                                                                                                              Size (bytes):3490952
                                                                                                              Entropy (8bit):6.105770368598401
                                                                                                              Encrypted:false
                                                                                                              SSDEEP:
                                                                                                              MD5:474D774A60BCBDBB326C248D1B86C785
                                                                                                              SHA1:C8611E2BEA720BB3B8768BB7F347DE04EAB8B00D
                                                                                                              SHA-256:4FB11C716E57A352D0C40B83F00B73A23B16F4418247AFB0E8CA114C20ED7414
                                                                                                              SHA-512:D25EFAE915E303AB98F86A3131E5C128BFFB0FEE7317C2F28D7A9C9836186C46FDB64008BE98EBF1B7C97F809AD4A170929583B5B899427C405C90503D3D39E0
                                                                                                              Malicious:false
                                                                                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......q.Q.5.?.5.?.5.?.<..'.?.g.>.7.?.g.:.>.?.g.;.=.?.g.<.1.?.!.>.8.?.5.>.?.5.?.+.?...;.N.?...?.4.?.....4.?...=.4.?.Rich5.?.........................PE..d...g..b.........." .....p%...................................................5.......5...`...........................................0..h....4.T.....5.|.....3.......5...... 5..P..T.-.8.............................-.8.............4..............................text....o%......p%................. ..`.rdata........%......t%.............@..@.data....~....2..0...t2.............@....pdata........3.......2.............@..@.idata..T'....4..(...h4.............@..@.00cfg..Q.....5.......4.............@..@.rsrc...|.....5.......4.............@..@.reloc...z... 5..|....4.............@..B................................................................................................................................................

                                                                                                              C:\Program Files\FastestVPN\Resources\libeay32.dll (copy)

                                                                                                              Download File
                                                                                                              Process:C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmp
                                                                                                              File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                                                                              Category:dropped
                                                                                                              Size (bytes):2276496
                                                                                                              Entropy (8bit):6.2839627604807955
                                                                                                              Encrypted:false
                                                                                                              SSDEEP:
                                                                                                              MD5:A928351F9555A07B7A8DCEA6B209D367
                                                                                                              SHA1:66379948FB082D9EB390B77C4E00EFAD25062C9C
                                                                                                              SHA-256:8993C69DAA63314019E3D33190140ACAC23704D20AB3BDF946B41969DD23B0A7
                                                                                                              SHA-512:099DAD1E89474F449EF9EA35CC93C2C8A643AF9108FD38FFB7B748FE93F0A25553B135AC6C6E33EDB8B1AD55687CDF182C6FA3E2D5018110D0500C3E2CA35EEA
                                                                                                              Malicious:false
                                                                                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....$.Y.p...<.....!.............0................(c.........................@........"...@... .........................A....P..........@.............".....................................p.......................R..h............................text...............................`.p`.data...|d.......f..................@.`..rdata..T............d..............@.`@.bss.........`........................`..edata..A............B..............@.0@.idata.......P......................@.0..CRT....,....`......................@.0..tls.... ....p......................@.0..rsrc...@...........................@.0..reloc.............................@.0B/4...........@......................@..B/19......i...P...j..................@..B/31..................,..............@..B/45..................@..............@..B/57..................R..............@.0B/70.....2............Z..

                                                                                                              C:\Program Files\FastestVPN\Resources\liblzo2-2.dll (copy)

                                                                                                              Download File
                                                                                                              Process:C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmp
                                                                                                              File Type:PE32 executable (DLL) (console) Intel 80386 (stripped to external PDB), for MS Windows
                                                                                                              Category:dropped
                                                                                                              Size (bytes):178552
                                                                                                              Entropy (8bit):6.1636094237053305
                                                                                                              Encrypted:false
                                                                                                              SSDEEP:
                                                                                                              MD5:3D0E093C2EA9BE7460BFBAD86E6FBB58
                                                                                                              SHA1:C36EB5601DF523DE321146CF1853F899921AB519
                                                                                                              SHA-256:810DD30ED0002E2D71937EA818F77E60B0D385D32CC61D92A466FCB6FDCE5526
                                                                                                              SHA-512:CF4A35C0FAA30FE2B96F2A04E91AFCF9CD08ADF021031C1CEFEF8E2F4028381FD1DEABA7B744AB2245B60A623715CDE8B7C8C9D7AE52728701D773F4B26367BB
                                                                                                              Malicious:false
                                                                                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...........-......#.....L...................`.....l......................................@... .........................H.......................................t...................................................................................text....K.......L..................`.p`.data........`.......P..............@.0..rdata..,....p.......R..............@.`@.bss..................................`..edata..H............f..............@.0@.idata...............v..............@.0..CRT....,............|..............@.0..tls.... ............~..............@.0..reloc..t...........................@.0B........................................................................................................................................................................................................................................................................

                                                                                                              C:\Program Files\FastestVPN\Resources\libpkcs11-helper-1.dll (copy)

                                                                                                              Download File
                                                                                                              Process:C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmp
                                                                                                              File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                              Category:dropped
                                                                                                              Size (bytes):113800
                                                                                                              Entropy (8bit):6.497871168162335
                                                                                                              Encrypted:false
                                                                                                              SSDEEP:
                                                                                                              MD5:C966B6A5F0143199FF16F8E491E2B44D
                                                                                                              SHA1:A47ECE66964E5432551E782EC53EBFEA42845256
                                                                                                              SHA-256:EA7E53C74D1E66FB0363A16DCCB2B893183937BF4A69770EA44D6BCD6C1A15D6
                                                                                                              SHA-512:54292A35794B0E147BDCDE724D7101FEDD499F5799175545C5E2BB4362D6387B713EBF511EBF25B4D7E41086073E167524C401936623BB3AE8E337E3D5ADE5CF
                                                                                                              Malicious:false
                                                                                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........hw...........q......|......|......|......|.....P|.....b............P|.....P|.....P|.....P|.....Rich............PE..d......b.........." ................................................................."....`..........................................p.......}.......................................Y...............................Z..8............................................text............................... ..`.rdata..z...........................@..@.data...(............t..............@....pdata...............v..............@..@.rsrc...............................@..@.reloc..............................@..B................................................................................................................................................................................................................................................

                                                                                                              C:\Program Files\FastestVPN\Resources\libssl-1_1-x64.dll (copy)

                                                                                                              Download File
                                                                                                              Process:C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmp
                                                                                                              File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                              Category:dropped
                                                                                                              Size (bytes):700040
                                                                                                              Entropy (8bit):5.552155208041958
                                                                                                              Encrypted:false
                                                                                                              SSDEEP:
                                                                                                              MD5:6EE5C92E2918B27974086A6F24D79043
                                                                                                              SHA1:40595B75A513BBF1BE16780784E13EFDAD2E40C7
                                                                                                              SHA-256:86F3A19221C710CFF12607FEB00D8CD0AF932873430AD1B59C990593010EC3CF
                                                                                                              SHA-512:F07BBE5D367D6F7474E08507F3827BDCAC5503673F2027CA139303FA573F4EEB7D82A9D88EE0F3291F53629C0644B39E2C81380B45F8E2A286FFCC326AE0E4B7
                                                                                                              Malicious:false
                                                                                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.............]...]...]..M]...]..\...]...\...]..\...]..\...]..\...]H..\...]...]o..]H..\...]H..\...]H.!]...]H..\...]Rich...]........PE..d...g..b.........." .....:...L......<.....................................................`..........................................+...N..@E..........s........L..............h.......8...........................@...8............0..@............................text....8.......:.................. ..`.rdata...)...P...*...>..............@..@.data...QM.......D...h..............@....pdata...T.......V..................@..@.idata..*W...0...X..................@..@.00cfg..Q............Z..............@..@.rsrc...s............\..............@..@.reloc..]............d..............@..B................................................................................................................................................................

                                                                                                              C:\Program Files\FastestVPN\Resources\libssl32.dll (copy)

                                                                                                              Download File
                                                                                                              Process:C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmp
                                                                                                              File Type:PE32 executable (DLL) (console) Intel 80386 (stripped to external PDB), for MS Windows
                                                                                                              Category:dropped
                                                                                                              Size (bytes):244360
                                                                                                              Entropy (8bit):6.534833630270433
                                                                                                              Encrypted:false
                                                                                                              SSDEEP:
                                                                                                              MD5:92CAE75041DFA888EE8284E7C6BB658E
                                                                                                              SHA1:2632FD77EAEDC09977192CFAA19EAEE66F538041
                                                                                                              SHA-256:ACEB2DBBA3948EF0D2908CAE3B2E1586AC82B700C1DE7E6420FA241EFBBB0ECB
                                                                                                              SHA-512:F01AC04FBD3EA1FD4D39D7654DF7D97EB15D60BC9EDFDF36C92176CF8A66FC148E4ECA480F52B7283AF1B9966983F4275A4E221E2D73056A7F3F4290C4D85C17
                                                                                                              Malicious:false
                                                                                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...R."K...........#...8............`..............k................................Ub........ ......................P.. ....p...$...................................................................................................................text...t...........................`.P`.data...0%.......&..................@.`..rdata..x^.......`..................@.`@.bss.........@........................@..edata.. ....P.......*..............@.0@.idata...$...p...&...H..............@.0..reloc...............n..............@.0B........................................................................................................................................................................................................................................................................................................................................................

                                                                                                              C:\Program Files\FastestVPN\Resources\msvcr100.dll (copy)

                                                                                                              Download File
                                                                                                              Process:C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmp
                                                                                                              File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                              Category:dropped
                                                                                                              Size (bytes):776328
                                                                                                              Entropy (8bit):6.92032788063544
                                                                                                              Encrypted:false
                                                                                                              SSDEEP:
                                                                                                              MD5:6ECA26F16FEB505B1BD0A0A25DA4AEDB
                                                                                                              SHA1:297A6E0D660FAF9E924B2BE827D9D9DC81E4EB85
                                                                                                              SHA-256:CD9005B83CAB43E566F287D1BB1A3DE33F2D67AD5013DC5213232A5DC5309BDB
                                                                                                              SHA-512:78F749E1D591D9AC2C1BB3A47FA7D4099A18303357F990E97D6E531FA50FE2466C8A203504F599C74EE92DFA179CC4AFBC561C60AFD01FA103A3276E79760A46
                                                                                                              Malicious:false
                                                                                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........ R.HA<.HA<.HA<.A9..KA<.HA=..A<.'7..@<.'7...A<.'7..|A<.'7...A<.'7..IA<.'7..IA<.'7..IA<.RichHA<.........PE..L.....K.........."!................. ....... .....x................................m.....@..........................I......D...(............................... L..h...8...........................pE..@............................................text............................... ..`.data...|Z... ...N..................@....rsrc................X..............@..@.reloc.. L.......N...\..............@..B........................................................................................................................................................................................................................................................................................................................................................................

                                                                                                              C:\Program Files\FastestVPN\Resources\openssl.exe (copy)

                                                                                                              Download File
                                                                                                              Process:C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmp
                                                                                                              File Type:PE32 executable (console) Intel 80386, for MS Windows
                                                                                                              Category:dropped
                                                                                                              Size (bytes):918536
                                                                                                              Entropy (8bit):6.038516348303836
                                                                                                              Encrypted:false
                                                                                                              SSDEEP:
                                                                                                              MD5:6F1B7C24C5FF662F4364B323F42C101A
                                                                                                              SHA1:B74949B7A809F8139BD89BD5B96E230108A6615D
                                                                                                              SHA-256:034248CEFD5BC35A927682E44B79C354A0AEE25E800CF99D86EC591FD8722B5A
                                                                                                              SHA-512:B13B4A46FB14C687925DE21982C4DE66C201E9FE16D7C03B2C65900CEF47C5E6DB338545E868EE6216C2A92453557BEA6C0D084B5D76A731CAA00BA821FA40E0
                                                                                                              Malicious:false
                                                                                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....$.Y...../...................H................@.................................n.....@... .........................N.......(................................a...................................................#..`............................text...............................`.P`.data....%.......&..................@.`..rdata..D...........................@.`@.bss.....G............................`..edata..N...........................@.0@.idata..(...........................@.0..CRT....4...........................@.0..tls.... ............0..............@.0..reloc...a.......b...2..............@.0B/4...........P......................@..B/19..........`......................@..B/31.....]............8..............@..B/45.......... .......T..............@..B/57..........@.......p..............@.0B/70..........P.......x..............@..B/81..........`.......~..

                                                                                                              C:\Program Files\FastestVPN\Resources\openvpn.exe (copy)

                                                                                                              Download File
                                                                                                              Process:C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmp
                                                                                                              File Type:PE32+ executable (console) x86-64, for MS Windows
                                                                                                              Category:dropped
                                                                                                              Size (bytes):865416
                                                                                                              Entropy (8bit):6.558002511161394
                                                                                                              Encrypted:false
                                                                                                              SSDEEP:
                                                                                                              MD5:A151697A9F14639BFA2CB3E470CEA355
                                                                                                              SHA1:FA45D614ABFF2ED9A707E3DFC02F404CFC18A89F
                                                                                                              SHA-256:4794C710A3E624B1A0D956CFE21EC0433FD85BD2D8EB96ACE3F2B5E5302E225C
                                                                                                              SHA-512:888CFD3919482BB56A15E23A73C868C277CA925EED122327E3399C23D0D647F07B9CD67CCAE28AFD1048A41710DA50126B38E75D7455F56AA95BBECA42D228BF
                                                                                                              Malicious:false
                                                                                                              Preview:MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$........*.w.K.$.K.$.K.$.3.$.K.$.>.%.K.$.$l$.K.$.>.%.K.$.>.%.K.$.>.%.K.$w>.%.K.$w>.%.K.$. .%.K.$. .%.K.$.K.$.I.$w>.%.K.$w>.%.K.$w>n$.K.$w>.%.K.$Rich.K.$................PE..d.....b.........."...........................@....................................q.....`.........................................Pd..P....d..........8....P...^..................................................`...8............................................text.............................. ..`.rdata..^...........................@..@.data...............................@....pdata...^...P...`..................@..@.rsrc...8...........................@..@.reloc..............................@..B................................................................................................................................................................................................................

                                                                                                              C:\Program Files\FastestVPN\Resources\openvpnserv.exe (copy)

                                                                                                              Download File
                                                                                                              Process:C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmp
                                                                                                              File Type:PE32+ executable (console) x86-64, for MS Windows
                                                                                                              Category:dropped
                                                                                                              Size (bytes):68744
                                                                                                              Entropy (8bit):6.03232541602541
                                                                                                              Encrypted:false
                                                                                                              SSDEEP:
                                                                                                              MD5:41E94A80206A87D947CE6CF5823494BE
                                                                                                              SHA1:558214579EE8F2732C36F779E545BA1340191E49
                                                                                                              SHA-256:E4275E6430AE1EC21A5CD0F2FC382998DEBC1E433A66129527C1B69792F09F95
                                                                                                              SHA-512:54B0DD18BA43C48B3FC21E4366D7D1DC65147A84AFA3DC29D94C4CF80B49FA67150B8303F576683F712E648CAFF516BFEA3A6F93435D6B33DCAB2C43BC762E35
                                                                                                              Malicious:false
                                                                                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........z..h...h...h.......h......h......h......h......h......h.......h...h..ih.......h.......h...h...h.......h..Rich.h..........PE..d.....b.........."......r...|.......v.........@.............................@............`.................................................x...T.... .......................0..p...................................@...8............................................text....p.......r.................. ..`.rdata...W.......X...v..............@..@.data...............................@....pdata..............................@..@.rsrc........ ......................@..@.reloc..p....0......................@..B................................................................................................................................................................................................................................................

                                                                                                              C:\Program Files\FastestVPN\Resources\openvpnserv2.exe (copy)

                                                                                                              Download File
                                                                                                              Process:C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmp
                                                                                                              File Type:PE32 executable (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                              Category:dropped
                                                                                                              Size (bytes):27784
                                                                                                              Entropy (8bit):6.488306745612165
                                                                                                              Encrypted:false
                                                                                                              SSDEEP:
                                                                                                              MD5:41C55E2A9D5D9B23C08E3DC067780DC7
                                                                                                              SHA1:1FB62C7FCF24F604676896121C1CCAFB628C1BE1
                                                                                                              SHA-256:D76995DCE5A5A3B0D77ABB438C14504F9825A6BC98676F1BA8D0CC18CEBB0545
                                                                                                              SHA-512:396E8878BAFCFC0DF994B9AF23176D343230B6F6EE82A71E14EFA56347EF0C63B4D277C029EF9FB3EF69D6F1B8AE73ECF92D8DCEDC9312E0C8BFA86EC0B611D2
                                                                                                              Malicious:false
                                                                                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....7X.................6...........T... ...`....@.. ....................................@..................................T..K....`...............>............................................................... ............... ..H............text....4... ...6.................. ..`.rsrc........`.......8..............@..@.reloc...............<..............@..B.................T......H........1..."..........|0..p...........................................6.(.....(....*...0..S............(....o.....s.......o....s.......o......o.........&..o............9.....o.....*.......#..6........../E.......0..E............(....o.....s.......o....s.......o.........&........9.....o.....*.........#../..........!7.......0..M.......~....s......o.....;.....o......#......$@(....o.........&........9.....o.....*...........,7..........4?.......0..M.......~....s......o.....;.....

                                                                                                              C:\Program Files\FastestVPN\Resources\sp\driver\windows7\amd64\fastestvpndriver.sys (copy)

                                                                                                              Download File
                                                                                                              Process:C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmp
                                                                                                              File Type:PE32+ executable (native) x86-64, for MS Windows
                                                                                                              Category:dropped
                                                                                                              Size (bytes):77064
                                                                                                              Entropy (8bit):6.309512423177142
                                                                                                              Encrypted:false
                                                                                                              SSDEEP:
                                                                                                              MD5:760475CD23CE23410F37558452B28545
                                                                                                              SHA1:68ED3626CE9ABE090B960EEB909C4324205DDEF0
                                                                                                              SHA-256:113A6934823339B6873D8CE80F629F37BFA912C4B8201428222025754BFEFA7F
                                                                                                              SHA-512:AB9AEF1013B579784C062D2ED30DAB86DAE541862B7C02FF19943D0987A5C7FC8B12A2C8ABCDB521123DB2E8BC1B806834C80E6C43C33164A004D37A59AE725A
                                                                                                              Malicious:false
                                                                                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......2.#Rv.M.v.M.v.M.v.L...M.....q.M.....r.M.....s.M.......M.....w.M.....w.M.Richv.M.........................PE..d....m.\.........."..........0......d0.......................................`...............................................................0..P....@....... ...............P......P...................................................H............................text...n........................... ..h.rdata..D...........................@..H.data...............................@....pdata....... ......................@..HINIT....d....0...................... ....rsrc........@......................@..B.reloc.......P......................@..B................................................................................................................................................................................................................................

                                                                                                              C:\Program Files\FastestVPN\Resources\sp\driver\windows7\amd64\is-N7JEQ.tmp

                                                                                                              Download File
                                                                                                              Process:C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmp
                                                                                                              File Type:PE32+ executable (native) x86-64, for MS Windows
                                                                                                              Category:dropped
                                                                                                              Size (bytes):77064
                                                                                                              Entropy (8bit):6.309512423177142
                                                                                                              Encrypted:false
                                                                                                              SSDEEP:
                                                                                                              MD5:760475CD23CE23410F37558452B28545
                                                                                                              SHA1:68ED3626CE9ABE090B960EEB909C4324205DDEF0
                                                                                                              SHA-256:113A6934823339B6873D8CE80F629F37BFA912C4B8201428222025754BFEFA7F
                                                                                                              SHA-512:AB9AEF1013B579784C062D2ED30DAB86DAE541862B7C02FF19943D0987A5C7FC8B12A2C8ABCDB521123DB2E8BC1B806834C80E6C43C33164A004D37A59AE725A
                                                                                                              Malicious:false
                                                                                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......2.#Rv.M.v.M.v.M.v.L...M.....q.M.....r.M.....s.M.......M.....w.M.....w.M.Richv.M.........................PE..d....m.\.........."..........0......d0.......................................`...............................................................0..P....@....... ...............P......P...................................................H............................text...n........................... ..h.rdata..D...........................@..H.data...............................@....pdata....... ......................@..HINIT....d....0...................... ....rsrc........@......................@..B.reloc.......P......................@..B................................................................................................................................................................................................................................

                                                                                                              C:\Program Files\FastestVPN\Resources\sp\driver\windows7\i386\fastestvpndriver.sys (copy)

                                                                                                              Download File
                                                                                                              Process:C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmp
                                                                                                              File Type:PE32 executable (native) Intel 80386, for MS Windows
                                                                                                              Category:dropped
                                                                                                              Size (bytes):72304
                                                                                                              Entropy (8bit):6.723888135179154
                                                                                                              Encrypted:false
                                                                                                              SSDEEP:
                                                                                                              MD5:5EE29684A6D1E66FD1590742620448EE
                                                                                                              SHA1:71DB43CA9730411BADD39AB2631A1346EF740AAA
                                                                                                              SHA-256:3506C17F79A4F38482DE5B5835484C7127B9903A9412FB6B668BE441D83D8B30
                                                                                                              SHA-512:5F0E00DAC143ED9995B5FECD023EA950FC7A37691E5A4DEF24DAB0DCBDE058787CD4997BE8B2BBE948E5CCA96E80112F55BA8DE7BDD39D264709813B67FDDC0D
                                                                                                              Malicious:false
                                                                                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........U..f;..f;..f;..f:..f;......f;......f;......f;......f;......f;.Rich.f;.........................PE..L....m.\.....................,......>.......................................................................................P...d.......................p:..........................................0...@............................................text............................... ..h.rdata..`...........................@..H.data...............................@...INIT................................ ....rsrc...............................@..B.reloc..^...........................@..B................................................................................................................................................................................................................................................................................................

                                                                                                              C:\Program Files\FastestVPN\Resources\sp\driver\windows7\i386\is-UE60Q.tmp

                                                                                                              Download File
                                                                                                              Process:C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmp
                                                                                                              File Type:PE32 executable (native) Intel 80386, for MS Windows
                                                                                                              Category:dropped
                                                                                                              Size (bytes):72304
                                                                                                              Entropy (8bit):6.723888135179154
                                                                                                              Encrypted:false
                                                                                                              SSDEEP:
                                                                                                              MD5:5EE29684A6D1E66FD1590742620448EE
                                                                                                              SHA1:71DB43CA9730411BADD39AB2631A1346EF740AAA
                                                                                                              SHA-256:3506C17F79A4F38482DE5B5835484C7127B9903A9412FB6B668BE441D83D8B30
                                                                                                              SHA-512:5F0E00DAC143ED9995B5FECD023EA950FC7A37691E5A4DEF24DAB0DCBDE058787CD4997BE8B2BBE948E5CCA96E80112F55BA8DE7BDD39D264709813B67FDDC0D
                                                                                                              Malicious:false
                                                                                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........U..f;..f;..f;..f:..f;......f;......f;......f;......f;......f;.Rich.f;.........................PE..L....m.\.....................,......>.......................................................................................P...d.......................p:..........................................0...@............................................text............................... ..h.rdata..`...........................@..H.data...............................@...INIT................................ ....rsrc...............................@..B.reloc..^...........................@..B................................................................................................................................................................................................................................................................................................

                                                                                                              C:\Program Files\FastestVPN\Resources\sp\driver\windows8\amd64\fastestvpndriver.sys (copy)

                                                                                                              Download File
                                                                                                              Process:C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmp
                                                                                                              File Type:PE32+ executable (native) x86-64, for MS Windows
                                                                                                              Category:dropped
                                                                                                              Size (bytes):104424
                                                                                                              Entropy (8bit):6.366713641084616
                                                                                                              Encrypted:false
                                                                                                              SSDEEP:
                                                                                                              MD5:95FD4F27F82A9E4D6E2A53AF7A9096E6
                                                                                                              SHA1:5F772C89901841AF1814C858359AC5FEB9BE3C24
                                                                                                              SHA-256:98CD2F27906E4FD7FA7FBE0EC747BADEF710BCA736A1AC5EE883756F2185818C
                                                                                                              SHA-512:6B2E2BA90B33F6658C903203317299057C83545D46549D468CDAA1D6F7BCE887310411B9BF6EEA9D19C214A2041BB5E14FD9395CC4E2FE9FC31AB03B88A75019
                                                                                                              Malicious:false
                                                                                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......>.d.z...z...z.....~...z.........}.....}...Y@..s....A..{....A..{...Richz...........................PE..d... [.\.........."..........L.................@....................................C.....`.................................................8p..P.......H....`.......R...E..........`#..8............................(..p............ ..`............................text...d........................... ..h.rdata....... ......................@..H.data...@....@.......$..............@....pdata.......`.......,..............@..HINIT.........p.......:.............. ....rsrc...H............J..............@..B.reloc...............P..............@..B................................................................................................................................................................................................................................

                                                                                                              C:\Program Files\FastestVPN\Resources\sp\driver\windows8\amd64\is-JUHU2.tmp

                                                                                                              Download File
                                                                                                              Process:C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmp
                                                                                                              File Type:PE32+ executable (native) x86-64, for MS Windows
                                                                                                              Category:dropped
                                                                                                              Size (bytes):104424
                                                                                                              Entropy (8bit):6.366713641084616
                                                                                                              Encrypted:false
                                                                                                              SSDEEP:
                                                                                                              MD5:95FD4F27F82A9E4D6E2A53AF7A9096E6
                                                                                                              SHA1:5F772C89901841AF1814C858359AC5FEB9BE3C24
                                                                                                              SHA-256:98CD2F27906E4FD7FA7FBE0EC747BADEF710BCA736A1AC5EE883756F2185818C
                                                                                                              SHA-512:6B2E2BA90B33F6658C903203317299057C83545D46549D468CDAA1D6F7BCE887310411B9BF6EEA9D19C214A2041BB5E14FD9395CC4E2FE9FC31AB03B88A75019
                                                                                                              Malicious:false
                                                                                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......>.d.z...z...z.....~...z.........}.....}...Y@..s....A..{....A..{...Richz...........................PE..d... [.\.........."..........L.................@....................................C.....`.................................................8p..P.......H....`.......R...E..........`#..8............................(..p............ ..`............................text...d........................... ..h.rdata....... ......................@..H.data...@....@.......$..............@....pdata.......`.......,..............@..HINIT.........p.......:.............. ....rsrc...H............J..............@..B.reloc...............P..............@..B................................................................................................................................................................................................................................

                                                                                                              C:\Program Files\FastestVPN\Resources\sp\driver\windows8\i386\fastestvpndriver.sys (copy)

                                                                                                              Download File
                                                                                                              Process:C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmp
                                                                                                              File Type:PE32+ executable (native) x86-64, for MS Windows
                                                                                                              Category:dropped
                                                                                                              Size (bytes):104424
                                                                                                              Entropy (8bit):6.366713641084616
                                                                                                              Encrypted:false
                                                                                                              SSDEEP:
                                                                                                              MD5:95FD4F27F82A9E4D6E2A53AF7A9096E6
                                                                                                              SHA1:5F772C89901841AF1814C858359AC5FEB9BE3C24
                                                                                                              SHA-256:98CD2F27906E4FD7FA7FBE0EC747BADEF710BCA736A1AC5EE883756F2185818C
                                                                                                              SHA-512:6B2E2BA90B33F6658C903203317299057C83545D46549D468CDAA1D6F7BCE887310411B9BF6EEA9D19C214A2041BB5E14FD9395CC4E2FE9FC31AB03B88A75019
                                                                                                              Malicious:false
                                                                                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......>.d.z...z...z.....~...z.........}.....}...Y@..s....A..{....A..{...Richz...........................PE..d... [.\.........."..........L.................@....................................C.....`.................................................8p..P.......H....`.......R...E..........`#..8............................(..p............ ..`............................text...d........................... ..h.rdata....... ......................@..H.data...@....@.......$..............@....pdata.......`.......,..............@..HINIT.........p.......:.............. ....rsrc...H............J..............@..B.reloc...............P..............@..B................................................................................................................................................................................................................................

                                                                                                              C:\Program Files\FastestVPN\Resources\sp\driver\windows8\i386\is-T910E.tmp

                                                                                                              Download File
                                                                                                              Process:C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmp
                                                                                                              File Type:PE32+ executable (native) x86-64, for MS Windows
                                                                                                              Category:dropped
                                                                                                              Size (bytes):104424
                                                                                                              Entropy (8bit):6.366713641084616
                                                                                                              Encrypted:false
                                                                                                              SSDEEP:
                                                                                                              MD5:95FD4F27F82A9E4D6E2A53AF7A9096E6
                                                                                                              SHA1:5F772C89901841AF1814C858359AC5FEB9BE3C24
                                                                                                              SHA-256:98CD2F27906E4FD7FA7FBE0EC747BADEF710BCA736A1AC5EE883756F2185818C
                                                                                                              SHA-512:6B2E2BA90B33F6658C903203317299057C83545D46549D468CDAA1D6F7BCE887310411B9BF6EEA9D19C214A2041BB5E14FD9395CC4E2FE9FC31AB03B88A75019
                                                                                                              Malicious:false
                                                                                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......>.d.z...z...z.....~...z.........}.....}...Y@..s....A..{....A..{...Richz...........................PE..d... [.\.........."..........L.................@....................................C.....`.................................................8p..P.......H....`.......R...E..........`#..8............................(..p............ ..`............................text...d........................... ..h.rdata....... ......................@..H.data...@....@.......$..............@....pdata.......`.......,..............@..HINIT.........p.......:.............. ....rsrc...H............J..............@..B.reloc...............P..............@..B................................................................................................................................................................................................................................

                                                                                                              C:\Program Files\FastestVPN\Resources\sp\install_sp.bat (copy)

                                                                                                              Download File
                                                                                                              Process:C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmp
                                                                                                              File Type:DOS batch file, ASCII text, with CRLF line terminators
                                                                                                              Category:dropped
                                                                                                              Size (bytes):527
                                                                                                              Entropy (8bit):5.160291198458603
                                                                                                              Encrypted:false
                                                                                                              SSDEEP:
                                                                                                              MD5:39B9357BA2B8B640ACFAE47275B80C56
                                                                                                              SHA1:0A80D68131736FB29C71D66CEBED9D59258F86DB
                                                                                                              SHA-256:76E9F6F16C00F33BE1717AE60A1FAFA0F90609508F7D613556B145E4C89D103A
                                                                                                              SHA-512:D3144461AC37E13100BE3444586163CCB8A6B767DCD0B7A26353172FD86C06D7AC31CD209C1E472B9DCAF0D5E3CCD80AF78A15B48BE72E4AFBBCB6747338DDCB
                                                                                                              Malicious:false
                                                                                                              Preview:@echo off..@cd /d %~dp0..start sc stop fastestvpndriver..del %systemroot%\system32\drivers\fastestvpndriver.sys....reg Query "HKLM\Hardware\Description\System\CentralProcessor\0" | find /i "x86" > NUL && set ARCH=i386 || set ARCH=amd64..reg QUERY "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion" | find /i "Windows 7" > NUL && set OS=windows7 || set OS=windows8....xcopy /y driver\%OS%\%ARCH%\fastestvpndriver.sys %systemroot%\system32\drivers..release\nfregdrv.exe -u fastestvpndriver..release\nfregdrv.exe fastestvpndriver

                                                                                                              C:\Program Files\FastestVPN\Resources\sp\is-EIAT9.tmp

                                                                                                              Download File
                                                                                                              Process:C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmp
                                                                                                              File Type:DOS batch file, ASCII text, with CRLF line terminators
                                                                                                              Category:dropped
                                                                                                              Size (bytes):153
                                                                                                              Entropy (8bit):4.487708026306449
                                                                                                              Encrypted:false
                                                                                                              SSDEEP:
                                                                                                              MD5:2D0CB38D144B0F1A34BD6F715D697658
                                                                                                              SHA1:65B935BEEE274E0BB6C069CB8FC1022E187ECAE2
                                                                                                              SHA-256:DFEE16836EBD2D8E76D0EE660F9B22154A3513591061FF9EF9E540094DDEA8F6
                                                                                                              SHA-512:472D2F8D2C58BC96C100674995A580F0EA3A60F42971A850582CEDB4B9108D42F7CE8D87410203C50EAD3F16B9CA92F3DDB1B4D543F2418FEF6259E754359987
                                                                                                              Malicious:false
                                                                                                              Preview:@echo off..@cd /d %~dp0..start sc stop fastestvpndriver..del %systemroot%\system32\drivers\fastestvpndriver.sys..release\nfregdrv.exe -u fastestvpndriver

                                                                                                              C:\Program Files\FastestVPN\Resources\sp\is-MDD17.tmp

                                                                                                              Download File
                                                                                                              Process:C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmp
                                                                                                              File Type:DOS batch file, ASCII text, with CRLF line terminators
                                                                                                              Category:dropped
                                                                                                              Size (bytes):527
                                                                                                              Entropy (8bit):5.160291198458603
                                                                                                              Encrypted:false
                                                                                                              SSDEEP:
                                                                                                              MD5:39B9357BA2B8B640ACFAE47275B80C56
                                                                                                              SHA1:0A80D68131736FB29C71D66CEBED9D59258F86DB
                                                                                                              SHA-256:76E9F6F16C00F33BE1717AE60A1FAFA0F90609508F7D613556B145E4C89D103A
                                                                                                              SHA-512:D3144461AC37E13100BE3444586163CCB8A6B767DCD0B7A26353172FD86C06D7AC31CD209C1E472B9DCAF0D5E3CCD80AF78A15B48BE72E4AFBBCB6747338DDCB
                                                                                                              Malicious:false
                                                                                                              Preview:@echo off..@cd /d %~dp0..start sc stop fastestvpndriver..del %systemroot%\system32\drivers\fastestvpndriver.sys....reg Query "HKLM\Hardware\Description\System\CentralProcessor\0" | find /i "x86" > NUL && set ARCH=i386 || set ARCH=amd64..reg QUERY "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion" | find /i "Windows 7" > NUL && set OS=windows7 || set OS=windows8....xcopy /y driver\%OS%\%ARCH%\fastestvpndriver.sys %systemroot%\system32\drivers..release\nfregdrv.exe -u fastestvpndriver..release\nfregdrv.exe fastestvpndriver

                                                                                                              C:\Program Files\FastestVPN\Resources\sp\release\is-8GLTJ.tmp

                                                                                                              Download File
                                                                                                              Process:C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmp
                                                                                                              File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                              Category:dropped
                                                                                                              Size (bytes):159368
                                                                                                              Entropy (8bit):6.430638214966169
                                                                                                              Encrypted:false
                                                                                                              SSDEEP:
                                                                                                              MD5:E7C064693750D51F5AC901A0CF0A987A
                                                                                                              SHA1:0FFE9BAE9054D779F60CE8E0E72D386401C0AF7D
                                                                                                              SHA-256:6138C9EC5082350F9223E87991A779457662FAD1AE937ADFD7229DA509810A14
                                                                                                              SHA-512:12E2CF49B1DA8BD4CEC556F1C816678B7E04D08ED71D94F5734DA6B73AE73E79EC09593CFCF2A27AF73C32645435CF52B127EFB8BACB94C9638249E1365A3CBB
                                                                                                              Malicious:false
                                                                                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......Jx.....................)......)..d...).."...............y...)......)......)......)......Rich............PE..L......]...........!........................................................`......8c.............................. ...........P.... ..`............@.......0......0..................................@............................................text...0|.......................... ..`.rdata...J.......P..................@..@.data...,6....... ..................@....rsrc...`.... ......................@..@.reloc...(...0...0..................@..B........................................................................................................................................................................................................................................................................................................................

                                                                                                              C:\Program Files\FastestVPN\Resources\sp\release\is-UGM5N.tmp

                                                                                                              Download File
                                                                                                              Process:C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmp
                                                                                                              File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                              Category:dropped
                                                                                                              Size (bytes):61064
                                                                                                              Entropy (8bit):6.255909242219927
                                                                                                              Encrypted:false
                                                                                                              SSDEEP:
                                                                                                              MD5:9333F583E2D32A47276DCEC7C2391FD2
                                                                                                              SHA1:8757F8136354B7F98407CEBFE8BDA6043972D88E
                                                                                                              SHA-256:AF36609DF5F1F9375354E68E2B8EA57059E44DEC3D089CD9EA509F0816D71294
                                                                                                              SHA-512:922578EFA998B4B92192F3A6839059C01406997F3DBEF0DE70C7BA3F6D73CBDEA04470CD6C214778AAB59EB7602AC354750AE5D97C66286F1215BC415B273222
                                                                                                              Malicious:false
                                                                                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......zRl.>3..>3..>3.......3....l.$3....o.v3...<_.<3....y.;3..>3..q3....p.?3....z.?3..Rich>3..................PE..L....K.Q.................p...@......@.............@.................................{.......................................\...P...................................@...................................@............................................text....c.......p.................. ..`.rdata........... ..................@..@.data...|...........................@....rsrc...............................@..@........................................................................................................................................................................................................................................................................................................................................................................

                                                                                                              C:\Program Files\FastestVPN\Resources\sp\release\nfapi.dll (copy)

                                                                                                              Download File
                                                                                                              Process:C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmp
                                                                                                              File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                              Category:dropped
                                                                                                              Size (bytes):159368
                                                                                                              Entropy (8bit):6.430638214966169
                                                                                                              Encrypted:false
                                                                                                              SSDEEP:
                                                                                                              MD5:E7C064693750D51F5AC901A0CF0A987A
                                                                                                              SHA1:0FFE9BAE9054D779F60CE8E0E72D386401C0AF7D
                                                                                                              SHA-256:6138C9EC5082350F9223E87991A779457662FAD1AE937ADFD7229DA509810A14
                                                                                                              SHA-512:12E2CF49B1DA8BD4CEC556F1C816678B7E04D08ED71D94F5734DA6B73AE73E79EC09593CFCF2A27AF73C32645435CF52B127EFB8BACB94C9638249E1365A3CBB
                                                                                                              Malicious:false
                                                                                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......Jx.....................)......)..d...).."...............y...)......)......)......)......Rich............PE..L......]...........!........................................................`......8c.............................. ...........P.... ..`............@.......0......0..................................@............................................text...0|.......................... ..`.rdata...J.......P..................@..@.data...,6....... ..................@....rsrc...`.... ......................@..@.reloc...(...0...0..................@..B........................................................................................................................................................................................................................................................................................................................

                                                                                                              C:\Program Files\FastestVPN\Resources\sp\release\nfregdrv.exe (copy)

                                                                                                              Download File
                                                                                                              Process:C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmp
                                                                                                              File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                              Category:dropped
                                                                                                              Size (bytes):61064
                                                                                                              Entropy (8bit):6.255909242219927
                                                                                                              Encrypted:false
                                                                                                              SSDEEP:
                                                                                                              MD5:9333F583E2D32A47276DCEC7C2391FD2
                                                                                                              SHA1:8757F8136354B7F98407CEBFE8BDA6043972D88E
                                                                                                              SHA-256:AF36609DF5F1F9375354E68E2B8EA57059E44DEC3D089CD9EA509F0816D71294
                                                                                                              SHA-512:922578EFA998B4B92192F3A6839059C01406997F3DBEF0DE70C7BA3F6D73CBDEA04470CD6C214778AAB59EB7602AC354750AE5D97C66286F1215BC415B273222
                                                                                                              Malicious:false
                                                                                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......zRl.>3..>3..>3.......3....l.$3....o.v3...<_.<3....y.;3..>3..q3....p.?3....z.?3..Rich>3..................PE..L....K.Q.................p...@......@.............@.................................{.......................................\...P...................................@...................................@............................................text....c.......p.................. ..`.rdata........... ..................@..@.data...|...........................@....rsrc...............................@..@........................................................................................................................................................................................................................................................................................................................................................................

                                                                                                              C:\Program Files\FastestVPN\Resources\sp\uninstall_sp.bat (copy)

                                                                                                              Download File
                                                                                                              Process:C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmp
                                                                                                              File Type:DOS batch file, ASCII text, with CRLF line terminators
                                                                                                              Category:dropped
                                                                                                              Size (bytes):153
                                                                                                              Entropy (8bit):4.487708026306449
                                                                                                              Encrypted:false
                                                                                                              SSDEEP:
                                                                                                              MD5:2D0CB38D144B0F1A34BD6F715D697658
                                                                                                              SHA1:65B935BEEE274E0BB6C069CB8FC1022E187ECAE2
                                                                                                              SHA-256:DFEE16836EBD2D8E76D0EE660F9B22154A3513591061FF9EF9E540094DDEA8F6
                                                                                                              SHA-512:472D2F8D2C58BC96C100674995A580F0EA3A60F42971A850582CEDB4B9108D42F7CE8D87410203C50EAD3F16B9CA92F3DDB1B4D543F2418FEF6259E754359987
                                                                                                              Malicious:false
                                                                                                              Preview:@echo off..@cd /d %~dp0..start sc stop fastestvpndriver..del %systemroot%\system32\drivers\fastestvpndriver.sys..release\nfregdrv.exe -u fastestvpndriver

                                                                                                              C:\Program Files\FastestVPN\Resources\ssleay32.dll (copy)

                                                                                                              Download File
                                                                                                              Process:C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmp
                                                                                                              File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                                                                              Category:dropped
                                                                                                              Size (bytes):585512
                                                                                                              Entropy (8bit):6.002108518534667
                                                                                                              Encrypted:false
                                                                                                              SSDEEP:
                                                                                                              MD5:2C700BBCDA59BFE2CD7EBF9BAA5B2626
                                                                                                              SHA1:72EFAA0E8652FB4ADC21E4484E7F63AA968F39D2
                                                                                                              SHA-256:C9C59AB5B3369B97C85129F160491BD743B68DE1AD41EE6EEBA69009407B54E7
                                                                                                              SHA-512:0911C7FED9653D9D50BAD7219E45778367DE4B105B5079A8011415F65465B80782A98A503CEBFB309997BCFB2A8620402579456565A24C69A20CBCBD0130DA20
                                                                                                              Malicious:false
                                                                                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....$.Y...........!..............................`n.........................p......L.....@... .........................m).......3...0..@....................@...)........................... .......................................................text...T...........................`.P`.data....-..........................@.`..rdata..............................@.`@.bss....d.............................`..edata..m).......*...t..............@.0@.idata...3.......4..................@.0..CRT....,...........................@.0..tls.... .... ......................@.0..rsrc...@....0......................@.0..reloc...)...@...*..................@.0B/4...........p......................@..B/19......l.......n..................@..B/31...../............v..............@..B/45.....|...........................@..B/57..........0......................@.0B/70.....2....@..........

                                                                                                              C:\Program Files\FastestVPN\Resources\status.dat (copy)

                                                                                                              Download File
                                                                                                              Process:C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmp
                                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                                              Category:dropped
                                                                                                              Size (bytes):277
                                                                                                              Entropy (8bit):5.0491979415178765
                                                                                                              Encrypted:false
                                                                                                              SSDEEP:
                                                                                                              MD5:C8768E552ABCA40175C704E4AF1F030C
                                                                                                              SHA1:7B8A3BC3310EE72006FD2C5A4D5F4FC60171C81B
                                                                                                              SHA-256:50259EEA13E0A9CB0AC48181F8F4345E6558EE8536CC71D0F6E2F63AE9D89D33
                                                                                                              SHA-512:09FD06DB34894F1EC79B607217DC70E204793E04C58B846DC495DC915F38C1311AC1EE0D3C5CCDE636D8A3D6CE5631EF7291D3617FB3F900FD072CEA5831B573
                                                                                                              Malicious:false
                                                                                                              Preview:OpenVPN STATISTICS..Updated,2023-09-03 07:45:36..TUN/TAP read bytes,1979..TUN/TAP write bytes,9103..TCP/UDP read bytes,15521..TCP/UDP write bytes,5150..Auth read bytes,9103..pre-compress bytes,0..post-compress bytes,0..pre-decompress bytes,204..post-decompress bytes,213..END..

                                                                                                              C:\Program Files\FastestVPN\Resources\tapctl.exe (copy)

                                                                                                              Download File
                                                                                                              Process:C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmp
                                                                                                              File Type:PE32+ executable (console) x86-64, for MS Windows
                                                                                                              Category:dropped
                                                                                                              Size (bytes):42120
                                                                                                              Entropy (8bit):6.157445136592099
                                                                                                              Encrypted:false
                                                                                                              SSDEEP:
                                                                                                              MD5:F6AFD5499FCC5D464085AD889BAE09B7
                                                                                                              SHA1:287C540655FCED0C09DDA2D9C4EADD3F3E210B17
                                                                                                              SHA-256:6EDA54D746C092A45395399319DFC878E5674C84FAB8147821524A0042C03F47
                                                                                                              SHA-512:BFD5ED90D0F16A2F0BCC22B0E847D5781A7B11D6912A51CDC8FCAAD80BF191D821418F7544BF52BF6E1AAA47D06A5442601543E9C25B2352D4E23AFC0C4668F9
                                                                                                              Malicious:false
                                                                                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......kT../5../5../5..&M<.#5..}@..-5..}@..=5..}@..%5..}@..,5..;^..$5../5..p5...@..,5...@P..5...@...5..Rich/5..........PE..d.....b.........."......0...H.......4.........@....................................e.....`.................................................4g..........@............v..........8...P]...............................]..8............@...............................text..../.......0.................. ..`.rdata...3...@...4...4..............@..@.data...H............h..............@....pdata...............j..............@..@.rsrc...@............n..............@..@.reloc..8............t..............@..B................................................................................................................................................................................................................................................................

                                                                                                              C:\Program Files\FastestVPN\Resources\tapinstall.exe (copy)

                                                                                                              Download File
                                                                                                              Process:C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmp
                                                                                                              File Type:PE32+ executable (console) x86-64, for MS Windows
                                                                                                              Category:dropped
                                                                                                              Size (bytes):94856
                                                                                                              Entropy (8bit):5.499392443352034
                                                                                                              Encrypted:false
                                                                                                              SSDEEP:
                                                                                                              MD5:834EE5DA601A6C78C43C64F6C282682F
                                                                                                              SHA1:03920B402B787CA53CD79A66B0B611C899B91F3E
                                                                                                              SHA-256:754B61DA108CC9379585E18DDCE90A8092C1B17DA5D922A6E8D6CE84A90B0F87
                                                                                                              SHA-512:C4A6A49D1EE316FB9EA399487EA17DD813C0A611F473F4FD054D07F6D5C6BB786D40FA478254A499DB3E1D5F0AFDA3B72651EF097945D0C3AA9F0D83D9C0ED06
                                                                                                              Malicious:false
                                                                                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........V........-.....;......<.......+....%......S....%......2....~......,.....)...Rich..........PE..d...<..W..........".................Tv..............................................I.....@.......... ..................................................h.......l....D.......p..........................................................X............................text............................... ..`.data...............................@....pdata..l...........................@..@.rsrc...h...........................@..@.reloc..z....p.......B..............@..B................................................................................................................................................................................................................................................................................................

                                                                                                              C:\Program Files\FastestVPN\Resources\tapinstallWin32.exe (copy)

                                                                                                              Download File
                                                                                                              Process:C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmp
                                                                                                              File Type:PE32 executable (console) Intel 80386, for MS Windows
                                                                                                              Category:dropped
                                                                                                              Size (bytes):89736
                                                                                                              Entropy (8bit):5.522767465825831
                                                                                                              Encrypted:false
                                                                                                              SSDEEP:
                                                                                                              MD5:2CC3AC572A2170108BABD019F0BFE779
                                                                                                              SHA1:AF962245CE32D5801A380FF7F6B8C87AC7772AB2
                                                                                                              SHA-256:755315DFCC9C72CBE4EB33AF34E9AAC0BD1324C6942F4B56AD9FE0135E1A9299
                                                                                                              SHA-512:891D545DDF35BF8C650FE8EB48A5E5F6F7C50036E42BE893417AF2EF886EB37C5BEEE9DD838A8F020728E4BAE803F2753CC8F6DD7958DD31B5B39DAED7EF464B
                                                                                                              Malicious:false
                                                                                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........L..."..."..."....."......"......"...#.S."....."..`\..."......"......".Rich..".................PE..L...#.pK.................l..........Td.......................................P......0a....@...... ..........................lm..........p............0.......@...... ...............................0...@............................................text... j.......l.................. ..`.data...4............p..............@....rsrc...p............v..............@..@.reloc.......@.......&..............@..B........................................................................................................................................................................................................................................................................................................................................................................

                                                                                                              C:\Program Files\FastestVPN\Resources\tapinstallWin64.exe (copy)

                                                                                                              Download File
                                                                                                              Process:C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmp
                                                                                                              File Type:PE32+ executable (console) x86-64, for MS Windows
                                                                                                              Category:dropped
                                                                                                              Size (bytes):93832
                                                                                                              Entropy (8bit):5.485112927422894
                                                                                                              Encrypted:false
                                                                                                              SSDEEP:
                                                                                                              MD5:8E7EE7C3876683902475753519681407
                                                                                                              SHA1:75FACB7F9C59B284F97956E799E57FB0F606C49D
                                                                                                              SHA-256:6D5041A8EF796C66BA151D8FCFAFDD96BCAA99B57D2777897FD25A87A5E41E13
                                                                                                              SHA-512:523EBF3A4DF9F6D299E72079DEF0A0DA9127601796D9AA613B70AD2F66EE2166F4F8F75083F47E67FFFD892A09FA437F3B12BD1B27065200E90F8617E3E83727
                                                                                                              Malicious:false
                                                                                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........X...9...9...9...AF..9...AW..9...A@..9...9..f9...AP.9...AY..9.......9...AG..9...AB..9..Rich.9..........................PE..d.....pK.........."......~...........s.......................................p............@.......... ......................................X}..........p.......T....@.......`......0................................................................................text....|.......~.................. ..`.data...x...........................@....pdata..T...........................@..@.rsrc...p...........................@..@.reloc..p....`.......>..............@..B................................................................................................................................................................................................................................................................................................

                                                                                                              C:\Program Files\FastestVPN\Resources\vcruntime140.dll (copy)

                                                                                                              Download File
                                                                                                              Process:C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmp
                                                                                                              File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                              Category:dropped
                                                                                                              Size (bytes):99976
                                                                                                              Entropy (8bit):6.499161413646961
                                                                                                              Encrypted:false
                                                                                                              SSDEEP:
                                                                                                              MD5:85054BAF6D0A7D31A18183ACC4CBA133
                                                                                                              SHA1:24830C002FFAB31102DFB674B52AFFD74E90E708
                                                                                                              SHA-256:EC86F182F55A338E26F598638F18422E474C6D6C651E1D9955D0303254BF6DDD
                                                                                                              SHA-512:B6B7D9115ED1D734D7C0EB09E7C7C96EEC29E2C59B8943586976F2182E46B660B99C1947ACF2C1DEB75595771A78B7405FDDBB989A2F06CF88E4AD3D8824055A
                                                                                                              Malicious:false
                                                                                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......*..qn.."n.."n.."...#l.."g.."e.."n.."B.."<..#c.."<..#~.."<..#q.."<..#o.."<.g"o.."<..#o.."Richn.."................PE..d.....`.........." .........`......p................................................>....`A.........................................B..4....J...............p..X....X..............h,..T............................,..8............................................text............................... ..`.rdata...@.......B..................@..@.data...@....`.......@..............@....pdata..X....p.......D..............@..@_RDATA...............P..............@..@.rsrc................R..............@..@.reloc...............V..............@..B........................................................................................................................................................................................................................

                                                                                                              C:\Program Files\FastestVPN\Resources\wireguard.exe (copy)

                                                                                                              Download File
                                                                                                              Process:C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmp
                                                                                                              File Type:PE32+ executable (GUI) x86-64 (stripped to external PDB), for MS Windows
                                                                                                              Category:dropped
                                                                                                              Size (bytes):8184456
                                                                                                              Entropy (8bit):6.15917051663501
                                                                                                              Encrypted:false
                                                                                                              SSDEEP:
                                                                                                              MD5:5850A25689FA1B36CD6B76E2E7F6BDB3
                                                                                                              SHA1:299CEBD4CD448239BF5094DCC0632100287C0B85
                                                                                                              SHA-256:803870B4FCC1A8C0675EE1D5AA5DEB4132514974CDF0F8F7BA40035377FFDCFA
                                                                                                              SHA-512:F64A196D0FE937112604D7B0CFE2099928987ECEAA650728C88ECE9BAEF288AF2E4BCDD52D3199D8787290F5071287DAFA5DC6FD44775E52CA1E04237411888F
                                                                                                              Malicious:false
                                                                                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d.........].......".......'..........=........@.......................................}...`... ...............................................c.|.... d.t.............|...... c.....................................................`SY.@............................text.....'.......'................. ..`.rdata..PC1...(..D1...'.............@..@.data... ....PY......0Y.............@....idata..|.....c.......\.............@....reloc....... c.......\.............@..B.symtab.......d.......]................B.rsrc...t.... d.......].............@..@........................................................................................................................................................................................................................................................................................................................................

                                                                                                              C:\Program Files\FastestVPN\SQLitePCLRaw.batteries_v2.dll (copy)

                                                                                                              Download File
                                                                                                              Process:C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmp
                                                                                                              File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                              Category:dropped
                                                                                                              Size (bytes):22184
                                                                                                              Entropy (8bit):6.685941492131545
                                                                                                              Encrypted:false
                                                                                                              SSDEEP:
                                                                                                              MD5:AAA9DA932D572F5B22CBEE1B4E479ED6
                                                                                                              SHA1:D708727DED1298610C2E3D72C8792F12FC60CFF2
                                                                                                              SHA-256:73B55714DB609A1712FD4FC420CE18441E41BB7E3E94D73B11AE28C68CCB1124
                                                                                                              SHA-512:40A8E2CB18FB2D68F0945B6FBF259FA9331327116A6D21A85AAE6AA12600F7FDD3737B5E84E0AE04C584442016882926D9201E16C25EB937838C8BAC24358779
                                                                                                              Malicious:false
                                                                                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...z............." ..0.."...........A... ...`....... ...............................6....`..................................A..O....`..`............,...*...........@..T............................................ ............... ..H............text...."... ...".................. ..`.rsrc...`....`.......$..............@..@.reloc...............*..............@..B.................A......H........'.......................@.......................................(....*..0...............(....o........(....s....*...0............(.......(....s....(....*6r...p..(....*.0.._.......s!.....s....}.....{....r...p.r'..p(....o.........."...s....(....%~....(....,..{....o....s....z*..0..#.......(......-...(....*..3...(....*s....z...(....%~....(....,.r=..p.r'..p(....s....z*..0..#.......(......-..(....&*..3..(....&*s....z..0..7..........~....%-.&~..........s....%.....(.........

                                                                                                              C:\Program Files\FastestVPN\SQLitePCLRaw.core.dll (copy)

                                                                                                              Download File
                                                                                                              Process:C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmp
                                                                                                              File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                              Category:dropped
                                                                                                              Size (bytes):61608
                                                                                                              Entropy (8bit):6.287396747644481
                                                                                                              Encrypted:false
                                                                                                              SSDEEP:
                                                                                                              MD5:A760AEACBE049C8C0D5DD66DD9EAA7A0
                                                                                                              SHA1:975896722F2D5A365621EE407ACE3E3294CFC1C3
                                                                                                              SHA-256:C3618538771839CBC6A855E41A1664D5B86313070FC75CA1B58EF74D007DBDE4
                                                                                                              SHA-512:64CF42CF493686A4286320819D10A37CC075088509866E867A341651B7762FFD88750417E3AD72E6FA78908DD17C66363752E5AA2955066BA4930889D36AE3CA
                                                                                                              Malicious:false
                                                                                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....b..........." ..0.................. ........... ....................... .......L....`.....................................O.......0................*..............T............................................ ............... ..H............text........ ...................... ..`.rsrc...0...........................@..@.reloc..............................@..B........................H.......@@..<...........|.................................................(....*..(....*..(....*.......*Z~....,.*.oB...&......*.......*b~....-.r...ps....z~....*.(#...o8...*.0..........(#......o9.....(....Q*6.(.....(%...*.0..........(#........o:.....(....Q*R.(.......(....('...*:(#......o?...*N.(.....(.....()...*2(#....o;...*2(#....o<...*..o....*..o....*2(#....o=...*2(#....o>...*6(#.....o....*...0..........s"......}"....{"...-...+....#...s.......(1...*6(#.....o....*6..(....(3..

                                                                                                              C:\Program Files\FastestVPN\SQLitePCLRaw.provider.dynamic_cdecl.dll (copy)

                                                                                                              Download File
                                                                                                              Process:C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmp
                                                                                                              File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                              Category:dropped
                                                                                                              Size (bytes):75432
                                                                                                              Entropy (8bit):6.020201057914009
                                                                                                              Encrypted:false
                                                                                                              SSDEEP:
                                                                                                              MD5:8DC8D595216B1D7703575B77282F7147
                                                                                                              SHA1:5FBA510AB9D9677B5AF28757BFCFC3E6EE3228F5
                                                                                                              SHA-256:7A8833790323071279C55854F35A1A802BF5D5766CABCFA381889460F95D5864
                                                                                                              SHA-512:F1E79E49CF5F10C9BC88D2AAA078FABD772027360A8C9692334AC3BBCDFEEDD93C2C6234F4DE6C6B4AFBD443FD6315633FE8943229EE0CB8CA6A6F29C2AE97EE
                                                                                                              Malicious:false
                                                                                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...e.Z..........." ..0.............".... ... ....... .......................`......E.....`.....................................O.... ...................*...@..........T............................................ ............... ..H............text...(.... ...................... ..`.rsrc........ ......................@..@.reloc.......@......................@..B........................H.......pG...................... .......................................6.......(....*.~....*F~J......o.......*N........s....o...+*..0............(........~......o2...*.0............(........~K.....o....*.0..%.........(..........(........~L.......o....*....0..H.........(..........(........~M....o.............(....(.........{........o....*2~$....o....*2~#....o....*2~H....oz...*6~I.....o~...*:~J......o....*2~%....o....*2~&....o....*>.(.......o....*...0..N........,........s.....

                                                                                                              C:\Program Files\FastestVPN\Service\FastestVPN.Common.dll (copy)

                                                                                                              Download File
                                                                                                              Process:C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmp
                                                                                                              File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                              Category:dropped
                                                                                                              Size (bytes):70824
                                                                                                              Entropy (8bit):6.236705505937758
                                                                                                              Encrypted:false
                                                                                                              SSDEEP:
                                                                                                              MD5:F7543F2749BAB00FB981A41BE19734F8
                                                                                                              SHA1:8BE0A90C7C011EEF0A775A518F2A29CE4AB035AA
                                                                                                              SHA-256:634CD208B4FE8DB050AC7D782CB953D51E266B62369F0F80B0CF9D10D077A76F
                                                                                                              SHA-512:160FBEB4AE704D00800656274B7680003C64559867ACEFB9274A23A1AEE45A145254E66DF423653CC3776A2FFA2A4F98BA93510109CF9963AED4CEBA2913A106
                                                                                                              Malicious:false
                                                                                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.... F..........." ..0.............J.... ... ....... .......................`............`.....................................O.... ...................*...@......D...8............................................ ............... ..H............text...P.... ...................... ..`.rsrc........ ......................@..@.reloc.......@......................@..B................,.......H.......0<................................................................("...*^.("......I...%...}....*:.(".....}....*b.{....%-.&*..s#...o$...*.0..)........{.........(%...t......|......(...+...3.*....0..)........{.........('...t......|......(...+...3.*..((...*..{....*"..}....*..{....*"..}....*..{....*"..}....*2.(....s)...*..{....*"..}....*..{....*"..}....*..{....*"..}....*..((...*..{....*"..}....*..{....*"..}....*..{....*"..}....*..{....*"..}....*..((...*..{....*"..}....*..{

                                                                                                              C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.InstallLog

                                                                                                              Download File
                                                                                                              Process:C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe
                                                                                                              File Type:Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                                                                                                              Category:dropped
                                                                                                              Size (bytes):1685
                                                                                                              Entropy (8bit):4.793020246491965
                                                                                                              Encrypted:false
                                                                                                              SSDEEP:
                                                                                                              MD5:92C0400BF8CDD574F669E40B8D0C2BAB
                                                                                                              SHA1:3EB5155763A3A204982D4231C7E882DC91F0016F
                                                                                                              SHA-256:FDC8BFD5790E64F7DE5425BBA4C80A2E8F1648EE037D9A2B61070A8565B12A4A
                                                                                                              SHA-512:9698839D57A4E3A34BA24CB4BDD6CACF97695748089448AC259CD939D952DF395C82A83E260CF75F8004FE33561E1365CDA1AF1C2DC70F63E28E6EA7403CED0D
                                                                                                              Malicious:false
                                                                                                              Preview:.Uninstalling assembly 'C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe'...Affected parameters are:.. logtoconsole = .. logfile = C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.InstallLog.. assemblypath = C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe..Removing EventLog source FastestVPNService...Warning: The source FastestVPNService is not registered on the local machine...Service FastestVPNService is being removed from the system.....An exception occurred during the uninstallation of the System.ServiceProcess.ServiceInstaller installer...System.ComponentModel.Win32Exception: The specified service does not exist as an installed service..An exception occurred while uninstalling. This exception will be ignored and the uninstall will continue. However, the application might not be fully uninstalled after the uninstall is complete...Installing assembly 'C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe'...Affected

                                                                                                              C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.InstallState

                                                                                                              Download File
                                                                                                              Process:C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe
                                                                                                              File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with very long lines (7463), with no line terminators
                                                                                                              Category:dropped
                                                                                                              Size (bytes):7466
                                                                                                              Entropy (8bit):5.1606801095705865
                                                                                                              Encrypted:false
                                                                                                              SSDEEP:
                                                                                                              MD5:FFB29BD88BD23C639985F1D369DBD1CA
                                                                                                              SHA1:F0AF5F803F59668AD52EA4B212A1CDE00DD5FE14
                                                                                                              SHA-256:1ADB4F9D1D152E018246A0A2762B473D910906340207F57D3F8CE1097E1DE09F
                                                                                                              SHA-512:1C12CF185691EE3D44A8522665F6AD20F41A4EE9C5A758B8DD2ABF7CC8F5F863F5CF5CB919BADFCDEE40394A89DA2C9A9601B93FB01B867932FAD4C03932B94D
                                                                                                              Malicious:false
                                                                                                              Preview:.<?xml version="1.0" encoding="utf-8"?><ArrayOfKeyValueOfanyTypeanyType xmlns:i="http://www.w3.org/2001/XMLSchema-instance" xmlns:x="http://www.w3.org/2001/XMLSchema" z:Id="1" z:Type="System.Collections.Hashtable" z:Assembly="0" xmlns:z="http://schemas.microsoft.com/2003/10/Serialization/" xmlns="http://schemas.microsoft.com/2003/10/Serialization/Arrays"><LoadFactor z:Id="2" z:Type="System.Single" z:Assembly="0" xmlns="">0.72</LoadFactor><Version z:Id="3" z:Type="System.Int32" z:Assembly="0" xmlns="">2</Version><Comparer i:nil="true" xmlns="" /><HashCodeProvider i:nil="true" xmlns="" /><HashSize z:Id="4" z:Type="System.Int32" z:Assembly="0" xmlns="">3</HashSize><Keys z:Id="5" z:Type="System.Object[]" z:Assembly="0" z:Size="2" xmlns=""><anyType z:Id="6" z:Type="System.String" z:Assembly="0" xmlns="http://schemas.microsoft.com/2003/10/Serialization/Arrays">_reserved_nestedSavedStates</anyType><anyType z:Id="7" z:Type="System.String" z:Assembly="0" xmlns="http://schemas.microsoft.com/20

                                                                                                              C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe (copy)

                                                                                                              Download File
                                                                                                              Process:C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmp
                                                                                                              File Type:PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                              Category:dropped
                                                                                                              Size (bytes):25768
                                                                                                              Entropy (8bit):6.588649497011045
                                                                                                              Encrypted:false
                                                                                                              SSDEEP:
                                                                                                              MD5:22D4E4267DFE093E5E23C2F3D7741AA4
                                                                                                              SHA1:AB18989C4442EB204528E64B18000E8E02FA2C50
                                                                                                              SHA-256:4E296E9B159F5D64E6E71821C9C06260AC02EBB424823ADA64E97DFD418C3CA1
                                                                                                              SHA-512:7F6D1228F93E454477E3C4250D1D0C78995DE8D9AE07FA585DC8BDCBB4A1046338B66BEFE0BD9BF63F61085657F7080A1C6350403292E484F047F9ED791EF43B
                                                                                                              Malicious:true
                                                                                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L..._S............"...0..............M... ...`....@.. ...............................0....`..................................M..O....`..,............:...*...........L..8............................................ ............... ..H............text....-... ...................... ..`.rsrc...,....`.......0..............@..@.reloc...............8..............@..B.................M......H........(..H#...........L................................................{....*"..}....*6.(.....(....*..0..g.........(....... ....0.. .....0. .....". .....&*. .....#. .....!. ......*(,...*(-...*(....*(/...*(0...*(1...*..0..J.......(....(....-.(....(....&~....r...p(.....(.......1.~......(....(......(....*Z(-....(....%-.&*o....*....0.."........r...p..(....(....(....(......&..*...................0..#....... F#.....+..(....-..*..X...X....2..*..0..1.......(....o......,...-..*..+.

                                                                                                              C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe.config (copy)

                                                                                                              Download File
                                                                                                              Process:C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmp
                                                                                                              File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                                                                                                              Category:dropped
                                                                                                              Size (bytes):1327
                                                                                                              Entropy (8bit):5.042117116126737
                                                                                                              Encrypted:false
                                                                                                              SSDEEP:
                                                                                                              MD5:E40244BE7715300DC4BA229C25237728
                                                                                                              SHA1:F9D299542C616D860D495CE59A6FD2B90907B2E5
                                                                                                              SHA-256:AE5027694FF0D363F757F112162AC8D49550826872C9A5B2BA67A75F56109C4D
                                                                                                              SHA-512:CBEA4111D0A2D8BB5FF5AD631728C85A38668C6D470AB8A4D59D5334B9309EF34125E9A9F70EA942113212D5B1FD5EABF9DF860F9112B52D55C95EE32BB8721A
                                                                                                              Malicious:true
                                                                                                              Preview:.<?xml version="1.0" encoding="utf-8"?>..<configuration>.. <startup> .. <supportedRuntime version="v4.0" sku=".NETFramework,Version=v4.8" />.. </startup>.. <runtime>.. <legacyCorruptedStateExceptionsPolicy enabled="true" />.. <assemblyBinding xmlns="urn:schemas-microsoft-com:asm.v1">.. <dependentAssembly>.. <assemblyIdentity name="Microsoft.Owin.Security" publicKeyToken="31bf3856ad364e35" culture="neutral" />.. <bindingRedirect oldVersion="0.0.0.0-4.2.2.0" newVersion="4.2.2.0" />.. </dependentAssembly>.. <dependentAssembly>.. <assemblyIdentity name="Newtonsoft.Json" publicKeyToken="30ad4fe6b2a6aeed" culture="neutral" />.. <bindingRedirect oldVersion="0.0.0.0-13.0.0.0" newVersion="13.0.0.0" />.. </dependentAssembly>.. <dependentAssembly>.. <assemblyIdentity name="Microsoft.Owin" publicKeyToken="31bf3856ad364e35" culture="neutral" />.. <bindingRedirect oldVersion="0.0.0.0-4.2.2.0" newVersion="4.2.2.0

                                                                                                              C:\Program Files\FastestVPN\Service\InstallUtil.InstallLog

                                                                                                              Download File
                                                                                                              Process:C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe
                                                                                                              File Type:Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                                                                                                              Category:dropped
                                                                                                              Size (bytes):1004
                                                                                                              Entropy (8bit):4.743456157396208
                                                                                                              Encrypted:false
                                                                                                              SSDEEP:
                                                                                                              MD5:FB8F7A7B8FD8826568D2DEE10D1C9AC1
                                                                                                              SHA1:D59BBFA7ED11D7044716AD555C4618824133A06C
                                                                                                              SHA-256:B3C7D69A8763580BB1B0978B8C87FED4E1C8C9934497451D3D813B46B3F8A3F3
                                                                                                              SHA-512:9DE3C7198F3C42227B9DE16246C189DEF584F51B2A17D210D3ED37346BD7B32989B5CB4F26F548E8FD3C88B166F6FBC1BB3A1DA1A35E83DE417ACC0F4A624485
                                                                                                              Malicious:false
                                                                                                              Preview:.....The uninstall is beginning...See the contents of the log file for the C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe assembly's progress...The file is located at C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.InstallLog.....The uninstall has completed.....Running a transacted installation.....Beginning the Install phase of the installation...See the contents of the log file for the C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe assembly's progress...The file is located at C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.InstallLog.....The Install phase completed successfully, and the Commit phase is beginning...See the contents of the log file for the C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe assembly's progress...The file is located at C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.InstallLog.....The Commit phase completed successfully.....The transacted install has complete

                                                                                                              C:\Program Files\FastestVPN\Service\Microsoft.AspNet.SignalR.Core.dll (copy)

                                                                                                              Download File
                                                                                                              Process:C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmp
                                                                                                              File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                              Category:dropped
                                                                                                              Size (bytes):347016
                                                                                                              Entropy (8bit):6.2576059322299855
                                                                                                              Encrypted:false
                                                                                                              SSDEEP:
                                                                                                              MD5:F4B5415B6C9EC38B073779A034421747
                                                                                                              SHA1:DADEC8724A898C84A9F52A86A5D0ACFA71758341
                                                                                                              SHA-256:2672829713F57630F2FC4DA57926456DDA7832F0E0F474F06462D2340B4DC4E3
                                                                                                              SHA-512:82C58B9061CB8B4603B88AB69CD43461A886029AA7CE1A1ADB614F07EEE90FA979F7CC524272D6A494BADC79254906182DE5A90BF992E48160CA5C3DBE57C334
                                                                                                              Malicious:false
                                                                                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...U=............" ..0..............<... ...@....... ....................................`.................................z<..O....@...............(...#...`.......;..T............................................ ............... ..H............text........ ...................... ..`.rsrc........@....... ..............@..@.reloc.......`.......&..............@..B.................<......H.......$....m..............H(...;........................................{0...*..{1...*V.(2.....}0.....}1...*...0..;........u......,/(3....{0....{0...o4...,.(5....{1....{1...o6...*.*. .... )UU.Z(3....{0...o7...X )UU.Z(5....{1...o8...X*.0...........r...p......%..{0....................-.q.............-.&.+.......o9....%..{1....................-.q.............-.&.+.......o9....(:...*..{;...*..{<...*V.(2.....};.....}<...*...0..;........u......,/(3....{;....{;...o4...,.(5....{<..

                                                                                                              C:\Program Files\FastestVPN\Service\Microsoft.Owin.Cors.dll (copy)

                                                                                                              Download File
                                                                                                              Process:C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmp
                                                                                                              File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                              Category:dropped
                                                                                                              Size (bytes):24976
                                                                                                              Entropy (8bit):6.836703429014385
                                                                                                              Encrypted:false
                                                                                                              SSDEEP:
                                                                                                              MD5:5E8C253B1394C1E6E396A939C9FC9068
                                                                                                              SHA1:6AE721F34E256FD90A99617BA19040D45FF6A41F
                                                                                                              SHA-256:4B1A93C57580BD0F304B214EAA3C451272821ACAFC6A0EAE34976606030E0D69
                                                                                                              SHA-512:22CCA8638EF56059A9DE79289D3EB8289F0774579059C6785B08D08229E366BC8E9FA591EAAFBB4F2952FF7627D1CA0AB180C2B82555BA9C4BC8806F837F478D
                                                                                                              Malicious:false
                                                                                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...l?J..........." ..0..0..........^N... ...`....... ..............................L.....`..................................N..O....`..(............:...'...........@..p............................................ ............... ..H............text...d.... ...0.................. ..`.rsrc...(....`.......2..............@..@.reloc...............8..............@..B................@N......H........&..,....................@.......................................0..T........(.....-.r...ps....z.-.r...ps....z..}......o....%-.&s....}......o....%-.&s....}....*.0..?.........(....}.......}.......}.......}......|......(...+..|....(....*..0..%............(....,...(.....{.....o....o....*....0..I........o....(....-%.....(....,..o ... ....o!.....(....+..o ... ....o!....(...+*v..{......o#...Q.P,..Po$...*.*..0..M........o%.....,B.o&....+%.o'.....o ...o(.....().....(*...o+...

                                                                                                              C:\Program Files\FastestVPN\Service\Microsoft.Owin.Diagnostics.dll (copy)

                                                                                                              Download File
                                                                                                              Process:C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmp
                                                                                                              File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                              Category:dropped
                                                                                                              Size (bytes):166800
                                                                                                              Entropy (8bit):5.092225196099469
                                                                                                              Encrypted:false
                                                                                                              SSDEEP:
                                                                                                              MD5:2839920AD2E9C4B08F97715D88586056
                                                                                                              SHA1:88F7544BF59DDD40E3C934C938A20164F3B518F1
                                                                                                              SHA-256:A655B1BC143B918C6F31B52AEA2726C131F474B70BF7E2DDF36FE48B1E6E279D
                                                                                                              SHA-512:E26A141021648398F109B41275154FDFCF139845466C9A37E80A1AD43725D914FD574F59706AD68404555BCB36490CB307E7E0C9158A8B8E94F97CB93E4C0F37
                                                                                                              Malicious:false
                                                                                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L................" ..0..Z...........x... ........... ...............................b....`..................................x..O.......8............d...'...........^..p............................................ ............... ..H............text....X... ...Z.................. ..`.rsrc...8............\..............@..@.reloc...............b..............@..B.................x......H........R..............|S......D^......................................j.-.r...ps$...z.s....(....*..0..Y........-.r...ps$...z.o%...s&......r...p(...+.r+..p..((.....(...+........%...%...%...>....(...+*..-.r...ps$...z......(+.........%...o,...*N.sD...%.oC...(....*b.sD...%.s-...oC...(....*2.sD...(....*....0..C........(.....-.rC..ps$...z.-.rM..ps$...z..,...o......}......}......}....*..0..?.........(/...}4......}5......}6......}3.....|4.....(...+..|4...(1...*j.{....,..{....r]..p.

                                                                                                              C:\Program Files\FastestVPN\Service\Microsoft.Owin.Host.HttpListener.dll (copy)

                                                                                                              Download File
                                                                                                              Process:C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmp
                                                                                                              File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                              Category:dropped
                                                                                                              Size (bytes):101776
                                                                                                              Entropy (8bit):6.519631245398067
                                                                                                              Encrypted:false
                                                                                                              SSDEEP:
                                                                                                              MD5:58D1267BAFC9E0D9531D7C97A08A3A68
                                                                                                              SHA1:1EC6E26D9E71D1CB5C885879CC8F6D3762DC5FD6
                                                                                                              SHA-256:34FB96B4CCA40AC4312E36E3310EACC2C13F2562BAAB7FFE836060965B7AD579
                                                                                                              SHA-512:E6A6EDE57B59CB675D869D1B5BD43C67C864363CE7168538ABB048F911783181546F7CBFEB29EE49EEC21291EEBD442E3BA9819967F8ABE3AD00AC33C94A3620
                                                                                                              Malicious:false
                                                                                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....c=..........." ..0..\...........z... ........... ...................................`.................................Kz..O....................f...'..........<C..p............................................ ............... ..H............text....Z... ...\.................. ..`.rsrc................^..............@..@.reloc...............d..............@..B.................z......H..........,............A.......B.......................................0..............o+...-..........*......*.0............(...+..-..........*..(...+*....0...........(,....s-...}......}/.....}2........(....r...p.$o/......5...(....r+..p.$o/...}1.....(0...,..o1........(....(2...,....{/...o3...t....}0....{1....(4...-..{0...-..{2...rI..p(....*.0..D........{1....(4...-..{0...-.(5...*.{1....o6...o3....l......(........o6...*.0...........{.......o7...,..*..(....*...0..........s8..

                                                                                                              C:\Program Files\FastestVPN\Service\Microsoft.Owin.Hosting.dll (copy)

                                                                                                              Download File
                                                                                                              Process:C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmp
                                                                                                              File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                              Category:dropped
                                                                                                              Size (bytes):80784
                                                                                                              Entropy (8bit):6.644018601476374
                                                                                                              Encrypted:false
                                                                                                              SSDEEP:
                                                                                                              MD5:056A3B1C036A46447EBCA7083DA271A5
                                                                                                              SHA1:8044FD37E124DF9BAFCE4311DB66D6B931120006
                                                                                                              SHA-256:6BEDFFF38EB390D01F0D51340B7B4F8F7B3D1C1C6CEE8888C0A8088EDA19283D
                                                                                                              SHA-512:3399C06120F32219D611D976D778654A2628AC5BA0FA778512FE1101EE461663C5D5819ED5EECF90363F70E69108F5DAA1A3E71E81BB7F9F635AED8908997852
                                                                                                              Malicious:false
                                                                                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L................." ..0..............(... ...@....... ..............................M.....`..................................'..O....@..(................'...`..........p............................................ ............... ..H............text........ ...................... ..`.rsrc...(....@......................@..@.reloc.......`......................@..B.................'......H........[..............................................................*....(....**....(....**....(....**....(....*..(&.....%-.&(....}......%-.&...'...s(...}......%-.&s....}....*j...(....%-.&.{......o)...*...0..........s........%-.&~*.......,(...+-....(......-..(,...-....(......-..*..o-...}_....o....(,...,.r...p+..o........{_.....(....}`....{`...-..*.......s/...*...0.............(......-..*.o0.....o1.....(.....(...+o.....+w.o..........o3........(4...,/.(5...(..........%...%.

                                                                                                              C:\Program Files\FastestVPN\Service\Microsoft.Owin.Security.dll (copy)

                                                                                                              Download File
                                                                                                              Process:C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmp
                                                                                                              File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                              Category:dropped
                                                                                                              Size (bytes):65960
                                                                                                              Entropy (8bit):6.704364809732977
                                                                                                              Encrypted:false
                                                                                                              SSDEEP:
                                                                                                              MD5:3B6AD220174768E52510D449C7A5C817
                                                                                                              SHA1:E76CB664268F45939A0A604E31CAB3DBE957510A
                                                                                                              SHA-256:294A04A1305277ABDF2539649F8A7909DAC57ECF61F223600227BC1CDED6E2DC
                                                                                                              SHA-512:43852FA0F4FD12967DAAF81613FF3C52EAD432F39E579E1C5C834595881A9E6AC156BCE326CEE3EB78D11D81AD33792870D31F81D7737483CF36636DB30DFCF1
                                                                                                              Malicious:false
                                                                                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L................" ..0.................. ........... .......................@......=.....`.................................e...O....... ................'... ......`...p............................................ ............... ..H............text........ ...................... ..`.rsrc... ...........................@..@.reloc....... ......................@..B........................H........H...u..............X............................................0..>........-.r...ps....z.o....r...p..o....,..uW.....(....-..*("...s....z..-.r...ps....z.-.r...ps....z.o....r...p.o ...*..(!....s"...(......(......(....*..{....*R..}.....(.....o#...*..{....*"..}....*..{....*"..}....*z.(!.....(......%-.&s$...(....*..{....*"..}....*..{....*"..}....*..(!....-.r...ps....z..(%...s&...}.....{....o'...-.r...ps(...z*....0..g.........,..*.-.r...ps....z.o)...o*..../..*.o)...o+....

                                                                                                              C:\Program Files\FastestVPN\Service\Microsoft.Owin.dll (copy)

                                                                                                              Download File
                                                                                                              Process:C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmp
                                                                                                              File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                              Category:dropped
                                                                                                              Size (bytes):122256
                                                                                                              Entropy (8bit):6.572766216409801
                                                                                                              Encrypted:false
                                                                                                              SSDEEP:
                                                                                                              MD5:C24CF68C9012B4E261D2FD6B2240BBE8
                                                                                                              SHA1:45844AE139DB45652AAC12E1D6EE138ED709E261
                                                                                                              SHA-256:42ED395C54526DAD6AA275CA2A65F6DE6E94BC8CEC8548CFB9891BA430FF1974
                                                                                                              SHA-512:DDF7872EB70E9546D28A209A562C873BA9E9402AD600C3D44ACD425FC7337C19B581A8C06F8BAD5987B36EF82895AAD0DA48CBC7E0E64886CD0EB7C9884FFA4D
                                                                                                              Malicious:false
                                                                                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....*0..........." ..0.................. ........... ....................... .......$....`.................................k...O........................'..........0}..p............................................ ............... ..H............text...D.... ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................H........................u.......|........................................-.r...ps(...z......()....o*...*..-.r...ps(...z.-.r...ps(...z.......%...(...+&*..-.r...ps(...z.-.r...ps(...z.......%...(...+*...0..^........-.r...ps(...z.-.r...ps(...z.-.r-..ps(...z.(+...-..rI..p.o,...,.(S...r...ps-...z..s.....(....*...0...........-.r...ps(...z.-.r-..ps(...z..(....,$..(....rI..p.o,...,.(S...r...ps-...zs....%.o............%...(...+..o.......o/..........()...o0...t....o.....*...0..s.......

                                                                                                              C:\Program Files\FastestVPN\Service\Newtonsoft.Json.dll (copy)

                                                                                                              Download File
                                                                                                              Process:C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmp
                                                                                                              File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                              Category:dropped
                                                                                                              Size (bytes):711952
                                                                                                              Entropy (8bit):5.967185619483575
                                                                                                              Encrypted:false
                                                                                                              SSDEEP:
                                                                                                              MD5:195FFB7167DB3219B217C4FD439EEDD6
                                                                                                              SHA1:1E76E6099570EDE620B76ED47CF8D03A936D49F8
                                                                                                              SHA-256:E1E27AF7B07EEEDF5CE71A9255F0422816A6FC5849A483C6714E1B472044FA9D
                                                                                                              SHA-512:56EB7F070929B239642DAB729537DDE2C2287BDB852AD9E80B5358C74B14BC2B2DDED910D0E3B6304EA27EB587E5F19DB0A92E1CBAE6A70FB20B4EF05057E4AC
                                                                                                              Malicious:false
                                                                                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...p$?..........." ..0.............B.... ........... ....................... ............`....................................O......................../.......... ...T............................................ ............... ..H............text........ ...................... ..`.rsrc...............................@..@.reloc..............................@..B................$.......H.......x...(9............................................................(....*..(....*^.(...........%...}....*:.(......}....*:.(......}....*..(....*:.(......}....*..{....*..(....*..(....*:.(......}....*..{....*.(.........*....}.....(......{.....X.....}....*..0...........-.~....*.~....X....b...aX...X...X..+....b....aX....X.....2.....cY.....cY....cY..|....(......._..{........+,..{|....3...{{......(....,...{{...*..{}.......-..*...0...........-.r...ps....z.o......-.~....*.~....

                                                                                                              C:\Program Files\FastestVPN\Service\Owin.dll (copy)

                                                                                                              Download File
                                                                                                              Process:C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmp
                                                                                                              File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                              Category:dropped
                                                                                                              Size (bytes):15528
                                                                                                              Entropy (8bit):6.93175318343703
                                                                                                              Encrypted:false
                                                                                                              SSDEEP:
                                                                                                              MD5:ADF6FCD8199E4DA7F52FBEBD9D9496D7
                                                                                                              SHA1:17E7E444AB035AE759D3B0E48928B7D23CEC3682
                                                                                                              SHA-256:C1AF49ACF4E6E9B77C025405CB31E6493F4A9A0080AE48381CE3B36EC5E1D76E
                                                                                                              SHA-512:72F42DC40B2B1B9C25F0B4BC6E18BCE4B9F144A39442B05E5DF6FB792EA1F5E0645E5CF6251918AF0D81316437982ADBE6892992E4F4323CF48C84A6B08FD809
                                                                                                              Malicious:false
                                                                                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....f.P...........!................N)... ...@....... ....................................@..................................(..W....@...................*...`.......'............................................... ............... ..H............text...T.... ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B................0)......H........ ......................P ......................................-.N...._J...a.w~.{...I..}.B.;=.XT.Jh.;.(f.eU/@r.. .......g...^......{i....h]..A,};......g..4..bb.....(..S).]..Ol.[..r....C.BSJB............v4.0.30319......l.......#~..d.......#Strings............#US.........#GUID...........#Blob...........G.........%3................................................................H.-...p.i.....i.....................8.....W.......p.....p.................i.......;.$...

                                                                                                              C:\Program Files\FastestVPN\Service\System.Web.Cors.dll (copy)

                                                                                                              Download File
                                                                                                              Process:C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmp
                                                                                                              File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                              Category:dropped
                                                                                                              Size (bytes):28648
                                                                                                              Entropy (8bit):6.283743404391549
                                                                                                              Encrypted:false
                                                                                                              SSDEEP:
                                                                                                              MD5:9FFF1DA4E481028262E27AEFD7C0EFF4
                                                                                                              SHA1:B0128E42E3CE3C295C48461A651AF99D95B5A04D
                                                                                                              SHA-256:3FDB918CC5F1E5F1FA9C155DC68AAFE10A16C73ED934C06B201ED94070EA985D
                                                                                                              SHA-512:6B02B873C4092BFE3C2D8428093696E94C6021DB9D6FA8740E79DF7C6C5208229ED7AE8A62E96597EEEF348956BC6AB79375292B6456162F78D332E3830B75EC
                                                                                                              Malicious:false
                                                                                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...P^.b.........." ..0..>...........\... ...`....... ..............................c.....`.................................x\..O....`...............H...'..........@[............................................... ............... ..H............text....<... ...>.................. ..`.rsrc........`.......@..............@..@.reloc...............F..............@..B.................\......H.......(-...+..........8X.......Z........................................(.....s....(.....s....(.....s....(.....s....(....*..{....*"..}....*..{....*"..}....*..{....*"..}....*..{....*"..}....*..{....*"..}....*..{....*"..}....*..{....*"..}....*..{....*..0..1..........j...(.........(...._,.r...p(I...s....z..}....*..{....*"..}....*...0..p.......s....%r...po....&%.(....o....&%r/..po....&%.(....o....&%rU..po....&%.(....o....&%r{..po....&%.(.......(....-.r...p+..(.......(.......( .

                                                                                                              C:\Program Files\FastestVPN\Service\VPN.AdvancedNetwork.dll (copy)

                                                                                                              Download File
                                                                                                              Process:C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmp
                                                                                                              File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                              Category:dropped
                                                                                                              Size (bytes):35496
                                                                                                              Entropy (8bit):6.3718937380199785
                                                                                                              Encrypted:false
                                                                                                              SSDEEP:
                                                                                                              MD5:D438F337397A4CB3CA4E87F70BC4B4C0
                                                                                                              SHA1:FB6FB592744E34BA9B8B9E2B05F6D9C0C983F353
                                                                                                              SHA-256:80E40E47F7D6EB2C9CB357B1B3951D0B0429087F44BEC066993C26975CDA4A76
                                                                                                              SHA-512:8B9E589D378775331C08CEB908C4FC3BCA2AFBEA776E86163E5C641BF1D5F5E84BBA76B6E5C0102EC388005F8D09EAAA80DFB60185C83BF462543A6903236204
                                                                                                              Malicious:false
                                                                                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...>............." ..0..X...........v... ........... ...............................k....`..................................v..O....................`...*...........v..8............................................ ............... ..H............text....W... ...X.................. ..`.rsrc................Z..............@..@.reloc...............^..............@..B.................v......H........3...B...........................................................0.................(n...........................s)...}................s%...}................s....}................s....}................s....}................s....} ...............s!...}!...............s....}"...............s....}#...............s=...}$...............s9...}%...............s5...}&...............sA...}'...............sE...}(...............s-...})...............s1...}*........(....(....(....

                                                                                                              C:\Program Files\FastestVPN\Service\VPN.Common.dll (copy)

                                                                                                              Download File
                                                                                                              Process:C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmp
                                                                                                              File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                              Category:dropped
                                                                                                              Size (bytes):60584
                                                                                                              Entropy (8bit):6.426868083769682
                                                                                                              Encrypted:false
                                                                                                              SSDEEP:
                                                                                                              MD5:D4BECC422A254D1A75CFC60750572848
                                                                                                              SHA1:2AE1D45045828B8D9A57DD90213F462D72F9A98B
                                                                                                              SHA-256:A8BC4A168A5F9CD7ABBBBFF3F0794F433233A72D557E168AF42BD34FFF3A2F34
                                                                                                              SHA-512:91A1E21F87868A00CF715018577A028413CB638A7965756324AFCF16A6108906DCB355959882C2C555C7276EF1A70627E455B4057695DE8C462E4D0679FEFAC5
                                                                                                              Malicious:false
                                                                                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L................." ..0.............r.... ........... ....................... ............`................................. ...O........................*..............8............................................ ............... ..H............text...x.... ...................... ..`.rsrc...............................@..@.reloc..............................@..B................T.......H.......T0..4.............................................................{....*"..}....*..{....*"..}....*..{....*"..}....*..{....*"..}....*..{....*"..}....*..{....*"..}....*>.(....o4......*>.(....o4......*>.(....o2......*>.(....o2......*>.(....o2......*v.(....-..(....,..(....+..+..*..{....*"..}....*6..s....}....*..0............(......,...(k.....*....0..4.......s......(....}......}......}......}.....|......(...+*.0..Y.........(....o....r...p(....(c....(f....(g.....(......,&.

                                                                                                              C:\Program Files\FastestVPN\Service\VPN.OpenVpn.dll (copy)

                                                                                                              Download File
                                                                                                              Process:C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmp
                                                                                                              File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                              Category:dropped
                                                                                                              Size (bytes):31912
                                                                                                              Entropy (8bit):6.377780370750934
                                                                                                              Encrypted:false
                                                                                                              SSDEEP:
                                                                                                              MD5:14515F3569114E0060716ABD3AB3265A
                                                                                                              SHA1:9E2DBC71979FFB5E3270C9353EA53448D9E07544
                                                                                                              SHA-256:94DEC461C651A437049E2E5CBA046684E7177C350B836B363880EEEBDD1EBDEA
                                                                                                              SHA-512:7067B02E1493A61BBABA8DDF922A8B5FDC31466F0E28ADAC116865661E739D6939863C44212FB0A22C49D2F3F03D2C28221E54C15FBC6387C43BD47637A349E4
                                                                                                              Malicious:false
                                                                                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...r.C..........." ..0..J..........~h... ........... ..............................yA....`.................................*h..O....................R...*...........g..8............................................ ............... ..H............text....H... ...J.................. ..`.rsrc................L..............@..@.reloc...............P..............@..B................^h......H........1...5............................................................{....*"..}....*..{....*"..}....*..{....*"..}....*..{....*"..}....*&..(.....*...0...........s.......o.....+X..(.........(....o....o....&..(.........,!..r...po....&...(....o....o....&..r...po....&...(....-...........o ......o....o!.....+...*...........et.......0...........s"...%r...p.o#....%r...pr#..po#....%r+..prA..po#....%r]..p.($...o%...o#....%ro..p.($...o&............o....o'...o#....%r...p.($...o(....

                                                                                                              C:\Program Files\FastestVPN\Service\VPN.RAS.dll (copy)

                                                                                                              Download File
                                                                                                              Process:C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmp
                                                                                                              File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                              Category:dropped
                                                                                                              Size (bytes):41128
                                                                                                              Entropy (8bit):6.401085070695131
                                                                                                              Encrypted:false
                                                                                                              SSDEEP:
                                                                                                              MD5:AD53B27150F1E38EF23BD155A07E2313
                                                                                                              SHA1:3A9A4383B9286A0E1A3F4102BC56437A5A961E41
                                                                                                              SHA-256:62DBC8A6D43D623E5F267B59A3C78807CB08EFBE37A06A67425C9458D8B985DA
                                                                                                              SHA-512:F8D471175E39425F1E1613C60EDD9D1A98DBACC98E3F18746AA642524AFB7D9F9A299B2BE33629200AB94538BF95C78B6343DE193EE3AD48B1CFC1DD4E37E9D4
                                                                                                              Malicious:false
                                                                                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....z:..........." ..0..n..........&.... ........... ....................................`....................................O.......h............v...*..........@...8............................................ ............... ..H............text...,m... ...n.................. ..`.rsrc...h............p..............@..@.reloc...............t..............@..B........................H........6..PU............................................................{....*"..}....*..{....*"..}....*..~....}......s....}.....(........(.............s*...}....*....0..................,5...(A.....(.........,..~.....(.....s....o.......8..............0....B+......8..... . ...G+.. . ..;....8....~.....(.....s....o.....8....~.....(.....s....o.....+s.o.....~.....(....s....o......(....o ...r...p(!.......,...(.......{.....{....o"....(6...&+...(......s#...(.....+.+..*..0..F.......

                                                                                                              C:\Program Files\FastestVPN\Service\VPN.WireGuard.dll (copy)

                                                                                                              Download File
                                                                                                              Process:C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmp
                                                                                                              File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                              Category:dropped
                                                                                                              Size (bytes):20136
                                                                                                              Entropy (8bit):6.721932799011409
                                                                                                              Encrypted:false
                                                                                                              SSDEEP:
                                                                                                              MD5:8E6A799F0DA3FBA278F06D4C7A18E7B5
                                                                                                              SHA1:B9AD516A47362FFAF360C1E8794D2F10C8E7080F
                                                                                                              SHA-256:1029DDF44F3CD774754DDFEAFB97BE18CD31B50DE24F19870F9BDE8163B5DEA5
                                                                                                              SHA-512:4607E418C0BE1F632CBE5CE0A8F1877F45EB873C193B4FF7C52495E891BD05D7F3AA3847D97F36D7B5601FCCAFCF6DE4A822140D9610C9E9BCA900BC06C67DE8
                                                                                                              Malicious:false
                                                                                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...W/%..........." ..0.............^;... ...@....... ....................................`..................................;..O....@...............$...*...`......l:..8............................................ ............... ..H............text...d.... ...................... ..`.rsrc........@......................@..@.reloc.......`......."..............@..B................>;......H........$..............................................................F.(....r...p(....*..{....*"..}....*..0...........s......r...po....&.r-..p.(....o....(....o....&.rI..p.(....o....r_..p(....o....&.rg..p.(....o....(....o....&.(......,...ru..po....&..r...po....&.r...po....&.r...p.(....o....(....o....&.r...po....&.r...p.(....o....r...p(....o....&.(....o.....o....( ....*..r...p.(....o!...r...p(....r...p.(....o....r...p(....("...&*..r?..prK..p.(.........(#...("...&*..r?..pr...

                                                                                                              C:\Program Files\FastestVPN\Service\VPN.dll (copy)

                                                                                                              Download File
                                                                                                              Process:C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmp
                                                                                                              File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                              Category:dropped
                                                                                                              Size (bytes):18088
                                                                                                              Entropy (8bit):6.788270069437216
                                                                                                              Encrypted:false
                                                                                                              SSDEEP:
                                                                                                              MD5:A891AAC2D9FD1B939E07BE155AFC84FF
                                                                                                              SHA1:7F977350D9CFD10C259356D98C0606779519C6EF
                                                                                                              SHA-256:38D6709A0A003761850933F79132CCDC40B6F26460169BAB092931BBA1500683
                                                                                                              SHA-512:E4227CA484824ED3C912A58B741B4A447ACC50DFFB9945165303D5362BA39217FFAEFC62DF60D292A8B081DAD82CD85593FF64DB93DBC26465355D89AA527724
                                                                                                              Malicious:false
                                                                                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...X4y..........." ..0.............n3... ...@....... ...................................`..................................3..O....@..H................*...`.......2..8............................................ ............... ..H............text...t.... ...................... ..`.rsrc...H....@......................@..@.reloc.......`......................@..B................N3......H........#................................................................{....*"..}....*..{....*"..}....*..{....*"..}....*..(........%-.&r...ps....z(.......(.....*.0..................,..rM..ps....z.(.........,...(....o.......(.......(.....s....o.........(....(......(....o......(....o........&..(.....r...ps....o........*..........tu.......0..B..........(....%-.&+.o.......*&..(.....(....%-.&.+.(......s....o........*.............*.....0..B..........(....%-.&+.o ......*&..(.....

                                                                                                              C:\Program Files\FastestVPN\Service\fix-dns-leak-32.dll (copy)

                                                                                                              Download File
                                                                                                              Process:C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmp
                                                                                                              File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                              Category:dropped
                                                                                                              Size (bytes):25768
                                                                                                              Entropy (8bit):6.829205499580206
                                                                                                              Encrypted:false
                                                                                                              SSDEEP:
                                                                                                              MD5:76DC589253A2FDAAA3CDD02E9F5421DD
                                                                                                              SHA1:A072B9CDDBDC150394643EBFD565A2443AFD9501
                                                                                                              SHA-256:9AC1C9B0343F4D9638FEB4FA25824AFBD2D829EEBF13E54A5FD2197CED2118B5
                                                                                                              SHA-512:50A85E3C61A2506912BC0F4547079DAB2C6B60A882127A4C3087C9AB4065C6568B1E8D4AF246D68BFEE7E7347664883A2FC8E00E2E58EA1DE867FE33D8220861
                                                                                                              Malicious:false
                                                                                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......4.a.pi.Hpi.Hpi.H68.Hri.H68.H|i.H68.Hri.H68.Hti.H...Hqi.H...Hyi.Hpi.HFi.H};.Hsi.H};.Hqi.H};.Hqi.H};.Hqi.HRichpi.H........PE..L....q.Z...........!.................$.......0...............................p.......D....@..........................7......D:.......P...............:...*...`..x...................................p4..@............0...............................text............................... ..`.rdata.......0......."..............@..@.data...\....@.......2..............@....rsrc........P.......4..............@..@.reloc..x....`.......6..............@..B................................................................................................................................................................................................................................................................................................................

                                                                                                              C:\Program Files\FastestVPN\Service\iphelperclose.dll (copy)

                                                                                                              Download File
                                                                                                              Process:C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmp
                                                                                                              File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                                                                              Category:dropped
                                                                                                              Size (bytes):116872
                                                                                                              Entropy (8bit):6.726218253535254
                                                                                                              Encrypted:false
                                                                                                              SSDEEP:
                                                                                                              MD5:B9F4D43230B7FB66B95AF05DC03B32DE
                                                                                                              SHA1:56F868C56FFF836CA61055499988F965DCA37D26
                                                                                                              SHA-256:A103634B16841E3A68DD4A6BCBDFC3A1651B8C9F1114D99BF01CA31297664E21
                                                                                                              SHA-512:50EB5DE7D0A1B5D7E1AC38209488635EF77733C2C78DC39D0D473904128DBFC67D4E3EC388D2C2D79645AFDF03FD1965386F6E6D21553C9A6DAB07A58549FD1E
                                                                                                              Malicious:false
                                                                                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........V.n.7.=.7.=.7.=.S.<.7.=.S.<o7.=.S.<.7.=._.<.7.=._.<.7.=._.<.7.=.S.<.7.=.7.=.7.=._.<.7.=._.<.7.=._3=.7.=._.<.7.=Rich.7.=........................PE..L...q._]...........!................O........0............................................@.............................T.......<.......................................p...............................@............0...............................text............................... ..`.rdata..4g...0...h..................@..@.data...4...........................@....rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................................

                                                                                                              C:\Program Files\FastestVPN\Service\is-04ESR.tmp

                                                                                                              Download File
                                                                                                              Process:C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmp
                                                                                                              File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                              Category:dropped
                                                                                                              Size (bytes):25768
                                                                                                              Entropy (8bit):6.829205499580206
                                                                                                              Encrypted:false
                                                                                                              SSDEEP:
                                                                                                              MD5:76DC589253A2FDAAA3CDD02E9F5421DD
                                                                                                              SHA1:A072B9CDDBDC150394643EBFD565A2443AFD9501
                                                                                                              SHA-256:9AC1C9B0343F4D9638FEB4FA25824AFBD2D829EEBF13E54A5FD2197CED2118B5
                                                                                                              SHA-512:50A85E3C61A2506912BC0F4547079DAB2C6B60A882127A4C3087C9AB4065C6568B1E8D4AF246D68BFEE7E7347664883A2FC8E00E2E58EA1DE867FE33D8220861
                                                                                                              Malicious:false
                                                                                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......4.a.pi.Hpi.Hpi.H68.Hri.H68.H|i.H68.Hri.H68.Hti.H...Hqi.H...Hyi.Hpi.HFi.H};.Hsi.H};.Hqi.H};.Hqi.H};.Hqi.HRichpi.H........PE..L....q.Z...........!.................$.......0...............................p.......D....@..........................7......D:.......P...............:...*...`..x...................................p4..@............0...............................text............................... ..`.rdata.......0......."..............@..@.data...\....@.......2..............@....rsrc........P.......4..............@..@.reloc..x....`.......6..............@..B................................................................................................................................................................................................................................................................................................................

                                                                                                              C:\Program Files\FastestVPN\Service\is-0SL0F.tmp

                                                                                                              Download File
                                                                                                              Process:C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmp
                                                                                                              File Type:PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                              Category:dropped
                                                                                                              Size (bytes):25768
                                                                                                              Entropy (8bit):6.588649497011045
                                                                                                              Encrypted:false
                                                                                                              SSDEEP:
                                                                                                              MD5:22D4E4267DFE093E5E23C2F3D7741AA4
                                                                                                              SHA1:AB18989C4442EB204528E64B18000E8E02FA2C50
                                                                                                              SHA-256:4E296E9B159F5D64E6E71821C9C06260AC02EBB424823ADA64E97DFD418C3CA1
                                                                                                              SHA-512:7F6D1228F93E454477E3C4250D1D0C78995DE8D9AE07FA585DC8BDCBB4A1046338B66BEFE0BD9BF63F61085657F7080A1C6350403292E484F047F9ED791EF43B
                                                                                                              Malicious:false
                                                                                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L..._S............"...0..............M... ...`....@.. ...............................0....`..................................M..O....`..,............:...*...........L..8............................................ ............... ..H............text....-... ...................... ..`.rsrc...,....`.......0..............@..@.reloc...............8..............@..B.................M......H........(..H#...........L................................................{....*"..}....*6.(.....(....*..0..g.........(....... ....0.. .....0. .....". .....&*. .....#. .....!. ......*(,...*(-...*(....*(/...*(0...*(1...*..0..J.......(....(....-.(....(....&~....r...p(.....(.......1.~......(....(......(....*Z(-....(....%-.&*o....*....0.."........r...p..(....(....(....(......&..*...................0..#....... F#.....+..(....-..*..X...X....2..*..0..1.......(....o......,...-..*..+.

                                                                                                              C:\Program Files\FastestVPN\Service\is-17HNF.tmp

                                                                                                              Download File
                                                                                                              Process:C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmp
                                                                                                              File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                              Category:dropped
                                                                                                              Size (bytes):159368
                                                                                                              Entropy (8bit):6.32384599449582
                                                                                                              Encrypted:false
                                                                                                              SSDEEP:
                                                                                                              MD5:7AE17C855F3CC63174E90EA527B6138B
                                                                                                              SHA1:0FE1E1B2252511F33EDA3FFCF1F8FC8586AB040A
                                                                                                              SHA-256:26FF04208EC4D26EF4DDD9B3CF01C4D2A1544550BCD59EFDE6F30170053A1170
                                                                                                              SHA-512:453BA41332A704F491FC9E1EE5FBE9F883EDDB4C26A71D207C93992726E9C5B7FEDC48EEEE2A2087F64B083F9473EE794FB2C8F3B77C9DBCBBC47B67816BD156
                                                                                                              Malicious:false
                                                                                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........y..............Y.......................................................................Rich....................PE..L.....[...........!.........................................................`..................................................P.... ..`............@.......0..(...0...............................0...@............................................text....w.......................... ..`.rdata...A.......P..................@..@.data....6....... ..................@....rsrc...`.... ......................@..@.reloc..2(...0...0..................@..B................................................................................................................................................................................................................................................................................................................

                                                                                                              C:\Program Files\FastestVPN\Service\is-2G3FE.tmp

                                                                                                              Download File
                                                                                                              Process:C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmp
                                                                                                              File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                              Category:dropped
                                                                                                              Size (bytes):31912
                                                                                                              Entropy (8bit):6.377780370750934
                                                                                                              Encrypted:false
                                                                                                              SSDEEP:
                                                                                                              MD5:14515F3569114E0060716ABD3AB3265A
                                                                                                              SHA1:9E2DBC71979FFB5E3270C9353EA53448D9E07544
                                                                                                              SHA-256:94DEC461C651A437049E2E5CBA046684E7177C350B836B363880EEEBDD1EBDEA
                                                                                                              SHA-512:7067B02E1493A61BBABA8DDF922A8B5FDC31466F0E28ADAC116865661E739D6939863C44212FB0A22C49D2F3F03D2C28221E54C15FBC6387C43BD47637A349E4
                                                                                                              Malicious:false
                                                                                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...r.C..........." ..0..J..........~h... ........... ..............................yA....`.................................*h..O....................R...*...........g..8............................................ ............... ..H............text....H... ...J.................. ..`.rsrc................L..............@..@.reloc...............P..............@..B................^h......H........1...5............................................................{....*"..}....*..{....*"..}....*..{....*"..}....*..{....*"..}....*&..(.....*...0...........s.......o.....+X..(.........(....o....o....&..(.........,!..r...po....&...(....o....o....&..r...po....&...(....-...........o ......o....o!.....+...*...........et.......0...........s"...%r...p.o#....%r...pr#..po#....%r+..prA..po#....%r]..p.($...o%...o#....%ro..p.($...o&............o....o'...o#....%r...p.($...o(....

                                                                                                              C:\Program Files\FastestVPN\Service\is-4F6CO.tmp

                                                                                                              Download File
                                                                                                              Process:C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmp
                                                                                                              File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                              Category:dropped
                                                                                                              Size (bytes):15528
                                                                                                              Entropy (8bit):6.93175318343703
                                                                                                              Encrypted:false
                                                                                                              SSDEEP:
                                                                                                              MD5:ADF6FCD8199E4DA7F52FBEBD9D9496D7
                                                                                                              SHA1:17E7E444AB035AE759D3B0E48928B7D23CEC3682
                                                                                                              SHA-256:C1AF49ACF4E6E9B77C025405CB31E6493F4A9A0080AE48381CE3B36EC5E1D76E
                                                                                                              SHA-512:72F42DC40B2B1B9C25F0B4BC6E18BCE4B9F144A39442B05E5DF6FB792EA1F5E0645E5CF6251918AF0D81316437982ADBE6892992E4F4323CF48C84A6B08FD809
                                                                                                              Malicious:false
                                                                                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....f.P...........!................N)... ...@....... ....................................@..................................(..W....@...................*...`.......'............................................... ............... ..H............text...T.... ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B................0)......H........ ......................P ......................................-.N...._J...a.w~.{...I..}.B.;=.XT.Jh.;.(f.eU/@r.. .......g...^......{i....h]..A,};......g..4..bb.....(..S).]..Ol.[..r....C.BSJB............v4.0.30319......l.......#~..d.......#Strings............#US.........#GUID...........#Blob...........G.........%3................................................................H.-...p.i.....i.....................8.....W.......p.....p.................i.......;.$...

                                                                                                              C:\Program Files\FastestVPN\Service\is-51UBL.tmp

                                                                                                              Download File
                                                                                                              Process:C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmp
                                                                                                              File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                              Category:dropped
                                                                                                              Size (bytes):80784
                                                                                                              Entropy (8bit):6.644018601476374
                                                                                                              Encrypted:false
                                                                                                              SSDEEP:
                                                                                                              MD5:056A3B1C036A46447EBCA7083DA271A5
                                                                                                              SHA1:8044FD37E124DF9BAFCE4311DB66D6B931120006
                                                                                                              SHA-256:6BEDFFF38EB390D01F0D51340B7B4F8F7B3D1C1C6CEE8888C0A8088EDA19283D
                                                                                                              SHA-512:3399C06120F32219D611D976D778654A2628AC5BA0FA778512FE1101EE461663C5D5819ED5EECF90363F70E69108F5DAA1A3E71E81BB7F9F635AED8908997852
                                                                                                              Malicious:false
                                                                                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L................." ..0..............(... ...@....... ..............................M.....`..................................'..O....@..(................'...`..........p............................................ ............... ..H............text........ ...................... ..`.rsrc...(....@......................@..@.reloc.......`......................@..B.................'......H........[..............................................................*....(....**....(....**....(....**....(....*..(&.....%-.&(....}......%-.&...'...s(...}......%-.&s....}....*j...(....%-.&.{......o)...*...0..........s........%-.&~*.......,(...+-....(......-..(,...-....(......-..*..o-...}_....o....(,...,.r...p+..o........{_.....(....}`....{`...-..*.......s/...*...0.............(......-..*.o0.....o1.....(.....(...+o.....+w.o..........o3........(4...,/.(5...(..........%...%.

                                                                                                              C:\Program Files\FastestVPN\Service\is-5GMR0.tmp

                                                                                                              Download File
                                                                                                              Process:C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmp
                                                                                                              File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                              Category:dropped
                                                                                                              Size (bytes):122256
                                                                                                              Entropy (8bit):6.572766216409801
                                                                                                              Encrypted:false
                                                                                                              SSDEEP:
                                                                                                              MD5:C24CF68C9012B4E261D2FD6B2240BBE8
                                                                                                              SHA1:45844AE139DB45652AAC12E1D6EE138ED709E261
                                                                                                              SHA-256:42ED395C54526DAD6AA275CA2A65F6DE6E94BC8CEC8548CFB9891BA430FF1974
                                                                                                              SHA-512:DDF7872EB70E9546D28A209A562C873BA9E9402AD600C3D44ACD425FC7337C19B581A8C06F8BAD5987B36EF82895AAD0DA48CBC7E0E64886CD0EB7C9884FFA4D
                                                                                                              Malicious:false
                                                                                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....*0..........." ..0.................. ........... ....................... .......$....`.................................k...O........................'..........0}..p............................................ ............... ..H............text...D.... ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................H........................u.......|........................................-.r...ps(...z......()....o*...*..-.r...ps(...z.-.r...ps(...z.......%...(...+&*..-.r...ps(...z.-.r...ps(...z.......%...(...+*...0..^........-.r...ps(...z.-.r...ps(...z.-.r-..ps(...z.(+...-..rI..p.o,...,.(S...r...ps-...z..s.....(....*...0...........-.r...ps(...z.-.r-..ps(...z..(....,$..(....rI..p.o,...,.(S...r...ps-...zs....%.o............%...(...+..o.......o/..........()...o0...t....o.....*...0..s.......

                                                                                                              C:\Program Files\FastestVPN\Service\is-6V6PA.tmp

                                                                                                              Download File
                                                                                                              Process:C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmp
                                                                                                              File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                              Category:dropped
                                                                                                              Size (bytes):41128
                                                                                                              Entropy (8bit):6.401085070695131
                                                                                                              Encrypted:false
                                                                                                              SSDEEP:
                                                                                                              MD5:AD53B27150F1E38EF23BD155A07E2313
                                                                                                              SHA1:3A9A4383B9286A0E1A3F4102BC56437A5A961E41
                                                                                                              SHA-256:62DBC8A6D43D623E5F267B59A3C78807CB08EFBE37A06A67425C9458D8B985DA
                                                                                                              SHA-512:F8D471175E39425F1E1613C60EDD9D1A98DBACC98E3F18746AA642524AFB7D9F9A299B2BE33629200AB94538BF95C78B6343DE193EE3AD48B1CFC1DD4E37E9D4
                                                                                                              Malicious:false
                                                                                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....z:..........." ..0..n..........&.... ........... ....................................`....................................O.......h............v...*..........@...8............................................ ............... ..H............text...,m... ...n.................. ..`.rsrc...h............p..............@..@.reloc...............t..............@..B........................H........6..PU............................................................{....*"..}....*..{....*"..}....*..~....}......s....}.....(........(.............s*...}....*....0..................,5...(A.....(.........,..~.....(.....s....o.......8..............0....B+......8..... . ...G+.. . ..;....8....~.....(.....s....o.....8....~.....(.....s....o.....+s.o.....~.....(....s....o......(....o ...r...p(!.......,...(.......{.....{....o"....(6...&+...(......s#...(.....+.+..*..0..F.......

                                                                                                              C:\Program Files\FastestVPN\Service\is-8F2SU.tmp

                                                                                                              Download File
                                                                                                              Process:C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmp
                                                                                                              File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                              Category:dropped
                                                                                                              Size (bytes):65960
                                                                                                              Entropy (8bit):6.704364809732977
                                                                                                              Encrypted:false
                                                                                                              SSDEEP:
                                                                                                              MD5:3B6AD220174768E52510D449C7A5C817
                                                                                                              SHA1:E76CB664268F45939A0A604E31CAB3DBE957510A
                                                                                                              SHA-256:294A04A1305277ABDF2539649F8A7909DAC57ECF61F223600227BC1CDED6E2DC
                                                                                                              SHA-512:43852FA0F4FD12967DAAF81613FF3C52EAD432F39E579E1C5C834595881A9E6AC156BCE326CEE3EB78D11D81AD33792870D31F81D7737483CF36636DB30DFCF1
                                                                                                              Malicious:false
                                                                                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L................" ..0.................. ........... .......................@......=.....`.................................e...O....... ................'... ......`...p............................................ ............... ..H............text........ ...................... ..`.rsrc... ...........................@..@.reloc....... ......................@..B........................H........H...u..............X............................................0..>........-.r...ps....z.o....r...p..o....,..uW.....(....-..*("...s....z..-.r...ps....z.-.r...ps....z.o....r...p.o ...*..(!....s"...(......(......(....*..{....*R..}.....(.....o#...*..{....*"..}....*..{....*"..}....*z.(!.....(......%-.&s$...(....*..{....*"..}....*..{....*"..}....*..(!....-.r...ps....z..(%...s&...}.....{....o'...-.r...ps(...z*....0..g.........,..*.-.r...ps....z.o)...o*..../..*.o)...o+....

                                                                                                              C:\Program Files\FastestVPN\Service\is-9KRN8.tmp

                                                                                                              Download File
                                                                                                              Process:C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmp
                                                                                                              File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                              Category:dropped
                                                                                                              Size (bytes):24976
                                                                                                              Entropy (8bit):6.836703429014385
                                                                                                              Encrypted:false
                                                                                                              SSDEEP:
                                                                                                              MD5:5E8C253B1394C1E6E396A939C9FC9068
                                                                                                              SHA1:6AE721F34E256FD90A99617BA19040D45FF6A41F
                                                                                                              SHA-256:4B1A93C57580BD0F304B214EAA3C451272821ACAFC6A0EAE34976606030E0D69
                                                                                                              SHA-512:22CCA8638EF56059A9DE79289D3EB8289F0774579059C6785B08D08229E366BC8E9FA591EAAFBB4F2952FF7627D1CA0AB180C2B82555BA9C4BC8806F837F478D
                                                                                                              Malicious:false
                                                                                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...l?J..........." ..0..0..........^N... ...`....... ..............................L.....`..................................N..O....`..(............:...'...........@..p............................................ ............... ..H............text...d.... ...0.................. ..`.rsrc...(....`.......2..............@..@.reloc...............8..............@..B................@N......H........&..,....................@.......................................0..T........(.....-.r...ps....z.-.r...ps....z..}......o....%-.&s....}......o....%-.&s....}....*.0..?.........(....}.......}.......}.......}......|......(...+..|....(....*..0..%............(....,...(.....{.....o....o....*....0..I........o....(....-%.....(....,..o ... ....o!.....(....+..o ... ....o!....(...+*v..{......o#...Q.P,..Po$...*.*..0..M........o%.....,B.o&....+%.o'.....o ...o(.....().....(*...o+...

                                                                                                              C:\Program Files\FastestVPN\Service\is-ABK95.tmp

                                                                                                              Download File
                                                                                                              Process:C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmp
                                                                                                              File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                              Category:dropped
                                                                                                              Size (bytes):347016
                                                                                                              Entropy (8bit):6.2576059322299855
                                                                                                              Encrypted:false
                                                                                                              SSDEEP:
                                                                                                              MD5:F4B5415B6C9EC38B073779A034421747
                                                                                                              SHA1:DADEC8724A898C84A9F52A86A5D0ACFA71758341
                                                                                                              SHA-256:2672829713F57630F2FC4DA57926456DDA7832F0E0F474F06462D2340B4DC4E3
                                                                                                              SHA-512:82C58B9061CB8B4603B88AB69CD43461A886029AA7CE1A1ADB614F07EEE90FA979F7CC524272D6A494BADC79254906182DE5A90BF992E48160CA5C3DBE57C334
                                                                                                              Malicious:false
                                                                                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...U=............" ..0..............<... ...@....... ....................................`.................................z<..O....@...............(...#...`.......;..T............................................ ............... ..H............text........ ...................... ..`.rsrc........@....... ..............@..@.reloc.......`.......&..............@..B.................<......H.......$....m..............H(...;........................................{0...*..{1...*V.(2.....}0.....}1...*...0..;........u......,/(3....{0....{0...o4...,.(5....{1....{1...o6...*.*. .... )UU.Z(3....{0...o7...X )UU.Z(5....{1...o8...X*.0...........r...p......%..{0....................-.q.............-.&.+.......o9....%..{1....................-.q.............-.&.+.......o9....(:...*..{;...*..{<...*V.(2.....};.....}<...*...0..;........u......,/(3....{;....{;...o4...,.(5....{<..

                                                                                                              C:\Program Files\FastestVPN\Service\is-AC1A8.tmp

                                                                                                              Download File
                                                                                                              Process:C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmp
                                                                                                              File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                              Category:dropped
                                                                                                              Size (bytes):101776
                                                                                                              Entropy (8bit):6.519631245398067
                                                                                                              Encrypted:false
                                                                                                              SSDEEP:
                                                                                                              MD5:58D1267BAFC9E0D9531D7C97A08A3A68
                                                                                                              SHA1:1EC6E26D9E71D1CB5C885879CC8F6D3762DC5FD6
                                                                                                              SHA-256:34FB96B4CCA40AC4312E36E3310EACC2C13F2562BAAB7FFE836060965B7AD579
                                                                                                              SHA-512:E6A6EDE57B59CB675D869D1B5BD43C67C864363CE7168538ABB048F911783181546F7CBFEB29EE49EEC21291EEBD442E3BA9819967F8ABE3AD00AC33C94A3620
                                                                                                              Malicious:false
                                                                                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....c=..........." ..0..\...........z... ........... ...................................`.................................Kz..O....................f...'..........<C..p............................................ ............... ..H............text....Z... ...\.................. ..`.rsrc................^..............@..@.reloc...............d..............@..B.................z......H..........,............A.......B.......................................0..............o+...-..........*......*.0............(...+..-..........*..(...+*....0...........(,....s-...}......}/.....}2........(....r...p.$o/......5...(....r+..p.$o/...}1.....(0...,..o1........(....(2...,....{/...o3...t....}0....{1....(4...-..{0...-..{2...rI..p(....*.0..D........{1....(4...-..{0...-.(5...*.{1....o6...o3....l......(........o6...*.0...........{.......o7...,..*..(....*...0..........s8..

                                                                                                              C:\Program Files\FastestVPN\Service\is-BBQCR.tmp

                                                                                                              Download File
                                                                                                              Process:C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmp
                                                                                                              File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                                                                                                              Category:dropped
                                                                                                              Size (bytes):1327
                                                                                                              Entropy (8bit):5.042117116126737
                                                                                                              Encrypted:false
                                                                                                              SSDEEP:
                                                                                                              MD5:E40244BE7715300DC4BA229C25237728
                                                                                                              SHA1:F9D299542C616D860D495CE59A6FD2B90907B2E5
                                                                                                              SHA-256:AE5027694FF0D363F757F112162AC8D49550826872C9A5B2BA67A75F56109C4D
                                                                                                              SHA-512:CBEA4111D0A2D8BB5FF5AD631728C85A38668C6D470AB8A4D59D5334B9309EF34125E9A9F70EA942113212D5B1FD5EABF9DF860F9112B52D55C95EE32BB8721A
                                                                                                              Malicious:false
                                                                                                              Preview:.<?xml version="1.0" encoding="utf-8"?>..<configuration>.. <startup> .. <supportedRuntime version="v4.0" sku=".NETFramework,Version=v4.8" />.. </startup>.. <runtime>.. <legacyCorruptedStateExceptionsPolicy enabled="true" />.. <assemblyBinding xmlns="urn:schemas-microsoft-com:asm.v1">.. <dependentAssembly>.. <assemblyIdentity name="Microsoft.Owin.Security" publicKeyToken="31bf3856ad364e35" culture="neutral" />.. <bindingRedirect oldVersion="0.0.0.0-4.2.2.0" newVersion="4.2.2.0" />.. </dependentAssembly>.. <dependentAssembly>.. <assemblyIdentity name="Newtonsoft.Json" publicKeyToken="30ad4fe6b2a6aeed" culture="neutral" />.. <bindingRedirect oldVersion="0.0.0.0-13.0.0.0" newVersion="13.0.0.0" />.. </dependentAssembly>.. <dependentAssembly>.. <assemblyIdentity name="Microsoft.Owin" publicKeyToken="31bf3856ad364e35" culture="neutral" />.. <bindingRedirect oldVersion="0.0.0.0-4.2.2.0" newVersion="4.2.2.0

                                                                                                              C:\Program Files\FastestVPN\Service\is-C2OTC.tmp

                                                                                                              Download File
                                                                                                              Process:C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmp
                                                                                                              File Type:PE32 executable (console) Intel 80386, for MS Windows
                                                                                                              Category:dropped
                                                                                                              Size (bytes):301224
                                                                                                              Entropy (8bit):5.822993671222324
                                                                                                              Encrypted:false
                                                                                                              SSDEEP:
                                                                                                              MD5:8E545EE7F96C317AADC4EDA0F0FCF481
                                                                                                              SHA1:242F4D714B142C10368AA82AF91B0A06E0A4E33F
                                                                                                              SHA-256:A67BBFB9EFE5C1CD55D3B8209093BA93370F1EAE4F03A0349696D7B45867EAFC
                                                                                                              SHA-512:77EBC317804B3D0830E76156D93A38980CA113CA80B0A3A2051FDF00D2ABAC96A39AA9BF099AE9CC5AF1E27D14976B5C582096DD6B3AB7F521423FCE6EC11FDE
                                                                                                              Malicious:false
                                                                                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........._.Y.1.Y.1.Y.1..l.[.1...>.].1.[.5.[.1.9.|.X.1...l.D.1.Y.0.p.1...n.V.1...Q.M.1...o.X.1...k.X.1.RichY.1.........PE..L...[..@.................J...................`...............................P......2............ ...........................=..T....@...............n...*..............................................@............................................text....I.......J.................. ..`.data...L....`.......N..............@....rsrc........@.......^..............@..@........................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                              C:\Program Files\FastestVPN\Service\is-D7DH9.tmp

                                                                                                              Download File
                                                                                                              Process:C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmp
                                                                                                              File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                              Category:dropped
                                                                                                              Size (bytes):60584
                                                                                                              Entropy (8bit):6.426868083769682
                                                                                                              Encrypted:false
                                                                                                              SSDEEP:
                                                                                                              MD5:D4BECC422A254D1A75CFC60750572848
                                                                                                              SHA1:2AE1D45045828B8D9A57DD90213F462D72F9A98B
                                                                                                              SHA-256:A8BC4A168A5F9CD7ABBBBFF3F0794F433233A72D557E168AF42BD34FFF3A2F34
                                                                                                              SHA-512:91A1E21F87868A00CF715018577A028413CB638A7965756324AFCF16A6108906DCB355959882C2C555C7276EF1A70627E455B4057695DE8C462E4D0679FEFAC5
                                                                                                              Malicious:false
                                                                                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L................." ..0.............r.... ........... ....................... ............`................................. ...O........................*..............8............................................ ............... ..H............text...x.... ...................... ..`.rsrc...............................@..@.reloc..............................@..B................T.......H.......T0..4.............................................................{....*"..}....*..{....*"..}....*..{....*"..}....*..{....*"..}....*..{....*"..}....*..{....*"..}....*>.(....o4......*>.(....o4......*>.(....o2......*>.(....o2......*>.(....o2......*v.(....-..(....,..(....+..+..*..{....*"..}....*6..s....}....*..0............(......,...(k.....*....0..4.......s......(....}......}......}......}.....|......(...+*.0..Y.........(....o....r...p(....(c....(f....(g.....(......,&.

                                                                                                              C:\Program Files\FastestVPN\Service\is-DPP41.tmp

                                                                                                              Download File
                                                                                                              Process:C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmp
                                                                                                              File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                              Category:dropped
                                                                                                              Size (bytes):20136
                                                                                                              Entropy (8bit):6.721932799011409
                                                                                                              Encrypted:false
                                                                                                              SSDEEP:
                                                                                                              MD5:8E6A799F0DA3FBA278F06D4C7A18E7B5
                                                                                                              SHA1:B9AD516A47362FFAF360C1E8794D2F10C8E7080F
                                                                                                              SHA-256:1029DDF44F3CD774754DDFEAFB97BE18CD31B50DE24F19870F9BDE8163B5DEA5
                                                                                                              SHA-512:4607E418C0BE1F632CBE5CE0A8F1877F45EB873C193B4FF7C52495E891BD05D7F3AA3847D97F36D7B5601FCCAFCF6DE4A822140D9610C9E9BCA900BC06C67DE8
                                                                                                              Malicious:false
                                                                                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...W/%..........." ..0.............^;... ...@....... ....................................`..................................;..O....@...............$...*...`......l:..8............................................ ............... ..H............text...d.... ...................... ..`.rsrc........@......................@..@.reloc.......`......."..............@..B................>;......H........$..............................................................F.(....r...p(....*..{....*"..}....*..0...........s......r...po....&.r-..p.(....o....(....o....&.rI..p.(....o....r_..p(....o....&.rg..p.(....o....(....o....&.(......,...ru..po....&..r...po....&.r...po....&.r...p.(....o....(....o....&.r...po....&.r...p.(....o....r...p(....o....&.(....o.....o....( ....*..r...p.(....o!...r...p(....r...p.(....o....r...p(....("...&*..r?..prK..p.(.........(#...("...&*..r?..pr...

                                                                                                              C:\Program Files\FastestVPN\Service\is-H126L.tmp

                                                                                                              Download File
                                                                                                              Process:C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmp
                                                                                                              File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                              Category:dropped
                                                                                                              Size (bytes):711952
                                                                                                              Entropy (8bit):5.967185619483575
                                                                                                              Encrypted:false
                                                                                                              SSDEEP:
                                                                                                              MD5:195FFB7167DB3219B217C4FD439EEDD6
                                                                                                              SHA1:1E76E6099570EDE620B76ED47CF8D03A936D49F8
                                                                                                              SHA-256:E1E27AF7B07EEEDF5CE71A9255F0422816A6FC5849A483C6714E1B472044FA9D
                                                                                                              SHA-512:56EB7F070929B239642DAB729537DDE2C2287BDB852AD9E80B5358C74B14BC2B2DDED910D0E3B6304EA27EB587E5F19DB0A92E1CBAE6A70FB20B4EF05057E4AC
                                                                                                              Malicious:false
                                                                                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...p$?..........." ..0.............B.... ........... ....................... ............`....................................O......................../.......... ...T............................................ ............... ..H............text........ ...................... ..`.rsrc...............................@..@.reloc..............................@..B................$.......H.......x...(9............................................................(....*..(....*^.(...........%...}....*:.(......}....*:.(......}....*..(....*:.(......}....*..{....*..(....*..(....*:.(......}....*..{....*.(.........*....}.....(......{.....X.....}....*..0...........-.~....*.~....X....b...aX...X...X..+....b....aX....X.....2.....cY.....cY....cY..|....(......._..{........+,..{|....3...{{......(....,...{{...*..{}.......-..*...0...........-.r...ps....z.o......-.~....*.~....

                                                                                                              C:\Program Files\FastestVPN\Service\is-JFLTF.tmp

                                                                                                              Download File
                                                                                                              Process:C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmp
                                                                                                              File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                              Category:dropped
                                                                                                              Size (bytes):70824
                                                                                                              Entropy (8bit):6.236705505937758
                                                                                                              Encrypted:false
                                                                                                              SSDEEP:
                                                                                                              MD5:F7543F2749BAB00FB981A41BE19734F8
                                                                                                              SHA1:8BE0A90C7C011EEF0A775A518F2A29CE4AB035AA
                                                                                                              SHA-256:634CD208B4FE8DB050AC7D782CB953D51E266B62369F0F80B0CF9D10D077A76F
                                                                                                              SHA-512:160FBEB4AE704D00800656274B7680003C64559867ACEFB9274A23A1AEE45A145254E66DF423653CC3776A2FFA2A4F98BA93510109CF9963AED4CEBA2913A106
                                                                                                              Malicious:false
                                                                                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.... F..........." ..0.............J.... ... ....... .......................`............`.....................................O.... ...................*...@......D...8............................................ ............... ..H............text...P.... ...................... ..`.rsrc........ ......................@..@.reloc.......@......................@..B................,.......H.......0<................................................................("...*^.("......I...%...}....*:.(".....}....*b.{....%-.&*..s#...o$...*.0..)........{.........(%...t......|......(...+...3.*....0..)........{.........('...t......|......(...+...3.*..((...*..{....*"..}....*..{....*"..}....*..{....*"..}....*2.(....s)...*..{....*"..}....*..{....*"..}....*..{....*"..}....*..((...*..{....*"..}....*..{....*"..}....*..{....*"..}....*..{....*"..}....*..((...*..{....*"..}....*..{

                                                                                                              C:\Program Files\FastestVPN\Service\is-M7EC0.tmp

                                                                                                              Download File
                                                                                                              Process:C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmp
                                                                                                              File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                              Category:dropped
                                                                                                              Size (bytes):166800
                                                                                                              Entropy (8bit):5.092225196099469
                                                                                                              Encrypted:false
                                                                                                              SSDEEP:
                                                                                                              MD5:2839920AD2E9C4B08F97715D88586056
                                                                                                              SHA1:88F7544BF59DDD40E3C934C938A20164F3B518F1
                                                                                                              SHA-256:A655B1BC143B918C6F31B52AEA2726C131F474B70BF7E2DDF36FE48B1E6E279D
                                                                                                              SHA-512:E26A141021648398F109B41275154FDFCF139845466C9A37E80A1AD43725D914FD574F59706AD68404555BCB36490CB307E7E0C9158A8B8E94F97CB93E4C0F37
                                                                                                              Malicious:false
                                                                                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L................" ..0..Z...........x... ........... ...............................b....`..................................x..O.......8............d...'...........^..p............................................ ............... ..H............text....X... ...Z.................. ..`.rsrc...8............\..............@..@.reloc...............b..............@..B.................x......H........R..............|S......D^......................................j.-.r...ps$...z.s....(....*..0..Y........-.r...ps$...z.o%...s&......r...p(...+.r+..p..((.....(...+........%...%...%...>....(...+*..-.r...ps$...z......(+.........%...o,...*N.sD...%.oC...(....*b.sD...%.s-...oC...(....*2.sD...(....*....0..C........(.....-.rC..ps$...z.-.rM..ps$...z..,...o......}......}......}....*..0..?.........(/...}4......}5......}6......}3.....|4.....(...+..|4...(1...*j.{....,..{....r]..p.

                                                                                                              C:\Program Files\FastestVPN\Service\is-NGC8I.tmp

                                                                                                              Download File
                                                                                                              Process:C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmp
                                                                                                              File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                              Category:dropped
                                                                                                              Size (bytes):35496
                                                                                                              Entropy (8bit):6.3718937380199785
                                                                                                              Encrypted:false
                                                                                                              SSDEEP:
                                                                                                              MD5:D438F337397A4CB3CA4E87F70BC4B4C0
                                                                                                              SHA1:FB6FB592744E34BA9B8B9E2B05F6D9C0C983F353
                                                                                                              SHA-256:80E40E47F7D6EB2C9CB357B1B3951D0B0429087F44BEC066993C26975CDA4A76
                                                                                                              SHA-512:8B9E589D378775331C08CEB908C4FC3BCA2AFBEA776E86163E5C641BF1D5F5E84BBA76B6E5C0102EC388005F8D09EAAA80DFB60185C83BF462543A6903236204
                                                                                                              Malicious:false
                                                                                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...>............." ..0..X...........v... ........... ...............................k....`..................................v..O....................`...*...........v..8............................................ ............... ..H............text....W... ...X.................. ..`.rsrc................Z..............@..@.reloc...............^..............@..B.................v......H........3...B...........................................................0.................(n...........................s)...}................s%...}................s....}................s....}................s....}................s....} ...............s!...}!...............s....}"...............s....}#...............s=...}$...............s9...}%...............s5...}&...............sA...}'...............sE...}(...............s-...})...............s1...}*........(....(....(....

                                                                                                              C:\Program Files\FastestVPN\Service\is-O78V3.tmp

                                                                                                              Download File
                                                                                                              Process:C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmp
                                                                                                              File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                              Category:dropped
                                                                                                              Size (bytes):18088
                                                                                                              Entropy (8bit):6.788270069437216
                                                                                                              Encrypted:false
                                                                                                              SSDEEP:
                                                                                                              MD5:A891AAC2D9FD1B939E07BE155AFC84FF
                                                                                                              SHA1:7F977350D9CFD10C259356D98C0606779519C6EF
                                                                                                              SHA-256:38D6709A0A003761850933F79132CCDC40B6F26460169BAB092931BBA1500683
                                                                                                              SHA-512:E4227CA484824ED3C912A58B741B4A447ACC50DFFB9945165303D5362BA39217FFAEFC62DF60D292A8B081DAD82CD85593FF64DB93DBC26465355D89AA527724
                                                                                                              Malicious:false
                                                                                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...X4y..........." ..0.............n3... ...@....... ...................................`..................................3..O....@..H................*...`.......2..8............................................ ............... ..H............text...t.... ...................... ..`.rsrc...H....@......................@..@.reloc.......`......................@..B................N3......H........#................................................................{....*"..}....*..{....*"..}....*..{....*"..}....*..(........%-.&r...ps....z(.......(.....*.0..................,..rM..ps....z.(.........,...(....o.......(.......(.....s....o.........(....(......(....o......(....o........&..(.....r...ps....o........*..........tu.......0..B..........(....%-.&+.o.......*&..(.....(....%-.&.+.(......s....o........*.............*.....0..B..........(....%-.&+.o ......*&..(.....

                                                                                                              C:\Program Files\FastestVPN\Service\is-PPT86.tmp

                                                                                                              Download File
                                                                                                              Process:C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmp
                                                                                                              File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                                                                              Category:dropped
                                                                                                              Size (bytes):116872
                                                                                                              Entropy (8bit):6.726218253535254
                                                                                                              Encrypted:false
                                                                                                              SSDEEP:
                                                                                                              MD5:B9F4D43230B7FB66B95AF05DC03B32DE
                                                                                                              SHA1:56F868C56FFF836CA61055499988F965DCA37D26
                                                                                                              SHA-256:A103634B16841E3A68DD4A6BCBDFC3A1651B8C9F1114D99BF01CA31297664E21
                                                                                                              SHA-512:50EB5DE7D0A1B5D7E1AC38209488635EF77733C2C78DC39D0D473904128DBFC67D4E3EC388D2C2D79645AFDF03FD1965386F6E6D21553C9A6DAB07A58549FD1E
                                                                                                              Malicious:false
                                                                                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........V.n.7.=.7.=.7.=.S.<.7.=.S.<o7.=.S.<.7.=._.<.7.=._.<.7.=._.<.7.=.S.<.7.=.7.=.7.=._.<.7.=._.<.7.=._3=.7.=._.<.7.=Rich.7.=........................PE..L...q._]...........!................O........0............................................@.............................T.......<.......................................p...............................@............0...............................text............................... ..`.rdata..4g...0...h..................@..@.data...4...........................@....rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................................

                                                                                                              C:\Program Files\FastestVPN\Service\is-SLLFS.tmp

                                                                                                              Download File
                                                                                                              Process:C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmp
                                                                                                              File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                              Category:dropped
                                                                                                              Size (bytes):28648
                                                                                                              Entropy (8bit):6.283743404391549
                                                                                                              Encrypted:false
                                                                                                              SSDEEP:
                                                                                                              MD5:9FFF1DA4E481028262E27AEFD7C0EFF4
                                                                                                              SHA1:B0128E42E3CE3C295C48461A651AF99D95B5A04D
                                                                                                              SHA-256:3FDB918CC5F1E5F1FA9C155DC68AAFE10A16C73ED934C06B201ED94070EA985D
                                                                                                              SHA-512:6B02B873C4092BFE3C2D8428093696E94C6021DB9D6FA8740E79DF7C6C5208229ED7AE8A62E96597EEEF348956BC6AB79375292B6456162F78D332E3830B75EC
                                                                                                              Malicious:false
                                                                                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...P^.b.........." ..0..>...........\... ...`....... ..............................c.....`.................................x\..O....`...............H...'..........@[............................................... ............... ..H............text....<... ...>.................. ..`.rsrc........`.......@..............@..@.reloc...............F..............@..B.................\......H.......(-...+..........8X.......Z........................................(.....s....(.....s....(.....s....(.....s....(....*..{....*"..}....*..{....*"..}....*..{....*"..}....*..{....*"..}....*..{....*"..}....*..{....*"..}....*..{....*"..}....*..{....*..0..1..........j...(.........(...._,.r...p(I...s....z..}....*..{....*"..}....*...0..p.......s....%r...po....&%.(....o....&%r/..po....&%.(....o....&%rU..po....&%.(....o....&%r{..po....&%.(.......(....-.r...p+..(.......(.......( .

                                                                                                              C:\Program Files\FastestVPN\Service\nfapi.dll (copy)

                                                                                                              Download File
                                                                                                              Process:C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmp
                                                                                                              File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                              Category:dropped
                                                                                                              Size (bytes):159368
                                                                                                              Entropy (8bit):6.32384599449582
                                                                                                              Encrypted:false
                                                                                                              SSDEEP:
                                                                                                              MD5:7AE17C855F3CC63174E90EA527B6138B
                                                                                                              SHA1:0FE1E1B2252511F33EDA3FFCF1F8FC8586AB040A
                                                                                                              SHA-256:26FF04208EC4D26EF4DDD9B3CF01C4D2A1544550BCD59EFDE6F30170053A1170
                                                                                                              SHA-512:453BA41332A704F491FC9E1EE5FBE9F883EDDB4C26A71D207C93992726E9C5B7FEDC48EEEE2A2087F64B083F9473EE794FB2C8F3B77C9DBCBBC47B67816BD156
                                                                                                              Malicious:false
                                                                                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........y..............Y.......................................................................Rich....................PE..L.....[...........!.........................................................`..................................................P.... ..`............@.......0..(...0...............................0...@............................................text....w.......................... ..`.rdata...A.......P..................@..@.data....6....... ..................@....rsrc...`.... ......................@..@.reloc..2(...0...0..................@..B................................................................................................................................................................................................................................................................................................................

                                                                                                              C:\Program Files\FastestVPN\Service\subinacl.exe (copy)

                                                                                                              Download File
                                                                                                              Process:C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmp
                                                                                                              File Type:PE32 executable (console) Intel 80386, for MS Windows
                                                                                                              Category:dropped
                                                                                                              Size (bytes):301224
                                                                                                              Entropy (8bit):5.822993671222324
                                                                                                              Encrypted:false
                                                                                                              SSDEEP:
                                                                                                              MD5:8E545EE7F96C317AADC4EDA0F0FCF481
                                                                                                              SHA1:242F4D714B142C10368AA82AF91B0A06E0A4E33F
                                                                                                              SHA-256:A67BBFB9EFE5C1CD55D3B8209093BA93370F1EAE4F03A0349696D7B45867EAFC
                                                                                                              SHA-512:77EBC317804B3D0830E76156D93A38980CA113CA80B0A3A2051FDF00D2ABAC96A39AA9BF099AE9CC5AF1E27D14976B5C582096DD6B3AB7F521423FCE6EC11FDE
                                                                                                              Malicious:false
                                                                                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........._.Y.1.Y.1.Y.1..l.[.1...>.].1.[.5.[.1.9.|.X.1...l.D.1.Y.0.p.1...n.V.1...Q.M.1...o.X.1...k.X.1.RichY.1.........PE..L...[..@.................J...................`...............................P......2............ ...........................=..T....@...............n...*..............................................@............................................text....I.......J.................. ..`.data...L....`.......N..............@....rsrc........@.......^..............@..@........................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                              C:\Program Files\FastestVPN\SingleInstanceApplication.dll (copy)

                                                                                                              Download File
                                                                                                              Process:C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmp
                                                                                                              File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                              Category:dropped
                                                                                                              Size (bytes):160936
                                                                                                              Entropy (8bit):5.261187861382329
                                                                                                              Encrypted:false
                                                                                                              SSDEEP:
                                                                                                              MD5:F3F2EB62314A960AD5F60B61A8193CBD
                                                                                                              SHA1:FD77AD6D9F96762CD7EE8D17454D9A7490FD8148
                                                                                                              SHA-256:0F74E741958310B8E65E3B2393828998DB075EBF4C5B29045707948C65CB03CC
                                                                                                              SHA-512:A62D09CF93E604AE0282F05842B607216533800F82ABF75E7D0FF1E9DED5F748B9E34D5E38170F1C837A0957D15FC4C6DF101FF2BE48D90C880807D0FB95D3E6
                                                                                                              Malicious:false
                                                                                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...2.Z...........!.........,......n:... ...@....... ....................................@..................................:..S....@..8)...........J...*...........8............................................... ............... ..H............text...t.... ...................... ..`.rsrc...8)...@...*..................@..@.reloc...............H..............@..B................P:......H........#......................P ............................................y.....3....f........UE#.H.NDC..\3,.|7...1...=.w..n.w.P5.y.......p.._Z@B..h..#,._...p...|..qXV..6.......i[..2;.'`..=.;...~....*..0..T.......(..........(....(......r...pr...p(...........s..........,..(......T+...~....(....T.*.~....,.~....o..........~....,.~....(..........*.0..e.......s.......o....s......r5..p.o ....r?..p.o ....rQ..pry..po .....s!........~.....("...s#.....r...p($...&*....0..A.......

                                                                                                              C:\Program Files\FastestVPN\System.Buffers.dll (copy)

                                                                                                              Download File
                                                                                                              Process:C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmp
                                                                                                              File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                              Category:dropped
                                                                                                              Size (bytes):22696
                                                                                                              Entropy (8bit):6.669675167195394
                                                                                                              Encrypted:false
                                                                                                              SSDEEP:
                                                                                                              MD5:657A48C8DA3DE14059498E383EBEF318
                                                                                                              SHA1:ECCC9AB4E6804EB0581AC5BBD684B7DB5A13F028
                                                                                                              SHA-256:201EC78B195DCE51330985026A8A4EC641F9ACE53429C5C2F5BB3F1CE7BEEC4A
                                                                                                              SHA-512:C4F2410470BBEA5680958490B705C828254992441D27E5FB7837957583FDA8D639EA8D9EF00035DB63ABACF28C5E4560D642C1D19F144255908C44F5C37CE8DE
                                                                                                              Malicious:false
                                                                                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....oY.........." ..0..$..........:C... ...`....... ....................................@..................................B..O....`...................*...........A............................................... ............... ..H............text...@#... ...$.................. ..`.rsrc........`.......&..............@..@.reloc...............,..............@..B.................C......H.......h'..p............?..X...0A......................................j~....%-.&(....s....%.....*..*...0..$.........(.....o.......&...,....o....,..*.*..................,!(....,..r...p.(....(....*..(....*.*.(....,.r...p......%...%...(....*..(....*.(....,.r...p......%...%...%...(....*...(....*.(....,!r...p......%...%...%...%...(....*....(....*2r...p.(....*......(....*..(....*R. ...(...+%-.&("...*^. ...(#....(...+&~ ...*.s%...*"..s&...*..('...*.*....0........................((

                                                                                                              C:\Program Files\FastestVPN\System.Memory.dll (copy)

                                                                                                              Download File
                                                                                                              Process:C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmp
                                                                                                              File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                              Category:dropped
                                                                                                              Size (bytes):143528
                                                                                                              Entropy (8bit):6.164743567434074
                                                                                                              Encrypted:false
                                                                                                              SSDEEP:
                                                                                                              MD5:24DF113016A58EB1D14691CFE947C2C8
                                                                                                              SHA1:E32B2388C9BCB8BD3EEA1A87626B562A06F5E2F9
                                                                                                              SHA-256:4DE9980CF1D3B45FC14F69EA4DFF6F456389C5E817344D44D6FA7C1A3276AFB5
                                                                                                              SHA-512:10DD82391CF51885533A5F9F859D7E79A9016F6E6A24C0A04C9BE08EA4C5A951D73AF467EC89BAB191DAC4B37D51B0C0AB247A24CD05478AD6101A44E9FC0D48
                                                                                                              Malicious:false
                                                                                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...U..\.........." ..0.............b.... ... ....... .......................`......q[....@.....................................O.... ..8................*...@..........8............................................ ............... ..H............text...8.... ...................... ..`.rsrc...8.... ......................@..@.reloc.......@......................@..B................C.......H........,..L...........,.................................................((...*>..}......}....*..{....*..{....*..{.....{....3..{.....{....()...*.*..0...........%.u....,..........(....*.*z.{....%-.&.+.o*....{....(a...*..(....zN........o+...s,...*.(....z.s-...*..(....zF(U....(O...s....*.(....z.(V...s....*.(....z.s/...*.(....z.s0...*..(....zN........o+...s1...*.(....zrr...p(\....c.M...(O...s2...*.(....zBr...p(Y...s2...*.(....z.s3...*.(....z.(X...s4...*.(!...z.(_...s4...*.(#...z

                                                                                                              C:\Program Files\FastestVPN\System.Numerics.Vectors.dll (copy)

                                                                                                              Download File
                                                                                                              Process:C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmp
                                                                                                              File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                              Category:dropped
                                                                                                              Size (bytes):110760
                                                                                                              Entropy (8bit):5.479763068610726
                                                                                                              Encrypted:false
                                                                                                              SSDEEP:
                                                                                                              MD5:3FC875FFEFAC2BBA64E6F2A6A7CFF45B
                                                                                                              SHA1:CAB48D6D156261CD9612633D70A61DA670D0D093
                                                                                                              SHA-256:5A12A8D3CA02716C616F56342C920422966ABF79B49C4B1E1C7FF36E97764E1B
                                                                                                              SHA-512:DDA0B6F0587D7915B490FFA2225E72374A2AA671E2019ABDC72EB7598B642906CF09302575C5B5B495B832FF434D45BAD0650C0409358E5D1786F4561FAE3636
                                                                                                              Malicious:false
                                                                                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....oY.........." ..0..v..........j.... ........... ....................................@.....................................O........................*..........t................................................ ............... ..H............text...pu... ...v.................. ..`.rsrc................x..............@..@.reloc..............................@..B................K.......H.......,S..0>..........\.................................................(....*&.l(....k*&.l(....k*..l.l(....k*&.l(....k*&.l(....k*&.l(....k*j~....%-.&(....s....%.....*..*.0..$.........(.....o.......&...,....o....,..*.*..................,!(....,..r...p.(....(....*..(....*.*.(....,.r...p......%...%...(....*..(....*.(....,.r...p......%...%...%...(....*...(....*.(....,!r...p......%...%...%...%...(....*....(....*2r...p.(....*2rG..p.(....*2r...p.(....*2r...p.(....*......(....*...

                                                                                                              C:\Program Files\FastestVPN\System.Runtime.CompilerServices.Unsafe.dll (copy)

                                                                                                              Download File
                                                                                                              Process:C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmp
                                                                                                              File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                              Category:dropped
                                                                                                              Size (bytes):16768
                                                                                                              Entropy (8bit):6.361391591273708
                                                                                                              Encrypted:false
                                                                                                              SSDEEP:
                                                                                                              MD5:DA04A75DDC22118ED24E0B53E474805A
                                                                                                              SHA1:2D68C648A6A6371B6046E6C3AF09128230E0AD32
                                                                                                              SHA-256:66409F670315AFE8610F17A4D3A1EE52D72B6A46C544CEC97544E8385F90AD74
                                                                                                              SHA-512:26AF01CA25E921465F477A0E1499EDC9E0AC26C23908E5E9B97D3AFD60F3308BFBF2C8CA89EA21878454CD88A1CDDD2F2F0172A6E1E87EF33C56CD7A8D16E9C8
                                                                                                              Malicious:false
                                                                                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....jM^...........!................^2... ...@....@.. ...............................y....@..................................2..S....@...................#...`....................................................... ............... ..H............text...d.... ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B................@2......H........#..@...................P ......................................{.v.`)!.t..@.62C<.=...h....X..}.`v.r...g.e...yXa.dat.mwQ.XdJ...M..`..J...$|.j.6W.U.3.r.A.h.....9Q..|..,<g..gy..6V9o%..Gd.r.0...........q....*..0..............q....*...0..............q....*...0.................*.0....................*..0....................*..0............q.........*....0............q.........*....0............*..0................*..0...............*...0...............*...0..........

                                                                                                              C:\Program Files\FastestVPN\System.Threading.Tasks.Extensions.dll (copy)

                                                                                                              Download File
                                                                                                              Process:C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmp
                                                                                                              File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                              Category:dropped
                                                                                                              Size (bytes):25984
                                                                                                              Entropy (8bit):6.291520154015514
                                                                                                              Encrypted:false
                                                                                                              SSDEEP:
                                                                                                              MD5:E1E9D7D46E5CD9525C5927DC98D9ECC7
                                                                                                              SHA1:2242627282F9E07E37B274EA36FAC2D3CD9C9110
                                                                                                              SHA-256:4F81FFD0DC7204DB75AFC35EA4291769B07C440592F28894260EEA76626A23C6
                                                                                                              SHA-512:DA7AB8C0100E7D074F0E680B28D241940733860DFBDC5B8C78428B76E807F27E44D1C5EC95EE80C0B5098E8C5D5DA4D48BCE86800164F9734A05035220C3FF11
                                                                                                              Malicious:false
                                                                                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....jM^.........." ..0..8...........V... ...`....... ....................................@..................................V..O....`...............B...#..........PU............................................... ............... ..H............text....6... ...8.................. ..`.rsrc........`.......:..............@..@.reloc...............@..............@..B.................V......H........0...$...................T........................................(....*..(....z..(....z2.(....s....*2.(....s....*:........o....*.~....*~.-..(......}......}......}....*~.-..(......}......}......}....*Z..}......}......}....*J.{....%-.&.*o....*^.u....,........(....*.*~.{.....{....3..{.....{......*.*&...(....*2...(.......*....0..'........{......,..u....%-.&..(...+(....*(....*n.{....,..(....s....*.q....*..0..a.........{....o0.....,;..{....o2...(......;...3.~.......s......

                                                                                                              C:\Program Files\FastestVPN\Updater.exe (copy)

                                                                                                              Download File
                                                                                                              Process:C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmp
                                                                                                              File Type:PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                              Category:dropped
                                                                                                              Size (bytes):354984
                                                                                                              Entropy (8bit):6.846739611307464
                                                                                                              Encrypted:false
                                                                                                              SSDEEP:
                                                                                                              MD5:D822226C4B35A7305269C8E16E542D3E
                                                                                                              SHA1:12F92D16608AAC1C39DDC92BA2B5AB8B5AAE6C30
                                                                                                              SHA-256:FC504A3F68150AFC8C3304E5528867BF99EDDE0F3707406A30371062DDD86A0E
                                                                                                              SHA-512:3A3A18D96716BD1033C35B06B73674FF6CBBEBE8F5025D0BE260F649FB268745290139B6501B9E208EB43EC5D76C2ABBA0A34C1E2F7E0E9F25E14C41F54E3914
                                                                                                              Malicious:false
                                                                                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....I}f.........."...0......D......6.... ... ....@.. ..............................o.....`.....................................O.... ..tA...........@...*........................................................... ............... ..H............text...<.... ...................... ..`.rsrc...tA... ...B..................@..@.reloc...............>..............@..B........................H........'... ...........G...............................................~....*.......*..,!.(...+.1..(...+(....-..(...+(....s....%o....%.o....o....&*....0..5........r...p.s....(.....{....,.*..}....r!..p.s.......(....*"..}....*..(....*.rY..p.....*..{....*"..}....*..{....*"..}....*..{....*"..}....*..{....*"..}....*..{....*"..}....*..{....*"..}....*..{....*"..}....*..{....*"..}....*...0............j(......j(.....(....,#.(....o....,..(....o ....(....o!.....(......&...s"...(.....(

                                                                                                              C:\Program Files\FastestVPN\Updater.exe.config (copy)

                                                                                                              Download File
                                                                                                              Process:C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmp
                                                                                                              File Type:XML 1.0 document, ASCII text, with CRLF line terminators
                                                                                                              Category:dropped
                                                                                                              Size (bytes):1106
                                                                                                              Entropy (8bit):5.038231865445437
                                                                                                              Encrypted:false
                                                                                                              SSDEEP:
                                                                                                              MD5:75E66AB540561A0C7D4160271F518243
                                                                                                              SHA1:AD6501E407D216744B6C3DE76D7664D9581EBAD2
                                                                                                              SHA-256:091AFFF3BB63024B5A7B14EA30306B6753858FD1A33FC8C98E3B5E65FE92FBE7
                                                                                                              SHA-512:FCB55C0FDBB984B06AFF2FAFCAEA2596C175AA5A07D2F1A401305D3441338AA266A53D2DE7A7577684884A2E12CE3EE430B2E1D0210684A7EEFAF9EAA0DE115F
                                                                                                              Malicious:false
                                                                                                              Preview:<?xml version="1.0" encoding="utf-8"?>..<configuration>.... <appSettings>.. <add key="DownloadLocation" value=""/>.. </appSettings>.... <runtime>.... <assemblyBinding xmlns="urn:schemas-microsoft-com:asm.v1">.... <dependentAssembly>.... <assemblyIdentity name="System.Runtime" publicKeyToken="b03f5f7f11d50a3a" culture="neutral"/>.... <bindingRedirect oldVersion="0.0.0.0-4.0.0.0" newVersion="4.0.0.0"/>.... </dependentAssembly>.... <dependentAssembly>.... <assemblyIdentity name="System.Threading.Tasks" publicKeyToken="b03f5f7f11d50a3a" culture="neutral"/>.... <bindingRedirect oldVersion="0.0.0.0-4.0.0.0" newVersion="4.0.0.0"/>.... </dependentAssembly>.... <dependentAssembly>.... <assemblyIdentity name="System.Net.Http" publicKeyToken="b03f5f7f11d50a3a" culture="neutral"/>.... <bindingRedirect oldVersion="0.0.0.0-4.0.0.0" newVersion="4.0.0.0"/>.... </dependentAssembly>.... </assemblyBinding>.... </runtime>

                                                                                                              C:\Program Files\FastestVPN\VPN.AdvancedNetwork.dll (copy)

                                                                                                              Download File
                                                                                                              Process:C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmp
                                                                                                              File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                              Category:dropped
                                                                                                              Size (bytes):35496
                                                                                                              Entropy (8bit):6.3704146545353355
                                                                                                              Encrypted:false
                                                                                                              SSDEEP:
                                                                                                              MD5:26592109F19A24EE91F039EBB40038C4
                                                                                                              SHA1:C8846404EFEB44C6CBB242B4C107F7CCE865AD14
                                                                                                              SHA-256:E3F74128991C128410498223D4185915528360AD3DA92CD01BC23B19D8C2C670
                                                                                                              SHA-512:8B031C53F5529D50A80AE2A4803D7C34F9A71A54DA01A912D1DB4D77D9BC1F490AB634A32F2DF6009EB53A2E57CD21975F3E00AF111BFA8320DE550A17509CA1
                                                                                                              Malicious:false
                                                                                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...>............." ..0..X...........v... ........... ...............................S....`..................................v..O....................`...*...........v..8............................................ ............... ..H............text....W... ...X.................. ..`.rsrc................Z..............@..@.reloc...............^..............@..B.................v......H........3...B...........................................................0.................(n...........................s)...}................s%...}................s....}................s....}................s....}................s....} ...............s!...}!...............s....}"...............s....}#...............s=...}$...............s9...}%...............s5...}&...............sA...}'...............sE...}(...............s-...})...............s1...}*........(....(....(....

                                                                                                              C:\Program Files\FastestVPN\VPN.Common.dll (copy)

                                                                                                              Download File
                                                                                                              Process:C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmp
                                                                                                              File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                              Category:dropped
                                                                                                              Size (bytes):60584
                                                                                                              Entropy (8bit):6.4260026936119194
                                                                                                              Encrypted:false
                                                                                                              SSDEEP:
                                                                                                              MD5:550D6E67BB1795B941E91840508BF7F6
                                                                                                              SHA1:46E22693BDC92F4E8DD8C4C5433D233438A271EF
                                                                                                              SHA-256:D4B4CEB77A3D429EE21412E5172AAC6E36C553E7D990137F212E5ADD6B9A9336
                                                                                                              SHA-512:1271BEC8A700AC925B9AC13FDB84FFCCFFA6A1589FA3F9FA1361282C47BB8985A7C8F0335EFDD422E2A708BF2DD46458AEF64B4E2A54B8488F8ED53750337A23
                                                                                                              Malicious:false
                                                                                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L................." ..0.............r.... ........... ....................... ............`................................. ...O........................*..............8............................................ ............... ..H............text...x.... ...................... ..`.rsrc...............................@..@.reloc..............................@..B................T.......H.......T0..4.............................................................{....*"..}....*..{....*"..}....*..{....*"..}....*..{....*"..}....*..{....*"..}....*..{....*"..}....*>.(....o4......*>.(....o4......*>.(....o2......*>.(....o2......*>.(....o2......*v.(....-..(....,..(....+..+..*..{....*"..}....*6..s....}....*..0............(......,...(k.....*....0..4.......s......(....}......}......}......}.....|......(...+*.0..Y.........(....o....r...p(....(c....(f....(g.....(......,&.

                                                                                                              C:\Program Files\FastestVPN\VPN.OpenVpn.dll (copy)

                                                                                                              Download File
                                                                                                              Process:C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmp
                                                                                                              File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                              Category:dropped
                                                                                                              Size (bytes):31912
                                                                                                              Entropy (8bit):6.377831305172757
                                                                                                              Encrypted:false
                                                                                                              SSDEEP:
                                                                                                              MD5:CE66CBCDA6D3B5047691C4AFF63CFE79
                                                                                                              SHA1:358E3A2284798BE1C537756A41721B61643D2BEE
                                                                                                              SHA-256:B8551ECBE96BB718BAA56E053589A7F16561BFDAB86575441EC5FBE528B32B8C
                                                                                                              SHA-512:7BC26EDD1C018553B163B75250B5862D26B607C26BDBFB6934F0AC5CE20B04D1956EEAF3915CBCE2129CD992ECA6E1B1C311991427D485CB43969A05431270E4
                                                                                                              Malicious:false
                                                                                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...r.C..........." ..0..J..........~h... ........... ..............................wt....`.................................*h..O....................R...*...........g..8............................................ ............... ..H............text....H... ...J.................. ..`.rsrc................L..............@..@.reloc...............P..............@..B................^h......H........1...5............................................................{....*"..}....*..{....*"..}....*..{....*"..}....*..{....*"..}....*&..(.....*...0...........s.......o.....+X..(.........(....o....o....&..(.........,!..r...po....&...(....o....o....&..r...po....&...(....-...........o ......o....o!.....+...*...........et.......0...........s"...%r...p.o#....%r...pr#..po#....%r+..prA..po#....%r]..p.($...o%...o#....%ro..p.($...o&............o....o'...o#....%r...p.($...o(....

                                                                                                              C:\Program Files\FastestVPN\VPN.RAS.dll (copy)

                                                                                                              Download File
                                                                                                              Process:C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmp
                                                                                                              File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                              Category:dropped
                                                                                                              Size (bytes):41128
                                                                                                              Entropy (8bit):6.4006875255426365
                                                                                                              Encrypted:false
                                                                                                              SSDEEP:
                                                                                                              MD5:FDF4712500755002CD0FFD2F7BEA8C2A
                                                                                                              SHA1:372F4D6F2F19A5DF96FCDEF566AE4761F7AFF2B5
                                                                                                              SHA-256:D61A675E7D11A6DDF12E4CEBCABFD7BAAA24B86AD7B751BE19788E7A8A5ABE39
                                                                                                              SHA-512:6484349215D1347FB3D77E6598AF740045AC416EE06370B8D89E91ECBA930E5AFFCE6F4840CE4ECD2214960E1884CCBE49710E5B5C1FEBE0C96F88A099AE2E4E
                                                                                                              Malicious:false
                                                                                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....z:..........." ..0..n..........&.... ........... ....................................`....................................O.......h............v...*..........@...8............................................ ............... ..H............text...,m... ...n.................. ..`.rsrc...h............p..............@..@.reloc...............t..............@..B........................H........6..PU............................................................{....*"..}....*..{....*"..}....*..~....}......s....}.....(........(.............s*...}....*....0..................,5...(A.....(.........,..~.....(.....s....o.......8..............0....B+......8..... . ...G+.. . ..;....8....~.....(.....s....o.....8....~.....(.....s....o.....+s.o.....~.....(....s....o......(....o ...r...p(!.......,...(.......{.....{....o"....(6...&+...(......s#...(.....+.+..*..0..F.......

                                                                                                              C:\Program Files\FastestVPN\VPN.WireGuard.dll (copy)

                                                                                                              Download File
                                                                                                              Process:C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmp
                                                                                                              File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                              Category:dropped
                                                                                                              Size (bytes):20136
                                                                                                              Entropy (8bit):6.723147332362829
                                                                                                              Encrypted:false
                                                                                                              SSDEEP:
                                                                                                              MD5:14A266CFF3BC7795C208096E24D4791D
                                                                                                              SHA1:D55A976C562A309B4EEB860E711324A22357470E
                                                                                                              SHA-256:2C2E075009E736927EBC468CDFB7FF273F73670DF87A057C7B98D18A17CA945D
                                                                                                              SHA-512:E4A82644052C82F3CFEBAFFF15DEF713F3883F3E32043FAFB607CEE008498329C2E5A5712B0FEE670D68C9CEE127EC70FEC88977B25AF838B5977595268CD252
                                                                                                              Malicious:false
                                                                                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...W/%..........." ..0.............^;... ...@....... ..............................}.....`..................................;..O....@...............$...*...`......l:..8............................................ ............... ..H............text...d.... ...................... ..`.rsrc........@......................@..@.reloc.......`......."..............@..B................>;......H........$..............................................................F.(....r...p(....*..{....*"..}....*..0...........s......r...po....&.r-..p.(....o....(....o....&.rI..p.(....o....r_..p(....o....&.rg..p.(....o....(....o....&.(......,...ru..po....&..r...po....&.r...po....&.r...p.(....o....(....o....&.r...po....&.r...p.(....o....r...p(....o....&.(....o.....o....( ....*..r...p.(....o!...r...p(....r...p.(....o....r...p(....("...&*..r?..prK..p.(.........(#...("...&*..r?..pr...

                                                                                                              C:\Program Files\FastestVPN\VPN.dll (copy)

                                                                                                              Download File
                                                                                                              Process:C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmp
                                                                                                              File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                              Category:dropped
                                                                                                              Size (bytes):18088
                                                                                                              Entropy (8bit):6.784018634948529
                                                                                                              Encrypted:false
                                                                                                              SSDEEP:
                                                                                                              MD5:CD6CB12E677F6C45BBFE57DED6C90567
                                                                                                              SHA1:C13525F597974BA46B4B2A71F270B1056332F77B
                                                                                                              SHA-256:FA0E1B932B5548F39795B9C24106B48D6221600EA7679D6A1D1DEEED1C8D7D8C
                                                                                                              SHA-512:6D9DC73035F3C053281C9347131C8EF232797507F28271B60428FCA4A82CC43689BF1FA3E6DCE46AE92BC3C0E924745F81E315D2E4D4BD2F5D7991DC78A58FBD
                                                                                                              Malicious:false
                                                                                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...X4y..........." ..0.............n3... ...@....... ....................................`..................................3..O....@..H................*...`.......2..8............................................ ............... ..H............text...t.... ...................... ..`.rsrc...H....@......................@..@.reloc.......`......................@..B................N3......H........#................................................................{....*"..}....*..{....*"..}....*..{....*"..}....*..(........%-.&r...ps....z(.......(.....*.0..................,..rM..ps....z.(.........,...(....o.......(.......(.....s....o.........(....(......(....o......(....o........&..(.....r...ps....o........*..........tu.......0..B..........(....%-.&+.o.......*&..(.....(....%-.&.+.(......s....o........*.............*.....0..B..........(....%-.&+.o ......*&..(.....

                                                                                                              C:\Program Files\FastestVPN\WpfAnimatedGif.dll (copy)

                                                                                                              Download File
                                                                                                              Process:C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmp
                                                                                                              File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                              Category:dropped
                                                                                                              Size (bytes):53416
                                                                                                              Entropy (8bit):6.326182355914875
                                                                                                              Encrypted:false
                                                                                                              SSDEEP:
                                                                                                              MD5:C4BC370961A9E628E64B8FF4586D4DA6
                                                                                                              SHA1:B391F6A1A54B693F14BA7E8CD58DD8976CDDC992
                                                                                                              SHA-256:097B7F6F9ED8B63F0E725DE28D6842F6AC93D8105E441C7498385FAAD243A8C1
                                                                                                              SHA-512:169FD48C453BC95D33137BDAA22225B483CF9BF73CBCE9AFB5B6BF63B62300CC98A968F1D825348CDB8C786232B66D62247659FD809B6B0D7BCBF26C7B4519A4
                                                                                                              Malicious:false
                                                                                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L................." ..0.................. ........... ....................................@.................................J...O.......$................*..........h...T............................................ ............... ..H............text........ ...................... ..`.rsrc...$...........................@..@.reloc..............................@..B................~.......H........H..Hq...........................................................{....*..{....*V.(......}......}....*...0..A........u........4.,/(.....{.....{....o....,.(.....{.....{....o....*.*.*. ...' )UU.Z(.....{....o....X )UU.Z(.....{....o....X*...0..b........r...p......%..{.......%q.........-.&.+.......o ....%..{.......%q.........-.&.+.......o ....(!...*...0..2..........(....~.......o"...-.~.....s#...%.o$.....o%...&*...0..A..........(....~.......o"...,)..o&..., .o'...-.~.....o(

                                                                                                              C:\Program Files\FastestVPN\app-icon.ico (copy)

                                                                                                              Download File
                                                                                                              Process:C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmp
                                                                                                              File Type:MS Windows icon resource - 3 icons, 16x16, 32 bits/pixel, 32x32, 32 bits/pixel
                                                                                                              Category:dropped
                                                                                                              Size (bytes):15086
                                                                                                              Entropy (8bit):3.1108966039740653
                                                                                                              Encrypted:false
                                                                                                              SSDEEP:
                                                                                                              MD5:BC1059DA39659B80A09C994AE6DB5DB7
                                                                                                              SHA1:D7E9D74133C98F897B94C42F09B93F10E3274EDB
                                                                                                              SHA-256:9543C96124919AE5B672FD7C23CCF5946A37FBB83A174112A33DA9FF37449B43
                                                                                                              SHA-512:F88CD2EC86E52EF31C471E580A9733D7DAAA7E3062C7DBCAAF9E50308934A4B679B364A4C1372D9021D9F5A504D5C310B8F631799AFA3248878B4F55A6CB704B
                                                                                                              Malicious:false
                                                                                                              Preview:............ .h...6... .... .........00.... ..%..F...(....... ..... .....@...................................2..A!...........................................................3..#.... ..-...................................................................m....................................................`.............. ................................................... ..]...............G........................................................ ...!...&...,{..........................7...................!...!... ... ......U....................U...+.../...,...'.......................,..7....................4..7(...)...-...4...@...>...2...........N.......................*..M&...*.......0...7...Y...j...r...?..i............................(..M...............................................................`...!..}..............._................................................0..!"..............5.......................................................I......................................

                                                                                                              C:\Program Files\FastestVPN\fix-dns-leak-32.dll (copy)

                                                                                                              Download File
                                                                                                              Process:C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmp
                                                                                                              File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                              Category:dropped
                                                                                                              Size (bytes):25768
                                                                                                              Entropy (8bit):6.8288213942048985
                                                                                                              Encrypted:false
                                                                                                              SSDEEP:
                                                                                                              MD5:37E6E1D07988932C4360D74A34B27AE9
                                                                                                              SHA1:F53AE2462ECC565EFCC28D1C5BB2C285BF899798
                                                                                                              SHA-256:7E321840FA4F112D0F117D8F4E4DDCA274829693CD1C1189CE1061B6F67550FF
                                                                                                              SHA-512:EFB94F19A885D20BF602AFE84CDD4FE5E9CE89B3A5B7D0BD5273546A6B5D894AD6F1359545DC6B2EEDE06FCB06790286CB69EFB153F249D7D8EF0C677C5D1B3A
                                                                                                              Malicious:false
                                                                                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......4.a.pi.Hpi.Hpi.H68.Hri.H68.H|i.H68.Hri.H68.Hti.H...Hqi.H...Hyi.Hpi.HFi.H};.Hsi.H};.Hqi.H};.Hqi.H};.Hqi.HRichpi.H........PE..L....q.Z...........!.................$.......0...............................p............@..........................7......D:.......P...............:...*...`..x...................................p4..@............0...............................text............................... ..`.rdata.......0......."..............@..@.data...\....@.......2..............@....rsrc........P.......4..............@..@.reloc..x....`.......6..............@..B................................................................................................................................................................................................................................................................................................................

                                                                                                              C:\Program Files\FastestVPN\iphelperclose.dll (copy)

                                                                                                              Download File
                                                                                                              Process:C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmp
                                                                                                              File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                                                                              Category:dropped
                                                                                                              Size (bytes):116872
                                                                                                              Entropy (8bit):6.726218253535254
                                                                                                              Encrypted:false
                                                                                                              SSDEEP:
                                                                                                              MD5:B9F4D43230B7FB66B95AF05DC03B32DE
                                                                                                              SHA1:56F868C56FFF836CA61055499988F965DCA37D26
                                                                                                              SHA-256:A103634B16841E3A68DD4A6BCBDFC3A1651B8C9F1114D99BF01CA31297664E21
                                                                                                              SHA-512:50EB5DE7D0A1B5D7E1AC38209488635EF77733C2C78DC39D0D473904128DBFC67D4E3EC388D2C2D79645AFDF03FD1965386F6E6D21553C9A6DAB07A58549FD1E
                                                                                                              Malicious:false
                                                                                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........V.n.7.=.7.=.7.=.S.<.7.=.S.<o7.=.S.<.7.=._.<.7.=._.<.7.=._.<.7.=.S.<.7.=.7.=.7.=._.<.7.=._.<.7.=._3=.7.=._.<.7.=Rich.7.=........................PE..L...q._]...........!................O........0............................................@.............................T.......<.......................................p...............................@............0...............................text............................... ..`.rdata..4g...0...h..................@..@.data...4...........................@....rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................................

                                                                                                              C:\Program Files\FastestVPN\is-0B265.tmp

                                                                                                              Download File
                                                                                                              Process:C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmp
                                                                                                              File Type:PE32 executable (console) Intel 80386, for MS Windows
                                                                                                              Category:dropped
                                                                                                              Size (bytes):301224
                                                                                                              Entropy (8bit):5.823114295644
                                                                                                              Encrypted:false
                                                                                                              SSDEEP:
                                                                                                              MD5:4798226EE22C513302EE57D3AA94398B
                                                                                                              SHA1:F42C6CFA4068263D955608DE47E60D099AD8B394
                                                                                                              SHA-256:38F32C75433A2AF902D33511BC3BBBE5BBF66D87FEC7D3AD1694AECEEB7E485E
                                                                                                              SHA-512:94BB5E38CBCDC1E40BBD3AB14A3C92C8C90F64EA1910108BB2DE80E00BEA358A13A063031B5E3417A55102DB238488F5C3E766A1AF3ACEDB8806FEC5DD81990C
                                                                                                              Malicious:false
                                                                                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........._.Y.1.Y.1.Y.1..l.[.1...>.].1.[.5.[.1.9.|.X.1...l.D.1.Y.0.p.1...n.V.1...Q.M.1...o.X.1...k.X.1.RichY.1.........PE..L...[..@.................J...................`...............................P................... ...........................=..T....@...............n...*..............................................@............................................text....I.......J.................. ..`.data...L....`.......N..............@....rsrc........@.......^..............@..@........................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                              C:\Program Files\FastestVPN\is-1GRRH.tmp

                                                                                                              Download File
                                                                                                              Process:C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmp
                                                                                                              File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                              Category:dropped
                                                                                                              Size (bytes):20136
                                                                                                              Entropy (8bit):6.723147332362829
                                                                                                              Encrypted:false
                                                                                                              SSDEEP:
                                                                                                              MD5:14A266CFF3BC7795C208096E24D4791D
                                                                                                              SHA1:D55A976C562A309B4EEB860E711324A22357470E
                                                                                                              SHA-256:2C2E075009E736927EBC468CDFB7FF273F73670DF87A057C7B98D18A17CA945D
                                                                                                              SHA-512:E4A82644052C82F3CFEBAFFF15DEF713F3883F3E32043FAFB607CEE008498329C2E5A5712B0FEE670D68C9CEE127EC70FEC88977B25AF838B5977595268CD252
                                                                                                              Malicious:false
                                                                                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...W/%..........." ..0.............^;... ...@....... ..............................}.....`..................................;..O....@...............$...*...`......l:..8............................................ ............... ..H............text...d.... ...................... ..`.rsrc........@......................@..@.reloc.......`......."..............@..B................>;......H........$..............................................................F.(....r...p(....*..{....*"..}....*..0...........s......r...po....&.r-..p.(....o....(....o....&.rI..p.(....o....r_..p(....o....&.rg..p.(....o....(....o....&.(......,...ru..po....&..r...po....&.r...po....&.r...p.(....o....(....o....&.r...po....&.r...p.(....o....r...p(....o....&.(....o.....o....( ....*..r...p.(....o!...r...p(....r...p.(....o....r...p(....("...&*..r?..prK..p.(.........(#...("...&*..r?..pr...

                                                                                                              C:\Program Files\FastestVPN\is-28KS7.tmp

                                                                                                              Download File
                                                                                                              Process:C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmp
                                                                                                              File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                              Category:dropped
                                                                                                              Size (bytes):22696
                                                                                                              Entropy (8bit):6.669675167195394
                                                                                                              Encrypted:false
                                                                                                              SSDEEP:
                                                                                                              MD5:657A48C8DA3DE14059498E383EBEF318
                                                                                                              SHA1:ECCC9AB4E6804EB0581AC5BBD684B7DB5A13F028
                                                                                                              SHA-256:201EC78B195DCE51330985026A8A4EC641F9ACE53429C5C2F5BB3F1CE7BEEC4A
                                                                                                              SHA-512:C4F2410470BBEA5680958490B705C828254992441D27E5FB7837957583FDA8D639EA8D9EF00035DB63ABACF28C5E4560D642C1D19F144255908C44F5C37CE8DE
                                                                                                              Malicious:false
                                                                                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....oY.........." ..0..$..........:C... ...`....... ....................................@..................................B..O....`...................*...........A............................................... ............... ..H............text...@#... ...$.................. ..`.rsrc........`.......&..............@..@.reloc...............,..............@..B.................C......H.......h'..p............?..X...0A......................................j~....%-.&(....s....%.....*..*...0..$.........(.....o.......&...,....o....,..*.*..................,!(....,..r...p.(....(....*..(....*.*.(....,.r...p......%...%...(....*..(....*.(....,.r...p......%...%...%...(....*...(....*.(....,!r...p......%...%...%...%...(....*....(....*2r...p.(....*......(....*..(....*R. ...(...+%-.&("...*^. ...(#....(...+&~ ...*.s%...*"..s&...*..('...*.*....0........................((

                                                                                                              C:\Program Files\FastestVPN\is-2DBGR.tmp

                                                                                                              Download File
                                                                                                              Process:C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmp
                                                                                                              File Type:PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                              Category:dropped
                                                                                                              Size (bytes):2059432
                                                                                                              Entropy (8bit):7.651137710710665
                                                                                                              Encrypted:false
                                                                                                              SSDEEP:
                                                                                                              MD5:01CF6EF766C41BB2C99A2CCCDECC69C1
                                                                                                              SHA1:8DD5EB983C1C8F2E3A2538E50295644BB778A69E
                                                                                                              SHA-256:9A9B95CA40D32FA23A615A122FA3AAF7AEB32FBEF2850D729F77C1169FFC0452
                                                                                                              SHA-512:9EE4D4D7852555F67CF0C9B372DCA87EC0727AB0A6FC5EAE309CF6BF5467FC75C6868A5E528D34AB605CDC736D30684D35A1451D4ABE3B99BA37D276474AC940
                                                                                                              Malicious:false
                                                                                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....G............"...0......D........... ... ....@.. ...............................P ...`.................................^...O.... ...A...........B...*..............8............................................ ............... ..H............text........ ...................... ..`.rsrc....A... ...B..................@..@.reloc...............@..............@..B........................H.......DD..T`......-....... v...........................................0..O.......s....%.o....%.o ...%.o!...%..o".....o#........($........(%..._,...o&...(....*.*..(....*..{....*"..}....*..{....*"..}....*..{....*"..}....*..{....*"..}....*...(.......(....(.......(....(.......(....(.....*.0..5........('...-..*.((.....o)...(*...(+...(,.......,..o-.....*............)........(....*2.(/...o0...*..(1...*.(2...*2.(....o3...*..(....o4...&.(.....o5....(.....o5....(....o6...&*2.(....o7

                                                                                                              C:\Program Files\FastestVPN\is-2J970.tmp

                                                                                                              Download File
                                                                                                              Process:C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmp
                                                                                                              File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                              Category:dropped
                                                                                                              Size (bytes):25976
                                                                                                              Entropy (8bit):6.331152456306087
                                                                                                              Encrypted:false
                                                                                                              SSDEEP:
                                                                                                              MD5:3C5DFBB4E3F1AD153EB2E203B56EA0AE
                                                                                                              SHA1:59623BF1D67D87264C165E421F12426DA998AF46
                                                                                                              SHA-256:9E8252429D0E6529B87A2C79A13119F4DF56ABE924949F3750B024C51D747378
                                                                                                              SHA-512:94DF20E98A2E5D7AC93B63EFEBCE4DAAFBF25AB6B4A2B76AF0BB46D9EDE102AC8C8E1147D5813CDB879AADD5A8AA4073FD0E6066286AF4EF4D368FAB983BE3B5
                                                                                                              Malicious:false
                                                                                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....w............" ..0..4...........S... ...`....... ....................................`..................................S..O....`...............>..x'..........XR..T............................................ ............... ..H............text....3... ...4.................. ..`.rsrc........`.......6..............@..@.reloc...............<..............@..B.................S......H.......l,..l%...................Q........................................(....*.0..H.........~....,...~....*~..........(......~....%-.&s....%...........,..(......*........#<.......0..%.......~..........(...............,..(.....*....................0..........~..........(....(....o....(...+....,..(......*...........".......0..0.......~..........(....(.....o.....(...+....,..(......*.........$.......0..).......~..........(....(......o.......,..(.....*....................0..b...

                                                                                                              C:\Program Files\FastestVPN\is-3TGVV.tmp

                                                                                                              Download File
                                                                                                              Process:C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmp
                                                                                                              File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                              Category:dropped
                                                                                                              Size (bytes):149896
                                                                                                              Entropy (8bit):6.136390335470081
                                                                                                              Encrypted:false
                                                                                                              SSDEEP:
                                                                                                              MD5:70B1C15FDBBFB88F91965DC7BBC5527F
                                                                                                              SHA1:A473571DAC42819933CD7EF0C604F1EA0614D2F3
                                                                                                              SHA-256:109878A7A6F6BD13637B7E3A2EBC22D37423716ECD4E954CC09BACB84B92F62B
                                                                                                              SHA-512:C496EE2DDF6C401E9E48FB6D739C44200EBFE36B516E7608CECB3E32FEB620CE1531CC5DE26B1A4CD033C65FD002D6B6315B746CFB8B4D047A2954F6F33CA0A4
                                                                                                              Malicious:false
                                                                                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...5A............" ..0..............;... ...@....... ..............................Ri....`.................................N;..O....@...............&...#...`......X:..T............................................ ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`.......$..............@..B.................;......H.......h....Y..........H'.......9........................................(...+*.~....*.~....*.~....*..%-.&(....*..%-.&~ ...*....0..........(!......o"......(7.......*...................0..........(!......o...+...(...+....*....................~$...%-.&~%.....&...s'...%.$....(...+*.0..D.............,:......o(.....,......o(....3.........o)....(....+.....(...+.*.0..9.......s*......}+.....},.....}-................s/... ....(B...&*....0..$........,...r...p......%.....o~......o0...*

                                                                                                              C:\Program Files\FastestVPN\is-4N32R.tmp

                                                                                                              Download File
                                                                                                              Process:C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmp
                                                                                                              File Type:PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                              Category:dropped
                                                                                                              Size (bytes):354984
                                                                                                              Entropy (8bit):6.846739611307464
                                                                                                              Encrypted:false
                                                                                                              SSDEEP:
                                                                                                              MD5:D822226C4B35A7305269C8E16E542D3E
                                                                                                              SHA1:12F92D16608AAC1C39DDC92BA2B5AB8B5AAE6C30
                                                                                                              SHA-256:FC504A3F68150AFC8C3304E5528867BF99EDDE0F3707406A30371062DDD86A0E
                                                                                                              SHA-512:3A3A18D96716BD1033C35B06B73674FF6CBBEBE8F5025D0BE260F649FB268745290139B6501B9E208EB43EC5D76C2ABBA0A34C1E2F7E0E9F25E14C41F54E3914
                                                                                                              Malicious:false
                                                                                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....I}f.........."...0......D......6.... ... ....@.. ..............................o.....`.....................................O.... ..tA...........@...*........................................................... ............... ..H............text...<.... ...................... ..`.rsrc...tA... ...B..................@..@.reloc...............>..............@..B........................H........'... ...........G...............................................~....*.......*..,!.(...+.1..(...+(....-..(...+(....s....%o....%.o....o....&*....0..5........r...p.s....(.....{....,.*..}....r!..p.s.......(....*"..}....*..(....*.rY..p.....*..{....*"..}....*..{....*"..}....*..{....*"..}....*..{....*"..}....*..{....*"..}....*..{....*"..}....*..{....*"..}....*..{....*"..}....*...0............j(......j(.....(....,#.(....o....,..(....o ....(....o!.....(......&...s"...(.....(

                                                                                                              C:\Program Files\FastestVPN\is-67AMD.tmp

                                                                                                              Download File
                                                                                                              Process:C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmp
                                                                                                              File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                                                                              Category:dropped
                                                                                                              Size (bytes):116872
                                                                                                              Entropy (8bit):6.726218253535254
                                                                                                              Encrypted:false
                                                                                                              SSDEEP:
                                                                                                              MD5:B9F4D43230B7FB66B95AF05DC03B32DE
                                                                                                              SHA1:56F868C56FFF836CA61055499988F965DCA37D26
                                                                                                              SHA-256:A103634B16841E3A68DD4A6BCBDFC3A1651B8C9F1114D99BF01CA31297664E21
                                                                                                              SHA-512:50EB5DE7D0A1B5D7E1AC38209488635EF77733C2C78DC39D0D473904128DBFC67D4E3EC388D2C2D79645AFDF03FD1965386F6E6D21553C9A6DAB07A58549FD1E
                                                                                                              Malicious:false
                                                                                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........V.n.7.=.7.=.7.=.S.<.7.=.S.<o7.=.S.<.7.=._.<.7.=._.<.7.=._.<.7.=.S.<.7.=.7.=.7.=._.<.7.=._.<.7.=._3=.7.=._.<.7.=Rich.7.=........................PE..L...q._]...........!................O........0............................................@.............................T.......<.......................................p...............................@............0...............................text............................... ..`.rdata..4g...0...h..................@..@.data...4...........................@....rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................................

                                                                                                              C:\Program Files\FastestVPN\is-7EKKK.tmp

                                                                                                              Download File
                                                                                                              Process:C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmp
                                                                                                              File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                              Category:dropped
                                                                                                              Size (bytes):25768
                                                                                                              Entropy (8bit):6.8288213942048985
                                                                                                              Encrypted:false
                                                                                                              SSDEEP:
                                                                                                              MD5:37E6E1D07988932C4360D74A34B27AE9
                                                                                                              SHA1:F53AE2462ECC565EFCC28D1C5BB2C285BF899798
                                                                                                              SHA-256:7E321840FA4F112D0F117D8F4E4DDCA274829693CD1C1189CE1061B6F67550FF
                                                                                                              SHA-512:EFB94F19A885D20BF602AFE84CDD4FE5E9CE89B3A5B7D0BD5273546A6B5D894AD6F1359545DC6B2EEDE06FCB06790286CB69EFB153F249D7D8EF0C677C5D1B3A
                                                                                                              Malicious:false
                                                                                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......4.a.pi.Hpi.Hpi.H68.Hri.H68.H|i.H68.Hri.H68.Hti.H...Hqi.H...Hyi.Hpi.HFi.H};.Hsi.H};.Hqi.H};.Hqi.H};.Hqi.HRichpi.H........PE..L....q.Z...........!.................$.......0...............................p............@..........................7......D:.......P...............:...*...`..x...................................p4..@............0...............................text............................... ..`.rdata.......0......."..............@..@.data...\....@.......2..............@....rsrc........P.......4..............@..@.reloc..x....`.......6..............@..B................................................................................................................................................................................................................................................................................................................

                                                                                                              C:\Program Files\FastestVPN\is-9DEC1.tmp

                                                                                                              Download File
                                                                                                              Process:C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmp
                                                                                                              File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                              Category:dropped
                                                                                                              Size (bytes):25984
                                                                                                              Entropy (8bit):6.291520154015514
                                                                                                              Encrypted:false
                                                                                                              SSDEEP:
                                                                                                              MD5:E1E9D7D46E5CD9525C5927DC98D9ECC7
                                                                                                              SHA1:2242627282F9E07E37B274EA36FAC2D3CD9C9110
                                                                                                              SHA-256:4F81FFD0DC7204DB75AFC35EA4291769B07C440592F28894260EEA76626A23C6
                                                                                                              SHA-512:DA7AB8C0100E7D074F0E680B28D241940733860DFBDC5B8C78428B76E807F27E44D1C5EC95EE80C0B5098E8C5D5DA4D48BCE86800164F9734A05035220C3FF11
                                                                                                              Malicious:false
                                                                                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....jM^.........." ..0..8...........V... ...`....... ....................................@..................................V..O....`...............B...#..........PU............................................... ............... ..H............text....6... ...8.................. ..`.rsrc........`.......:..............@..@.reloc...............@..............@..B.................V......H........0...$...................T........................................(....*..(....z..(....z2.(....s....*2.(....s....*:........o....*.~....*~.-..(......}......}......}....*~.-..(......}......}......}....*Z..}......}......}....*J.{....%-.&.*o....*^.u....,........(....*.*~.{.....{....3..{.....{......*.*&...(....*2...(.......*....0..'........{......,..u....%-.&..(...+(....*(....*n.{....,..(....s....*.q....*..0..a.........{....o0.....,;..{....o2...(......;...3.~.......s......

                                                                                                              C:\Program Files\FastestVPN\is-9RDU4.tmp

                                                                                                              Download File
                                                                                                              Process:C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmp
                                                                                                              File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                                                                                                              Category:dropped
                                                                                                              Size (bytes):432
                                                                                                              Entropy (8bit):5.0141792226861375
                                                                                                              Encrypted:false
                                                                                                              SSDEEP:
                                                                                                              MD5:8F6EB9E75E6A6F0C0D58FB697C10CEDF
                                                                                                              SHA1:6944935DFDC33E0C6DB26869BF25EDA85A2622D8
                                                                                                              SHA-256:E2B8677434501735FB0233ED0CC2FFEE5BF6FB4387C51DBCB2585A70E42E4F08
                                                                                                              SHA-512:A946252B2E3705EAE751A2672D4ADE1499ECEB28C48B4BE6150C4201EE20A7B9A4450C75E06B07F5DAA3528041A566931D988FBD0C2EA90240D61008895BA44A
                                                                                                              Malicious:false
                                                                                                              Preview:.<?xml version="1.0" encoding="utf-8"?>..<configuration>.. <runtime>.. <assemblyBinding xmlns="urn:schemas-microsoft-com:asm.v1">.. <dependentAssembly>.. <assemblyIdentity name="Newtonsoft.Json" publicKeyToken="30ad4fe6b2a6aeed" culture="neutral" />.. <bindingRedirect oldVersion="0.0.0.0-13.0.0.0" newVersion="13.0.0.0" />.. </dependentAssembly>.. </assemblyBinding>.. </runtime>..</configuration>

                                                                                                              C:\Program Files\FastestVPN\is-AASMC.tmp

                                                                                                              Download File
                                                                                                              Process:C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmp
                                                                                                              File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                              Category:dropped
                                                                                                              Size (bytes):53416
                                                                                                              Entropy (8bit):6.326182355914875
                                                                                                              Encrypted:false
                                                                                                              SSDEEP:
                                                                                                              MD5:C4BC370961A9E628E64B8FF4586D4DA6
                                                                                                              SHA1:B391F6A1A54B693F14BA7E8CD58DD8976CDDC992
                                                                                                              SHA-256:097B7F6F9ED8B63F0E725DE28D6842F6AC93D8105E441C7498385FAAD243A8C1
                                                                                                              SHA-512:169FD48C453BC95D33137BDAA22225B483CF9BF73CBCE9AFB5B6BF63B62300CC98A968F1D825348CDB8C786232B66D62247659FD809B6B0D7BCBF26C7B4519A4
                                                                                                              Malicious:false
                                                                                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L................." ..0.................. ........... ....................................@.................................J...O.......$................*..........h...T............................................ ............... ..H............text........ ...................... ..`.rsrc...$...........................@..@.reloc..............................@..B................~.......H........H..Hq...........................................................{....*..{....*V.(......}......}....*...0..A........u........4.,/(.....{.....{....o....,.(.....{.....{....o....*.*.*. ...' )UU.Z(.....{....o....X )UU.Z(.....{....o....X*...0..b........r...p......%..{.......%q.........-.&.+.......o ....%..{.......%q.........-.&.+.......o ....(!...*...0..2..........(....~.......o"...-.~.....s#...%.o$.....o%...&*...0..A..........(....~.......o"...,)..o&..., .o'...-.~.....o(

                                                                                                              C:\Program Files\FastestVPN\is-AC86P.tmp

                                                                                                              Download File
                                                                                                              Process:C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmp
                                                                                                              File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                              Category:dropped
                                                                                                              Size (bytes):75432
                                                                                                              Entropy (8bit):6.020201057914009
                                                                                                              Encrypted:false
                                                                                                              SSDEEP:
                                                                                                              MD5:8DC8D595216B1D7703575B77282F7147
                                                                                                              SHA1:5FBA510AB9D9677B5AF28757BFCFC3E6EE3228F5
                                                                                                              SHA-256:7A8833790323071279C55854F35A1A802BF5D5766CABCFA381889460F95D5864
                                                                                                              SHA-512:F1E79E49CF5F10C9BC88D2AAA078FABD772027360A8C9692334AC3BBCDFEEDD93C2C6234F4DE6C6B4AFBD443FD6315633FE8943229EE0CB8CA6A6F29C2AE97EE
                                                                                                              Malicious:false
                                                                                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...e.Z..........." ..0.............".... ... ....... .......................`......E.....`.....................................O.... ...................*...@..........T............................................ ............... ..H............text...(.... ...................... ..`.rsrc........ ......................@..@.reloc.......@......................@..B........................H.......pG...................... .......................................6.......(....*.~....*F~J......o.......*N........s....o...+*..0............(........~......o2...*.0............(........~K.....o....*.0..%.........(..........(........~L.......o....*....0..H.........(..........(........~M....o.............(....(.........{........o....*2~$....o....*2~#....o....*2~H....oz...*6~I.....o~...*:~J......o....*2~%....o....*2~&....o....*>.(.......o....*...0..N........,........s.....

                                                                                                              C:\Program Files\FastestVPN\is-ALQ73.tmp

                                                                                                              Download File
                                                                                                              Process:C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmp
                                                                                                              File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                              Category:dropped
                                                                                                              Size (bytes):3316968
                                                                                                              Entropy (8bit):6.532906510598102
                                                                                                              Encrypted:false
                                                                                                              SSDEEP:
                                                                                                              MD5:0CF454B6ED4D9E46BC40306421E4B800
                                                                                                              SHA1:9611AA929D35CBD86B87E40B628F60D5177D2411
                                                                                                              SHA-256:E51721DC0647F4838B1ABC592BD95FD8CB924716E8A64F83D4B947821FA1FA42
                                                                                                              SHA-512:85262F1BC67A89911640F59A759B476B30CA644BD1A1D9CD3213CC8AAE16D7CC6EA689815F19B146DB1D26F7A75772CEB48E71E27940E3686A83EB2CF7E46048
                                                                                                              Malicious:false
                                                                                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....R............" ..0..r2..........&1.. ....2...... ........................2.....6Q3...@.................................G&1.O.....2..............|2.. ....2.....X.(.p............................................ ............... ..H............text....p2.. ...r2................. ..`.rsrc.........2......t2.............@..@.reloc........2......z2.............@..B................{&1.....H...........$....................(.....................................V!........s.........*.~....-*(....o....o....o.........~....-.~.........~....*..( ...*...0..G.......(!....o"....s.1....s*,..%..(.... ....o.....o 0...Zo....t....o8(..(....*..0..$..........(.....(....o.....(!.......io#...*z...(....(!....o"...o....(....*..0............T....r...p.(O....o$....(....*..0..I.......sG...sB)..s.(..s.(...(....s6(....,..o%....2...(....sV(....+.....%..ox...*..( ...*V.(&.....}......}..

                                                                                                              C:\Program Files\FastestVPN\is-C2OV1.tmp

                                                                                                              Download File
                                                                                                              Process:C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmp
                                                                                                              File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                              Category:dropped
                                                                                                              Size (bytes):711952
                                                                                                              Entropy (8bit):5.967185619483575
                                                                                                              Encrypted:false
                                                                                                              SSDEEP:
                                                                                                              MD5:195FFB7167DB3219B217C4FD439EEDD6
                                                                                                              SHA1:1E76E6099570EDE620B76ED47CF8D03A936D49F8
                                                                                                              SHA-256:E1E27AF7B07EEEDF5CE71A9255F0422816A6FC5849A483C6714E1B472044FA9D
                                                                                                              SHA-512:56EB7F070929B239642DAB729537DDE2C2287BDB852AD9E80B5358C74B14BC2B2DDED910D0E3B6304EA27EB587E5F19DB0A92E1CBAE6A70FB20B4EF05057E4AC
                                                                                                              Malicious:false
                                                                                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...p$?..........." ..0.............B.... ........... ....................... ............`....................................O......................../.......... ...T............................................ ............... ..H............text........ ...................... ..`.rsrc...............................@..@.reloc..............................@..B................$.......H.......x...(9............................................................(....*..(....*^.(...........%...}....*:.(......}....*:.(......}....*..(....*:.(......}....*..{....*..(....*..(....*:.(......}....*..{....*.(.........*....}.....(......{.....X.....}....*..0...........-.~....*.~....X....b...aX...X...X..+....b....aX....X.....2.....cY.....cY....cY..|....(......._..{........+,..{|....3...{{......(....,...{{...*..{}.......-..*...0...........-.r...ps....z.o......-.~....*.~....

                                                                                                              C:\Program Files\FastestVPN\is-CVBBG.tmp

                                                                                                              Download File
                                                                                                              Process:C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmp
                                                                                                              File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                              Category:dropped
                                                                                                              Size (bytes):117928
                                                                                                              Entropy (8bit):6.160360774488817
                                                                                                              Encrypted:false
                                                                                                              SSDEEP:
                                                                                                              MD5:FDFDFE021B53B630939D27C6C90CB435
                                                                                                              SHA1:AA0987A6EA6987BB9930B9167EC31C249EF9D885
                                                                                                              SHA-256:D753A7EF62BABC2ADB5D1DBEB0BEBAA2B042CC01CC219726F32F761BBB0A711D
                                                                                                              SHA-512:1FD0C74D0ED3AC4DF26D3E95C0F133E8024D77D1FD06E0C76C630D6AAC7B81124AA1DCA7CFFAC43BC34252A057414F8C3F8EC63A805323B1EF892B5F6A277D3B
                                                                                                              Malicious:false
                                                                                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....8............" ..0................. ........... ..............................U.....`.................................w...O........................*..............T............................................ ............... ..H............text....... ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................H.........................................................................{ ...*..{!...*V.(".....} .....}!...*...0..A........u........4.,/(#....{ ....{ ...o$...,.(%....{!....{!...o&...*.*.*. '.(k )UU.Z(#....{ ...o'...X )UU.Z(%....{!...o(...X*...0..b........r...p......%..{ ......%q.........-.&.+.......o)....%..{!......%q.........-.&.+.......o)....(*...*>..su...%.}^...*...0...........(+...,..*...(....o.....8t....o......-2.{,....{-.....g...%..".o.....(/...s0...sk....88....{,...r

                                                                                                              C:\Program Files\FastestVPN\is-DQ4HF.tmp

                                                                                                              Download File
                                                                                                              Process:C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmp
                                                                                                              File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                              Category:dropped
                                                                                                              Size (bytes):18088
                                                                                                              Entropy (8bit):6.784018634948529
                                                                                                              Encrypted:false
                                                                                                              SSDEEP:
                                                                                                              MD5:CD6CB12E677F6C45BBFE57DED6C90567
                                                                                                              SHA1:C13525F597974BA46B4B2A71F270B1056332F77B
                                                                                                              SHA-256:FA0E1B932B5548F39795B9C24106B48D6221600EA7679D6A1D1DEEED1C8D7D8C
                                                                                                              SHA-512:6D9DC73035F3C053281C9347131C8EF232797507F28271B60428FCA4A82CC43689BF1FA3E6DCE46AE92BC3C0E924745F81E315D2E4D4BD2F5D7991DC78A58FBD
                                                                                                              Malicious:false
                                                                                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...X4y..........." ..0.............n3... ...@....... ....................................`..................................3..O....@..H................*...`.......2..8............................................ ............... ..H............text...t.... ...................... ..`.rsrc...H....@......................@..@.reloc.......`......................@..B................N3......H........#................................................................{....*"..}....*..{....*"..}....*..{....*"..}....*..(........%-.&r...ps....z(.......(.....*.0..................,..rM..ps....z.(.........,...(....o.......(.......(.....s....o.........(....(......(....o......(....o........&..(.....r...ps....o........*..........tu.......0..B..........(....%-.&+.o.......*&..(.....(....%-.&.+.(......s....o........*.............*.....0..B..........(....%-.&+.o ......*&..(.....

                                                                                                              C:\Program Files\FastestVPN\is-E3G7B.tmp

                                                                                                              Download File
                                                                                                              Process:C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmp
                                                                                                              File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                              Category:dropped
                                                                                                              Size (bytes):22184
                                                                                                              Entropy (8bit):6.685941492131545
                                                                                                              Encrypted:false
                                                                                                              SSDEEP:
                                                                                                              MD5:AAA9DA932D572F5B22CBEE1B4E479ED6
                                                                                                              SHA1:D708727DED1298610C2E3D72C8792F12FC60CFF2
                                                                                                              SHA-256:73B55714DB609A1712FD4FC420CE18441E41BB7E3E94D73B11AE28C68CCB1124
                                                                                                              SHA-512:40A8E2CB18FB2D68F0945B6FBF259FA9331327116A6D21A85AAE6AA12600F7FDD3737B5E84E0AE04C584442016882926D9201E16C25EB937838C8BAC24358779
                                                                                                              Malicious:false
                                                                                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...z............." ..0.."...........A... ...`....... ...............................6....`..................................A..O....`..`............,...*...........@..T............................................ ............... ..H............text...."... ...".................. ..`.rsrc...`....`.......$..............@..@.reloc...............*..............@..B.................A......H........'.......................@.......................................(....*..0...............(....o........(....s....*...0............(.......(....s....(....*6r...p..(....*.0.._.......s!.....s....}.....{....r...p.r'..p(....o.........."...s....(....%~....(....,..{....o....s....z*..0..#.......(......-...(....*..3...(....*s....z...(....%~....(....,.r=..p.r'..p(....s....z*..0..#.......(......-..(....&*..3..(....&*s....z..0..7..........~....%-.&~..........s....%.....(.........

                                                                                                              C:\Program Files\FastestVPN\is-EES9I.tmp

                                                                                                              Download File
                                                                                                              Process:C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmp
                                                                                                              File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                              Category:dropped
                                                                                                              Size (bytes):60584
                                                                                                              Entropy (8bit):6.4260026936119194
                                                                                                              Encrypted:false
                                                                                                              SSDEEP:
                                                                                                              MD5:550D6E67BB1795B941E91840508BF7F6
                                                                                                              SHA1:46E22693BDC92F4E8DD8C4C5433D233438A271EF
                                                                                                              SHA-256:D4B4CEB77A3D429EE21412E5172AAC6E36C553E7D990137F212E5ADD6B9A9336
                                                                                                              SHA-512:1271BEC8A700AC925B9AC13FDB84FFCCFFA6A1589FA3F9FA1361282C47BB8985A7C8F0335EFDD422E2A708BF2DD46458AEF64B4E2A54B8488F8ED53750337A23
                                                                                                              Malicious:false
                                                                                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L................." ..0.............r.... ........... ....................... ............`................................. ...O........................*..............8............................................ ............... ..H............text...x.... ...................... ..`.rsrc...............................@..@.reloc..............................@..B................T.......H.......T0..4.............................................................{....*"..}....*..{....*"..}....*..{....*"..}....*..{....*"..}....*..{....*"..}....*..{....*"..}....*>.(....o4......*>.(....o4......*>.(....o2......*>.(....o2......*>.(....o2......*v.(....-..(....,..(....+..+..*..{....*"..}....*6..s....}....*..0............(......,...(k.....*....0..4.......s......(....}......}......}......}.....|......(...+*.0..Y.........(....o....r...p(....(c....(f....(g.....(......,&.

                                                                                                              C:\Program Files\FastestVPN\is-EFE8N.tmp

                                                                                                              Download File
                                                                                                              Process:C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmp
                                                                                                              File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                              Category:dropped
                                                                                                              Size (bytes):143528
                                                                                                              Entropy (8bit):6.164743567434074
                                                                                                              Encrypted:false
                                                                                                              SSDEEP:
                                                                                                              MD5:24DF113016A58EB1D14691CFE947C2C8
                                                                                                              SHA1:E32B2388C9BCB8BD3EEA1A87626B562A06F5E2F9
                                                                                                              SHA-256:4DE9980CF1D3B45FC14F69EA4DFF6F456389C5E817344D44D6FA7C1A3276AFB5
                                                                                                              SHA-512:10DD82391CF51885533A5F9F859D7E79A9016F6E6A24C0A04C9BE08EA4C5A951D73AF467EC89BAB191DAC4B37D51B0C0AB247A24CD05478AD6101A44E9FC0D48
                                                                                                              Malicious:false
                                                                                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...U..\.........." ..0.............b.... ... ....... .......................`......q[....@.....................................O.... ..8................*...@..........8............................................ ............... ..H............text...8.... ...................... ..`.rsrc...8.... ......................@..@.reloc.......@......................@..B................C.......H........,..L...........,.................................................((...*>..}......}....*..{....*..{....*..{.....{....3..{.....{....()...*.*..0...........%.u....,..........(....*.*z.{....%-.&.+.o*....{....(a...*..(....zN........o+...s,...*.(....z.s-...*..(....zF(U....(O...s....*.(....z.(V...s....*.(....z.s/...*.(....z.s0...*..(....zN........o+...s1...*.(....zrr...p(\....c.M...(O...s2...*.(....zBr...p(Y...s2...*.(....z.s3...*.(....z.(X...s4...*.(!...z.(_...s4...*.(#...z

                                                                                                              C:\Program Files\FastestVPN\is-F69J1.tmp

                                                                                                              Download File
                                                                                                              Process:C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmp
                                                                                                              File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                              Category:dropped
                                                                                                              Size (bytes):48256
                                                                                                              Entropy (8bit):6.234996524588368
                                                                                                              Encrypted:false
                                                                                                              SSDEEP:
                                                                                                              MD5:37EB7CCE6E282D3572D64C880E1AC3C8
                                                                                                              SHA1:9A2952589A19D650932E7C633577EB9AFC04F959
                                                                                                              SHA-256:039155F155C5D14F5B73F4EE2CD1FBD9290F391B88A1D2A0BA815569205EDB74
                                                                                                              SHA-512:E3C2EF1CC52E3AA5BD77B74DEC93A4FC9E908DF823426F13CA304265D41605DE51970CC8C7E18C2E76319D3225707B2EA2D8613402A25C4FBD3951E70FCFD521
                                                                                                              Malicious:false
                                                                                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....v..........." ..0.................. ........... ....................................`.....................................O........................(..............T............................................ ............... ..H............text........ ...................... ..`.rsrc...............................@..@.reloc..............................@..B.......................H........=..da..........0.................................................(....*..(....*^.(.......>...%...}....*:.(......}....*:.(......}....*:.(......}....*:.(......}....**.-..(....*..s....z.~....*...0..........(....,..*..(.....o.......&...*...................0...........(.......(....-..,..*.*.(....,.r...p......%...%...(....*..( ...*.(....,.r...p......%...%...%...(....*...(!...*.(....,!r...p......%...%...%...%...(....*....("...*..,&(....,..r...pr...p.(....(#...*..($...*.*.(.

                                                                                                              C:\Program Files\FastestVPN\is-G45GB.tmp

                                                                                                              Download File
                                                                                                              Process:C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmp
                                                                                                              File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                              Category:dropped
                                                                                                              Size (bytes):70824
                                                                                                              Entropy (8bit):6.23750269831583
                                                                                                              Encrypted:false
                                                                                                              SSDEEP:
                                                                                                              MD5:0F7D6DEE75C3FBB958529AB6A351CBDF
                                                                                                              SHA1:1CA639AB692ECD972C51C8BF826BF9BF089359FE
                                                                                                              SHA-256:C5B07CBACD0FF045485A0A4CE6FB3CCB330A0623E3EFE347D61DA4E698FDE412
                                                                                                              SHA-512:58F0B5ED44E3290D6C9FB0E624F2A351CD5BB4744A84AC55AC47FB1B087026DE4DBAA6BBC83255EEC51A2BB3ED9A680EF53E8FC7035586B4A74CA68016AE0F5D
                                                                                                              Malicious:false
                                                                                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.... F..........." ..0.............J.... ... ....... .......................`...........`.....................................O.... ...................*...@......D...8............................................ ............... ..H............text...P.... ...................... ..`.rsrc........ ......................@..@.reloc.......@......................@..B................,.......H.......0<................................................................("...*^.("......I...%...}....*:.(".....}....*b.{....%-.&*..s#...o$...*.0..)........{.........(%...t......|......(...+...3.*....0..)........{.........('...t......|......(...+...3.*..((...*..{....*"..}....*..{....*"..}....*..{....*"..}....*2.(....s)...*..{....*"..}....*..{....*"..}....*..{....*"..}....*..((...*..{....*"..}....*..{....*"..}....*..{....*"..}....*..{....*"..}....*..((...*..{....*"..}....*..{

                                                                                                              C:\Program Files\FastestVPN\is-GVJ6C.tmp

                                                                                                              Download File
                                                                                                              Process:C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmp
                                                                                                              File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                                                                                                              Category:dropped
                                                                                                              Size (bytes):432
                                                                                                              Entropy (8bit):5.0141792226861375
                                                                                                              Encrypted:false
                                                                                                              SSDEEP:
                                                                                                              MD5:8F6EB9E75E6A6F0C0D58FB697C10CEDF
                                                                                                              SHA1:6944935DFDC33E0C6DB26869BF25EDA85A2622D8
                                                                                                              SHA-256:E2B8677434501735FB0233ED0CC2FFEE5BF6FB4387C51DBCB2585A70E42E4F08
                                                                                                              SHA-512:A946252B2E3705EAE751A2672D4ADE1499ECEB28C48B4BE6150C4201EE20A7B9A4450C75E06B07F5DAA3528041A566931D988FBD0C2EA90240D61008895BA44A
                                                                                                              Malicious:false
                                                                                                              Preview:.<?xml version="1.0" encoding="utf-8"?>..<configuration>.. <runtime>.. <assemblyBinding xmlns="urn:schemas-microsoft-com:asm.v1">.. <dependentAssembly>.. <assemblyIdentity name="Newtonsoft.Json" publicKeyToken="30ad4fe6b2a6aeed" culture="neutral" />.. <bindingRedirect oldVersion="0.0.0.0-13.0.0.0" newVersion="13.0.0.0" />.. </dependentAssembly>.. </assemblyBinding>.. </runtime>..</configuration>

                                                                                                              C:\Program Files\FastestVPN\is-HB5NQ.tmp

                                                                                                              Download File
                                                                                                              Process:C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmp
                                                                                                              File Type:MS Windows icon resource - 3 icons, 16x16, 32 bits/pixel, 32x32, 32 bits/pixel
                                                                                                              Category:dropped
                                                                                                              Size (bytes):15086
                                                                                                              Entropy (8bit):3.1108966039740653
                                                                                                              Encrypted:false
                                                                                                              SSDEEP:
                                                                                                              MD5:BC1059DA39659B80A09C994AE6DB5DB7
                                                                                                              SHA1:D7E9D74133C98F897B94C42F09B93F10E3274EDB
                                                                                                              SHA-256:9543C96124919AE5B672FD7C23CCF5946A37FBB83A174112A33DA9FF37449B43
                                                                                                              SHA-512:F88CD2EC86E52EF31C471E580A9733D7DAAA7E3062C7DBCAAF9E50308934A4B679B364A4C1372D9021D9F5A504D5C310B8F631799AFA3248878B4F55A6CB704B
                                                                                                              Malicious:false
                                                                                                              Preview:............ .h...6... .... .........00.... ..%..F...(....... ..... .....@...................................2..A!...........................................................3..#.... ..-...................................................................m....................................................`.............. ................................................... ..]...............G........................................................ ...!...&...,{..........................7...................!...!... ... ......U....................U...+.../...,...'.......................,..7....................4..7(...)...-...4...@...>...2...........N.......................*..M&...*.......0...7...Y...j...r...?..i............................(..M...............................................................`...!..}..............._................................................0..!"..............5.......................................................I......................................

                                                                                                              C:\Program Files\FastestVPN\is-HOPCL.tmp

                                                                                                              Download File
                                                                                                              Process:C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmp
                                                                                                              File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                                                                                                              Category:dropped
                                                                                                              Size (bytes):432
                                                                                                              Entropy (8bit):5.0141792226861375
                                                                                                              Encrypted:false
                                                                                                              SSDEEP:
                                                                                                              MD5:8F6EB9E75E6A6F0C0D58FB697C10CEDF
                                                                                                              SHA1:6944935DFDC33E0C6DB26869BF25EDA85A2622D8
                                                                                                              SHA-256:E2B8677434501735FB0233ED0CC2FFEE5BF6FB4387C51DBCB2585A70E42E4F08
                                                                                                              SHA-512:A946252B2E3705EAE751A2672D4ADE1499ECEB28C48B4BE6150C4201EE20A7B9A4450C75E06B07F5DAA3528041A566931D988FBD0C2EA90240D61008895BA44A
                                                                                                              Malicious:false
                                                                                                              Preview:.<?xml version="1.0" encoding="utf-8"?>..<configuration>.. <runtime>.. <assemblyBinding xmlns="urn:schemas-microsoft-com:asm.v1">.. <dependentAssembly>.. <assemblyIdentity name="Newtonsoft.Json" publicKeyToken="30ad4fe6b2a6aeed" culture="neutral" />.. <bindingRedirect oldVersion="0.0.0.0-13.0.0.0" newVersion="13.0.0.0" />.. </dependentAssembly>.. </assemblyBinding>.. </runtime>..</configuration>

                                                                                                              C:\Program Files\FastestVPN\is-IAI1H.tmp

                                                                                                              Download File
                                                                                                              Process:C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmp
                                                                                                              File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                              Category:dropped
                                                                                                              Size (bytes):19624
                                                                                                              Entropy (8bit):6.761472837087098
                                                                                                              Encrypted:false
                                                                                                              SSDEEP:
                                                                                                              MD5:12A69C58D97C26D0132D493111E42345
                                                                                                              SHA1:0DCC8570C7D76B660746A0F657607864F8764AD4
                                                                                                              SHA-256:E6682B67F0C489BEB53C93C399D46CEAEBDD7096AD7DB984BF99DCC68E476F4C
                                                                                                              SHA-512:3335371222BB282C55F1309432CD776CD146EFA9B6D17BF23997EFA6E3A741512FD95B9382EB719F400C6A70BD13E6A445A6011716B4C7637CF1083C8D669BE6
                                                                                                              Malicious:false
                                                                                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L................." ..0..............8... ...@....... ...............................P....`.................................j8..O....@..............."...*...`.......7..8............................................ ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`....... ..............@..B.................8......H.......L'..`............................................................0..?.........(....}.......}.......}.......}......|......(...+..|....(....*..0..7.........(....}.......}.......}......|......(...+..|....(....*..0../.........(....}.......}......|......(...+..|....(....*..0..7.........(....}.......}.......}......|......(...+..|....(....*6..(...+(....*..(....*..(....*..{..........%..#...(.....%..!...(.....(.....(....*.0..e........{......E....8............(....o ......(!...

                                                                                                              C:\Program Files\FastestVPN\is-ILJO4.tmp

                                                                                                              Download File
                                                                                                              Process:C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmp
                                                                                                              File Type:XML 1.0 document, ASCII text, with CRLF line terminators
                                                                                                              Category:dropped
                                                                                                              Size (bytes):1106
                                                                                                              Entropy (8bit):5.038231865445437
                                                                                                              Encrypted:false
                                                                                                              SSDEEP:
                                                                                                              MD5:75E66AB540561A0C7D4160271F518243
                                                                                                              SHA1:AD6501E407D216744B6C3DE76D7664D9581EBAD2
                                                                                                              SHA-256:091AFFF3BB63024B5A7B14EA30306B6753858FD1A33FC8C98E3B5E65FE92FBE7
                                                                                                              SHA-512:FCB55C0FDBB984B06AFF2FAFCAEA2596C175AA5A07D2F1A401305D3441338AA266A53D2DE7A7577684884A2E12CE3EE430B2E1D0210684A7EEFAF9EAA0DE115F
                                                                                                              Malicious:false
                                                                                                              Preview:<?xml version="1.0" encoding="utf-8"?>..<configuration>.... <appSettings>.. <add key="DownloadLocation" value=""/>.. </appSettings>.... <runtime>.... <assemblyBinding xmlns="urn:schemas-microsoft-com:asm.v1">.... <dependentAssembly>.... <assemblyIdentity name="System.Runtime" publicKeyToken="b03f5f7f11d50a3a" culture="neutral"/>.... <bindingRedirect oldVersion="0.0.0.0-4.0.0.0" newVersion="4.0.0.0"/>.... </dependentAssembly>.... <dependentAssembly>.... <assemblyIdentity name="System.Threading.Tasks" publicKeyToken="b03f5f7f11d50a3a" culture="neutral"/>.... <bindingRedirect oldVersion="0.0.0.0-4.0.0.0" newVersion="4.0.0.0"/>.... </dependentAssembly>.... <dependentAssembly>.... <assemblyIdentity name="System.Net.Http" publicKeyToken="b03f5f7f11d50a3a" culture="neutral"/>.... <bindingRedirect oldVersion="0.0.0.0-4.0.0.0" newVersion="4.0.0.0"/>.... </dependentAssembly>.... </assemblyBinding>.... </runtime>

                                                                                                              C:\Program Files\FastestVPN\is-JOA76.tmp

                                                                                                              Download File
                                                                                                              Process:C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmp
                                                                                                              File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                              Category:dropped
                                                                                                              Size (bytes):124072
                                                                                                              Entropy (8bit):6.169344446608534
                                                                                                              Encrypted:false
                                                                                                              SSDEEP:
                                                                                                              MD5:2DC3102392DAEF9B935CDF4939A9B132
                                                                                                              SHA1:F56261CE19BFC14F8317C2AA05F010E9ACFBCE02
                                                                                                              SHA-256:B6D9088505C220F23132D78675004BC31E0FB5C04257357C2B02072EF8C28DAD
                                                                                                              SHA-512:596AFAA1347CF730D2D0312857366EE3AD4C5C439E2F93BD6D38B29129C7B3530523B206FAEEF1DB3F6D9A18482162FF56321C9F1A1FA4F296F6B29AE8659321
                                                                                                              Malicious:false
                                                                                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...q............" ..0.................. ........... ....................... ......Q.....`.....................................O........................*..............8............................................ ............... ..H............text........ ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................H.......d................................................................0...........s....%r...pr...po....%rk..pru..po....%r...pr...po....}......(....(...+o.....(...+o.......o....r!..p.o....(....}......o....}......o....}......o....}.....(....r%..p( ...-..(....re..p( ...,...}....*..}....*..{....*..{....*..{....*..{....*..{....*J.......s!...s:...*.~....%-.&~..........s!...%.....s:...*J.......s"...s#...*J.......s!...s:...*..0..........(...+o$.....E........9...^...*.r...pr...pr..

                                                                                                              C:\Program Files\FastestVPN\is-K0SIQ.tmp

                                                                                                              Download File
                                                                                                              Process:C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmp
                                                                                                              File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                              Category:dropped
                                                                                                              Size (bytes):35496
                                                                                                              Entropy (8bit):6.3704146545353355
                                                                                                              Encrypted:false
                                                                                                              SSDEEP:
                                                                                                              MD5:26592109F19A24EE91F039EBB40038C4
                                                                                                              SHA1:C8846404EFEB44C6CBB242B4C107F7CCE865AD14
                                                                                                              SHA-256:E3F74128991C128410498223D4185915528360AD3DA92CD01BC23B19D8C2C670
                                                                                                              SHA-512:8B031C53F5529D50A80AE2A4803D7C34F9A71A54DA01A912D1DB4D77D9BC1F490AB634A32F2DF6009EB53A2E57CD21975F3E00AF111BFA8320DE550A17509CA1
                                                                                                              Malicious:false
                                                                                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...>............." ..0..X...........v... ........... ...............................S....`..................................v..O....................`...*...........v..8............................................ ............... ..H............text....W... ...X.................. ..`.rsrc................Z..............@..@.reloc...............^..............@..B.................v......H........3...B...........................................................0.................(n...........................s)...}................s%...}................s....}................s....}................s....}................s....} ...............s!...}!...............s....}"...............s....}#...............s=...}$...............s9...}%...............s5...}&...............sA...}'...............sE...}(...............s-...})...............s1...}*........(....(....(....

                                                                                                              C:\Program Files\FastestVPN\is-L0D1P.tmp

                                                                                                              Download File
                                                                                                              Process:C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmp
                                                                                                              File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                              Category:dropped
                                                                                                              Size (bytes):160936
                                                                                                              Entropy (8bit):5.261187861382329
                                                                                                              Encrypted:false
                                                                                                              SSDEEP:
                                                                                                              MD5:F3F2EB62314A960AD5F60B61A8193CBD
                                                                                                              SHA1:FD77AD6D9F96762CD7EE8D17454D9A7490FD8148
                                                                                                              SHA-256:0F74E741958310B8E65E3B2393828998DB075EBF4C5B29045707948C65CB03CC
                                                                                                              SHA-512:A62D09CF93E604AE0282F05842B607216533800F82ABF75E7D0FF1E9DED5F748B9E34D5E38170F1C837A0957D15FC4C6DF101FF2BE48D90C880807D0FB95D3E6
                                                                                                              Malicious:false
                                                                                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...2.Z...........!.........,......n:... ...@....... ....................................@..................................:..S....@..8)...........J...*...........8............................................... ............... ..H............text...t.... ...................... ..`.rsrc...8)...@...*..................@..@.reloc...............H..............@..B................P:......H........#......................P ............................................y.....3....f........UE#.H.NDC..\3,.|7...1...=.w..n.w.P5.y.......p.._Z@B..h..#,._...p...|..qXV..6.......i[..2;.'`..=.;...~....*..0..T.......(..........(....(......r...pr...p(...........s..........,..(......T+...~....(....T.*.~....,.~....o..........~....,.~....(..........*.0..e.......s.......o....s......r5..p.o ....r?..p.o ....rQ..pry..po .....s!........~.....("...s#.....r...p($...&*....0..A.......

                                                                                                              C:\Program Files\FastestVPN\is-L85R1.tmp

                                                                                                              Download File
                                                                                                              Process:C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmp
                                                                                                              File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                                                                                                              Category:dropped
                                                                                                              Size (bytes):1192
                                                                                                              Entropy (8bit):5.059106104983516
                                                                                                              Encrypted:false
                                                                                                              SSDEEP:
                                                                                                              MD5:66373624F8B60F41B8FEC0E61779C0AC
                                                                                                              SHA1:0D3BE3C009F0A2260F89C3FBC9FFEBA0061C17F2
                                                                                                              SHA-256:FE0A5830D875B8BD0864BF4F85705D4F2E3D7A575C07B2B5A18041558DBA1386
                                                                                                              SHA-512:74F084B2697F936122E371042FEF5740BF205914B3FA276F8F7C72561680BF2C39A7DD2970BDEDF36AACC20970CD9552A719211F30090881E498815D91C6CDD0
                                                                                                              Malicious:false
                                                                                                              Preview:.<?xml version="1.0" encoding="utf-8"?>..<configuration>.. <runtime>.. <assemblyBinding xmlns="urn:schemas-microsoft-com:asm.v1">.. <dependentAssembly>.. <assemblyIdentity name="SQLitePCLRaw.core" publicKeyToken="1488e028ca7ab535" culture="neutral" />.. <bindingRedirect oldVersion="0.0.0.0-2.1.6.2060" newVersion="2.1.6.2060" />.. </dependentAssembly>.. <dependentAssembly>.. <assemblyIdentity name="SQLitePCLRaw.batteries_v2" publicKeyToken="8226ea5df37bcae9" culture="neutral" />.. <bindingRedirect oldVersion="0.0.0.0-2.1.6.2060" newVersion="2.1.6.2060" />.. </dependentAssembly>.. <dependentAssembly>.. <assemblyIdentity name="System.Runtime.CompilerServices.Unsafe" publicKeyToken="b03f5f7f11d50a3a" culture="neutral" />.. <bindingRedirect oldVersion="0.0.0.0-6.0.0.0" newVersion="6.0.0.0" />.. </dependentAssembly>.. <dependentAssembly>.. <assemblyIdentity name="System.Memory" publicKeyToken="cc7b13ffc

                                                                                                              C:\Program Files\FastestVPN\is-LGHQU.tmp

                                                                                                              Download File
                                                                                                              Process:C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmp
                                                                                                              File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                              Category:dropped
                                                                                                              Size (bytes):108200
                                                                                                              Entropy (8bit):7.332504567097915
                                                                                                              Encrypted:false
                                                                                                              SSDEEP:
                                                                                                              MD5:261A5044C94F318DEEA20D178ED9F36E
                                                                                                              SHA1:2A9704F70A543EE219481A3AA756A0CF151E1999
                                                                                                              SHA-256:D17E9B0C62C224D1BA56E7206D8A44FE382FE99752C511BA211A7725D83FEF43
                                                                                                              SHA-512:E53C320DBF6B2AAEEC01FE5AFF1FAD5A8D75B2483A78BA0E1B510F2A7A8C5C510ACD603541734F4A002748D0781FC11AFBF6967EBCDB41A6FC9A29C828ABC2A3
                                                                                                              Malicious:false
                                                                                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...l.g..........." ..0..p.............. ........... ....................................`.....................................O....................|...*..............p............................................ ............... ..H............text....n... ...p.................. ..`.rsrc................r..............@..@.reloc...............z..............@..B........................H........O..|w..................,.......................................V!.)1......s.........*...0..$........u......,...o....*.u......,...o....*.0..&........u......,....o ...*.u......,....o!...*...0..&........u......,....o"...*.u......,....o#...*B.(Y...-.(....*.*..{!...*"..}!...*>.{....o.......*.0..9........(*.....($.....(......,..o%...-..,..o&...-..,..o%...*.*.*....0...........s'...}.....((....(....-..s....+.(....}......{....o....(....}.....(!....{...........s)...o.....{....

                                                                                                              C:\Program Files\FastestVPN\is-M7G5C.tmp

                                                                                                              Download File
                                                                                                              Process:C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmp
                                                                                                              File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                              Category:dropped
                                                                                                              Size (bytes):61608
                                                                                                              Entropy (8bit):6.287396747644481
                                                                                                              Encrypted:false
                                                                                                              SSDEEP:
                                                                                                              MD5:A760AEACBE049C8C0D5DD66DD9EAA7A0
                                                                                                              SHA1:975896722F2D5A365621EE407ACE3E3294CFC1C3
                                                                                                              SHA-256:C3618538771839CBC6A855E41A1664D5B86313070FC75CA1B58EF74D007DBDE4
                                                                                                              SHA-512:64CF42CF493686A4286320819D10A37CC075088509866E867A341651B7762FFD88750417E3AD72E6FA78908DD17C66363752E5AA2955066BA4930889D36AE3CA
                                                                                                              Malicious:false
                                                                                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....b..........." ..0.................. ........... ....................... .......L....`.....................................O.......0................*..............T............................................ ............... ..H............text........ ...................... ..`.rsrc...0...........................@..@.reloc..............................@..B........................H.......@@..<...........|.................................................(....*..(....*..(....*.......*Z~....,.*.oB...&......*.......*b~....-.r...ps....z~....*.(#...o8...*.0..........(#......o9.....(....Q*6.(.....(%...*.0..........(#........o:.....(....Q*R.(.......(....('...*:(#......o?...*N.(.....(.....()...*2(#....o;...*2(#....o<...*..o....*..o....*2(#....o=...*2(#....o>...*6(#.....o....*...0..........s"......}"....{"...-...+....#...s.......(1...*6(#.....o....*6..(....(3..

                                                                                                              C:\Program Files\FastestVPN\is-MB689.tmp

                                                                                                              Download File
                                                                                                              Process:C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmp
                                                                                                              File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                              Category:dropped
                                                                                                              Size (bytes):31912
                                                                                                              Entropy (8bit):6.377831305172757
                                                                                                              Encrypted:false
                                                                                                              SSDEEP:
                                                                                                              MD5:CE66CBCDA6D3B5047691C4AFF63CFE79
                                                                                                              SHA1:358E3A2284798BE1C537756A41721B61643D2BEE
                                                                                                              SHA-256:B8551ECBE96BB718BAA56E053589A7F16561BFDAB86575441EC5FBE528B32B8C
                                                                                                              SHA-512:7BC26EDD1C018553B163B75250B5862D26B607C26BDBFB6934F0AC5CE20B04D1956EEAF3915CBCE2129CD992ECA6E1B1C311991427D485CB43969A05431270E4
                                                                                                              Malicious:false
                                                                                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...r.C..........." ..0..J..........~h... ........... ..............................wt....`.................................*h..O....................R...*...........g..8............................................ ............... ..H............text....H... ...J.................. ..`.rsrc................L..............@..@.reloc...............P..............@..B................^h......H........1...5............................................................{....*"..}....*..{....*"..}....*..{....*"..}....*..{....*"..}....*&..(.....*...0...........s.......o.....+X..(.........(....o....o....&..(.........,!..r...po....&...(....o....o....&..r...po....&...(....-...........o ......o....o!.....+...*...........et.......0...........s"...%r...p.o#....%r...pr#..po#....%r+..prA..po#....%r]..p.($...o%...o#....%ro..p.($...o&............o....o'...o#....%r...p.($...o(....

                                                                                                              C:\Program Files\FastestVPN\is-MD8VT.tmp

                                                                                                              Download File
                                                                                                              Process:C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmp
                                                                                                              File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                              Category:dropped
                                                                                                              Size (bytes):16768
                                                                                                              Entropy (8bit):6.361391591273708
                                                                                                              Encrypted:false
                                                                                                              SSDEEP:
                                                                                                              MD5:DA04A75DDC22118ED24E0B53E474805A
                                                                                                              SHA1:2D68C648A6A6371B6046E6C3AF09128230E0AD32
                                                                                                              SHA-256:66409F670315AFE8610F17A4D3A1EE52D72B6A46C544CEC97544E8385F90AD74
                                                                                                              SHA-512:26AF01CA25E921465F477A0E1499EDC9E0AC26C23908E5E9B97D3AFD60F3308BFBF2C8CA89EA21878454CD88A1CDDD2F2F0172A6E1E87EF33C56CD7A8D16E9C8
                                                                                                              Malicious:false
                                                                                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....jM^...........!................^2... ...@....@.. ...............................y....@..................................2..S....@...................#...`....................................................... ............... ..H............text...d.... ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B................@2......H........#..@...................P ......................................{.v.`)!.t..@.62C<.=...h....X..}.`v.r...g.e...yXa.dat.mwQ.XdJ...M..`..J...$|.j.6W.U.3.r.A.h.....9Q..|..,<g..gy..6V9o%..Gd.r.0...........q....*..0..............q....*...0..............q....*...0.................*.0....................*..0....................*..0............q.........*....0............q.........*....0............*..0................*..0...............*...0...............*...0..........

                                                                                                              C:\Program Files\FastestVPN\is-MM0UH.tmp

                                                                                                              Download File
                                                                                                              Process:C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmp
                                                                                                              File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                              Category:dropped
                                                                                                              Size (bytes):110760
                                                                                                              Entropy (8bit):5.479763068610726
                                                                                                              Encrypted:false
                                                                                                              SSDEEP:
                                                                                                              MD5:3FC875FFEFAC2BBA64E6F2A6A7CFF45B
                                                                                                              SHA1:CAB48D6D156261CD9612633D70A61DA670D0D093
                                                                                                              SHA-256:5A12A8D3CA02716C616F56342C920422966ABF79B49C4B1E1C7FF36E97764E1B
                                                                                                              SHA-512:DDA0B6F0587D7915B490FFA2225E72374A2AA671E2019ABDC72EB7598B642906CF09302575C5B5B495B832FF434D45BAD0650C0409358E5D1786F4561FAE3636
                                                                                                              Malicious:false
                                                                                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....oY.........." ..0..v..........j.... ........... ....................................@.....................................O........................*..........t................................................ ............... ..H............text...pu... ...v.................. ..`.rsrc................x..............@..@.reloc..............................@..B................K.......H.......,S..0>..........\.................................................(....*&.l(....k*&.l(....k*..l.l(....k*&.l(....k*&.l(....k*&.l(....k*j~....%-.&(....s....%.....*..*.0..$.........(.....o.......&...,....o....,..*.*..................,!(....,..r...p.(....(....*..(....*.*.(....,.r...p......%...%...(....*..(....*.(....,.r...p......%...%...%...(....*...(....*.(....,!r...p......%...%...%...%...(....*....(....*2r...p.(....*2rG..p.(....*2r...p.(....*2r...p.(....*......(....*...

                                                                                                              C:\Program Files\FastestVPN\is-N38EL.tmp

                                                                                                              Download File
                                                                                                              Process:C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmp
                                                                                                              File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                              Category:dropped
                                                                                                              Size (bytes):88192
                                                                                                              Entropy (8bit):6.25584016939133
                                                                                                              Encrypted:false
                                                                                                              SSDEEP:
                                                                                                              MD5:4186A905DC180A0CC2110403727BD792
                                                                                                              SHA1:E0563D20CA7E95688A60F4BFC1AB0127EAE1F651
                                                                                                              SHA-256:40DCB80A87A762745D0A15294B5CA7783A9EAD1D93AD352D25B5EDAF4994651E
                                                                                                              SHA-512:1C3459232B41C531F01BCCE54E46799F2FB3FCD6C87D7F908C633ABCC718D9726D98E65F964B1A870D416A38F545971779054FE65F7C1299905FC7DC24FA2DEC
                                                                                                              Malicious:false
                                                                                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L................." ..0..&..........>E... ...`....... ....................................`..................................D..O....`...............0...(...........C..T............................................ ............... ..H............text...D%... ...&.................. ..`.rsrc........`.......(..............@..@.reloc..............................@..B.................E......H........l..@...........02..0...`C........................................(....*..(....*^.(.......k...%...}....*:.(......}....*:.(......}....*:.(......}....*:.(......}....*.~....*..0..........(....,..*..(.....o ......&...*...................0...........(.......(!...-..,..*.*.(....,.r...p......%...%...("...*..(#...*.(....,.r...p......%...%...%...("...*...($...*.(....,!r...p......%...%...%...%...("...*....(%...*..,&(....,..r...pr...p.("...(&...*..('...*.*.(....,.r...p......%...

                                                                                                              C:\Program Files\FastestVPN\is-NJH6K.tmp

                                                                                                              Download File
                                                                                                              Process:C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmp
                                                                                                              File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                              Category:dropped
                                                                                                              Size (bytes):41128
                                                                                                              Entropy (8bit):6.4006875255426365
                                                                                                              Encrypted:false
                                                                                                              SSDEEP:
                                                                                                              MD5:FDF4712500755002CD0FFD2F7BEA8C2A
                                                                                                              SHA1:372F4D6F2F19A5DF96FCDEF566AE4761F7AFF2B5
                                                                                                              SHA-256:D61A675E7D11A6DDF12E4CEBCABFD7BAAA24B86AD7B751BE19788E7A8A5ABE39
                                                                                                              SHA-512:6484349215D1347FB3D77E6598AF740045AC416EE06370B8D89E91ECBA930E5AFFCE6F4840CE4ECD2214960E1884CCBE49710E5B5C1FEBE0C96F88A099AE2E4E
                                                                                                              Malicious:false
                                                                                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....z:..........." ..0..n..........&.... ........... ....................................`....................................O.......h............v...*..........@...8............................................ ............... ..H............text...,m... ...n.................. ..`.rsrc...h............p..............@..@.reloc...............t..............@..B........................H........6..PU............................................................{....*"..}....*..{....*"..}....*..~....}......s....}.....(........(.............s*...}....*....0..................,5...(A.....(.........,..~.....(.....s....o.......8..............0....B+......8..... . ...G+.. . ..;....8....~.....(.....s....o.....8....~.....(.....s....o.....+s.o.....~.....(....s....o......(....o ...r...p(!.......,...(.......{.....{....o"....(6...&+...(......s#...(.....+.+..*..0..F.......

                                                                                                              C:\Program Files\FastestVPN\is-NTHCN.tmp

                                                                                                              Download File
                                                                                                              Process:C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmp
                                                                                                              File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                              Category:dropped
                                                                                                              Size (bytes):25768
                                                                                                              Entropy (8bit):6.623350319992477
                                                                                                              Encrypted:false
                                                                                                              SSDEEP:
                                                                                                              MD5:D92BF2C8E0A192E18B1F0B24CCB75171
                                                                                                              SHA1:2A6343C3409172E1D426B763151E0CBA3B35E473
                                                                                                              SHA-256:BEED084878EACA4A745A53CC21FAAD1A76F4F82C955BB507496B5B9F23032F1C
                                                                                                              SHA-512:71AD4963BCEBE516FD9EE526F2DD1ECB13F10E1424D0D3CED08A19A38D902DA562C9B1D0E308C4B898E30187773F040CF6A437210EFEF52B957623F798E59459
                                                                                                              Malicious:false
                                                                                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...R.s..........." ..0..2..........:Q... ...`....... ..............................I/....`..................................P..O....`...............:...*..........,P..8............................................ ............... ..H............text...@1... ...2.................. ..`.rsrc........`.......4..............@..@.reloc...............8..............@..B.................Q......H.......`(...'...........................................................0..M........r...p}.....r...p}.....(......{..... (....(....(......{..... (....(....(....*^~....-.s.........~....*..{....*"..}....*..{....*"..}....*..0..8........(........(.....(.....o....r...p(....o.......&..r...p*.*........--.......0..(.......(.....o........(.....(.......&..r...p*.*.................0..X........o.....[.&......+9...Z.o.... ....(........Z.X.o.... ....(......b`.......X...o.....[2..*.0..V...

                                                                                                              C:\Program Files\FastestVPN\is-O9AN2.tmp

                                                                                                              Download File
                                                                                                              Process:C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmp
                                                                                                              File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                              Category:dropped
                                                                                                              Size (bytes):49320
                                                                                                              Entropy (8bit):6.325351798150663
                                                                                                              Encrypted:false
                                                                                                              SSDEEP:
                                                                                                              MD5:C22900453EF4B917460ADEA7DE87225B
                                                                                                              SHA1:6878237656DA68C046FB95FAA8CAF3B4C719851B
                                                                                                              SHA-256:9AF8C8105093B7D62FC578DAE3497FF0AD796C9ABD638EB14269DED4270DFF96
                                                                                                              SHA-512:2E7D0EB99E2924FB375AAF8891968228193C65C133E362F66567C044E8B744ABC3A992EF7606644690D1BB81AD13A64A35D8107BDBDD9D5942BEA1DD1074EA3C
                                                                                                              Malicious:false
                                                                                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L................." ..0................. ........... ....................................`.................................p...O.......,................*..............T............................................ ............... ..H............text....... ...................... ..`.rsrc...,...........................@..@.reloc..............................@..B........................H........L...\............................................................{"...*..{#...*V.($.....}".....}#...*...0..A........u........4.,/(%....{"....{"...o&...,.('....{#....{#...o(...*.*.*. ?Y.. )UU.Z(%....{"...o)...X )UU.Z('....{#...o*...X*...0..b........r...p......%..{"......%q.........-.&.+.......o+....%..{#......%q.........-.&.+.......o+....(,...*..{-...*..{....*V.($.....}-.....}....*.0..A........u........4.,/(%....{-....{-...o&...,.('....{.....{....o(...*.*.*. (... )UU.

                                                                                                              C:\Program Files\FastestVPN\is-OO2G4.tmp

                                                                                                              Download File
                                                                                                              Process:C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmp
                                                                                                              File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                              Category:dropped
                                                                                                              Size (bytes):159368
                                                                                                              Entropy (8bit):6.32384599449582
                                                                                                              Encrypted:false
                                                                                                              SSDEEP:
                                                                                                              MD5:7AE17C855F3CC63174E90EA527B6138B
                                                                                                              SHA1:0FE1E1B2252511F33EDA3FFCF1F8FC8586AB040A
                                                                                                              SHA-256:26FF04208EC4D26EF4DDD9B3CF01C4D2A1544550BCD59EFDE6F30170053A1170
                                                                                                              SHA-512:453BA41332A704F491FC9E1EE5FBE9F883EDDB4C26A71D207C93992726E9C5B7FEDC48EEEE2A2087F64B083F9473EE794FB2C8F3B77C9DBCBBC47B67816BD156
                                                                                                              Malicious:false
                                                                                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........y..............Y.......................................................................Rich....................PE..L.....[...........!.........................................................`..................................................P.... ..`............@.......0..(...0...............................0...@............................................text....w.......................... ..`.rdata...A.......P..................@..@.data....6....... ..................@....rsrc...`.... ......................@..@.reloc..2(...0...0..................@..B................................................................................................................................................................................................................................................................................................................

                                                                                                              C:\Program Files\FastestVPN\is-PQTD6.tmp

                                                                                                              Download File
                                                                                                              Process:C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmp
                                                                                                              File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                                                                                                              Category:dropped
                                                                                                              Size (bytes):1112
                                                                                                              Entropy (8bit):5.030466366630491
                                                                                                              Encrypted:false
                                                                                                              SSDEEP:
                                                                                                              MD5:B94AE93769D64791440B3C36CC82AC69
                                                                                                              SHA1:E4AAAD9A0FB51051C8B25F768BC1563543F132C0
                                                                                                              SHA-256:432BFD182828A531147812566CB3439702A243BB7A4C45CC816192F9CB91D4A5
                                                                                                              SHA-512:AD978C59980C0194357D5070D53EA77C334493D14593C141B9DBEEF835FC688FD90C99236D687F50860FA7F4FD4125650E432A61EDF7917C77E4EE4E5E3D4E66
                                                                                                              Malicious:false
                                                                                                              Preview:.<?xml version="1.0" encoding="utf-8"?>..<configuration>.. <startup> .. <supportedRuntime version="v4.0" sku=".NETFramework,Version=v4.8" />.. </startup>.. <runtime>.. <legacyCorruptedStateExceptionsPolicy enabled="true" />.. <assemblyBinding xmlns="urn:schemas-microsoft-com:asm.v1">.. <dependentAssembly>.. <assemblyIdentity name="Microsoft.Expression.Interactions" publicKeyToken="31bf3856ad364e35" culture="neutral" />.. <bindingRedirect oldVersion="0.0.0.0-4.5.0.0" newVersion="4.5.0.0" />.. </dependentAssembly>.. <dependentAssembly>.. <assemblyIdentity name="System.Windows.Interactivity" publicKeyToken="31bf3856ad364e35" culture="neutral" />.. <bindingRedirect oldVersion="0.0.0.0-4.5.0.0" newVersion="4.5.0.0" />.. </dependentAssembly>.. <dependentAssembly>.. <assemblyIdentity name="Newtonsoft.Json" publicKeyToken="30ad4fe6b2a6aeed" culture="neutral" />.. <bindingRedirect oldVersion="0.0.0.0-13.0.0

                                                                                                              C:\Program Files\FastestVPN\is-Q0KU7.tmp

                                                                                                              Download File
                                                                                                              Process:C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmp
                                                                                                              File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                              Category:dropped
                                                                                                              Size (bytes):53624
                                                                                                              Entropy (8bit):6.18841715621451
                                                                                                              Encrypted:false
                                                                                                              SSDEEP:
                                                                                                              MD5:B7ABAF6A90E95E585E71C0C22D90AF73
                                                                                                              SHA1:C9756883D1738A9931D0BF58D6F69CBB8DFD5870
                                                                                                              SHA-256:3BA247FDCC6953B5CC672A361983B7B0AF3051A83128970BCEBAB22036D1E859
                                                                                                              SHA-512:3A67EF230A06FAE3095926EAD9AAF329009BC0F2ED6AA1E6683C426ADA29DDD9CB77EC3BE134DFC4CD10A1F675D518FB4986363C4FE649D4247770B96DBC7A56
                                                                                                              Malicious:false
                                                                                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....#2..........." ..0.................. ........... ...............................0....`.....................................O.......................x'..........t...T............................................ ............... ..H............text........ ...................... ..`.rsrc...............................@..@.reloc..............................@..B.......................H........E...w..........................................................&...(....*2.r...p(....*V.(......}......}....*..{....*..{....*..{....*..(......}......}......}.......}.......}....*..{....*..{....*..{....*..{....*..{....*...0..'.......~.........(....t............(...+...3.*..0..'.......~.........(....t............(...+...3.*..0..'.......~.........(....t............(...+...3.*..0..'.......~.........(....t............(...+...3.*..0..'.......~.........(....t............(...

                                                                                                              C:\Program Files\FastestVPN\is-Q6C5B.tmp

                                                                                                              Download File
                                                                                                              Process:C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmp
                                                                                                              File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                              Category:dropped
                                                                                                              Size (bytes):19112
                                                                                                              Entropy (8bit):6.821071301483957
                                                                                                              Encrypted:false
                                                                                                              SSDEEP:
                                                                                                              MD5:64E2269D156CA2AA5704E2E0908506F9
                                                                                                              SHA1:0F7D6EECE52D8A9A91E389736BE1092739AA3014
                                                                                                              SHA-256:B012720952E3FE9CB303E9EDB4314F924CB388D9C24FB63A968A3479113B665D
                                                                                                              SHA-512:C845E7EB96ED29C564C28D42F07F5EB81C27568F0F89C343533384BF8E704B99566EA073E46259D9F3740A7A3D41AAB5BFA78AEAB05697100B3A179F5C1EDFB6
                                                                                                              Malicious:false
                                                                                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....c............" ..0..............6... ...@....... ..............................hj....`.................................16..O....@............... ...*...`......t5..8............................................ ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B................e6......H.......("..L............................................................~....*.......*..s....*..s....*..0..B.......(....,.*s....(....(....(....(....(....(.....(....(....(.....(....*..(...+*F.(...+(...+(...+*F.(...+(...+(...+*F.(...+(...+(...+*.0..f........(...+(...+(...+(...+(...+(...+(...+(...+(...+(...+(...+(...+(...+(...+(...+(...+(...+(...+(...+(...+*..(...+*...0...........-..*....8.......%o.....%o.....o........E........ ...>...+X..(....-...(....+....(......+:..(....-...

                                                                                                              C:\Program Files\FastestVPN\is-Q7N7F.tmp

                                                                                                              Download File
                                                                                                              Process:C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmp
                                                                                                              File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                              Category:dropped
                                                                                                              Size (bytes):147848
                                                                                                              Entropy (8bit):6.032707503792338
                                                                                                              Encrypted:false
                                                                                                              SSDEEP:
                                                                                                              MD5:B6DB385295FA78A6AABCF217FD3C3F83
                                                                                                              SHA1:71E2A93223A6B8204EED6B9834284C0FA1D7EBD0
                                                                                                              SHA-256:ABF40F07643E6D29D0817021991F9D27410B7DCAEF80980D849634ACEF255BDC
                                                                                                              SHA-512:122FDB77C0AC6A7A2ECF5519BB059097EF119390E6D3C34F9FAB303D60279EE8649175617E3B6FC2A3D118B422CE8BC1BFFC208332D0A9F012271325AC0A0EE7
                                                                                                              Malicious:false
                                                                                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....@..........." ..0..............1... ...@....... ..............................0b....`.................................71..O....@...................'...`.......0..T............................................ ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B................k1......H.......8...d].................../.......................................0..s........r...p(......(....,.r...psK...z.rW..po....-.r[..pro..p(X....*s.....~.....o....o......+8..o....t.........o.....o ...o!.....o.....o ...o!...o".....o#...-.....u........,...o$.....r...po%...,.r[..pr...p(X....*.rS..po%...,.r[..prg..p(X....*~&....~&......o%...,.....o'...&..o%...,.....o'...&.(....,..(....,.r...p.r...p((...sK...z.(....-&.(....-.r...p.r%..p((.....r)..p.((.....*.......U.E........(....*.

                                                                                                              C:\Program Files\FastestVPN\is-RP1DP.tmp

                                                                                                              Download File
                                                                                                              Process:C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmp
                                                                                                              File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                              Category:dropped
                                                                                                              Size (bytes):26752
                                                                                                              Entropy (8bit):6.512503595653532
                                                                                                              Encrypted:false
                                                                                                              SSDEEP:
                                                                                                              MD5:970B6E6478AE3AB699F277D77DE0CD19
                                                                                                              SHA1:5475CB28998D419B4714343FFA9511FF46322AC2
                                                                                                              SHA-256:5DC372A10F345B1F00EC6A8FA1A2CE569F7E5D63E4F1F8631BE367E46BFA34F4
                                                                                                              SHA-512:F3AD2088C5D3FCB770C6D8212650EED95507E107A34F9468CA9DB99DEFD8838443A95E0B59A5A6CB65A18EBBC529110C5348513A321B44223F537096C6D7D6E0
                                                                                                              Malicious:false
                                                                                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...$:............" ..0..4...........S... ...`....... ....................................`..................................S..O....`...............@...(...........R..T............................................ ............... ..H............text....3... ...4.................. ..`.rsrc........`.......6..............@..@.reloc...............>..............@..B.................S......H........'..P*..................,R........................................(....*..(....*^.(.......1...%...}....*:.(......}....*:.(......}....*:.(......}....*:.(......}....*..(....*..(....*..(....*..(....*:.(......}....*..{....*:.(......}....*..{....*:.(......}....*..{....*..(....*:.(......}....*..{....*^.(.......2...%...}....*:.(......}....*..{....*z.(......}.......2...%...}....*V.(......}......}....*..{....*..{....*:.(......}....*..{....*..{....*"..}....*..{....*"..}....*..{

                                                                                                              C:\Program Files\FastestVPN\is-RRCOJ.tmp

                                                                                                              Download File
                                                                                                              Process:C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmp
                                                                                                              File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                              Category:dropped
                                                                                                              Size (bytes):3070013
                                                                                                              Entropy (8bit):6.39701754184779
                                                                                                              Encrypted:false
                                                                                                              SSDEEP:
                                                                                                              MD5:A2386053A831B1C65F9BB923F4F17A7B
                                                                                                              SHA1:530BC9411C100138963776A527966EA98D2D1FD9
                                                                                                              SHA-256:3AE0793AF74140734EC43A261FAD664E5871890F28F9CCC692B68B3D6E1A26E5
                                                                                                              SHA-512:2E149D81B13101F9C38EE67396A92527AE5BFD8761D8187BAB635C7736B316E31D9A246DC14D934F28EEE4076F9B3FA78751F912D9CFEB6A032470997382D76F
                                                                                                              Malicious:false
                                                                                                              Preview:MZP.....................@.......................InUn....................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L.....gf..................*...........*.......*...@..........................P/...........@......@...................P,.n.....,.j:....,.$....................................................p,.......................,......@,.(....................text.....*.......*................. ..`.itext..$.....*..0....*............. ..`.data.........*.......*.............@....bss.....|....+..........................idata..j:....,..<...f+.............@....didata.(....@,.......+.............@....edata..n....P,.......+.............@..@.tls....X....`,..........................rdata..]....p,.......+.............@..@.rsrc...$.....,.......+.............@..@.............`0......./.............@..@........................................................

                                                                                                              C:\Program Files\FastestVPN\is-TQ8EO.tmp

                                                                                                              Download File
                                                                                                              Process:C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmp
                                                                                                              File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                              Category:dropped
                                                                                                              Size (bytes):29352
                                                                                                              Entropy (8bit):6.56368110636982
                                                                                                              Encrypted:false
                                                                                                              SSDEEP:
                                                                                                              MD5:1CFBF0CBA3C87653D9639ADA438C3291
                                                                                                              SHA1:07E36A34319EAD85857CC022E277B69EA132750B
                                                                                                              SHA-256:3525FCE82E2687D8EFAF992147B196881818856EA9EA851A8DC930751329A8DD
                                                                                                              SHA-512:E95FC978E889BD62E92975EFD8F39161B6E43FE97451068552E3A71635943F990E4E8697323794D75F77BB12F3DE4E2CFADB5B9D80EF90F1992C82298EBFD00B
                                                                                                              Malicious:false
                                                                                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...t.i..........." ..0..@...........^... ...`....... ....................................`.................................:^..O....`...............H...*..........|]..8............................................ ............... ..H............text....>... ...@.................. ..`.rsrc........`.......B..............@..@.reloc...............F..............@..B................n^......H........1...+............................................................{....*:.(......}....*..0..)........u..........,.(.....{.....{....o....*.*.*v .5Q' )UU.Z(.....{....o....X*..0..:........r...p......%..{.......%q.........-.&.+.......o.....(....*..{....*:.(......}....*....0..)........u..........,.(.....{.....{....o....*.*.*v . .q )UU.Z(.....{....o....X*..0..:........r-..p......%..{.......%q.........-.&.+.......o.....(....*..{....*..{....*V.(......}......}....*.0..A.......

                                                                                                              C:\Program Files\FastestVPN\is-U1J8U.tmp

                                                                                                              Download File
                                                                                                              Process:C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmp
                                                                                                              File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                              Category:dropped
                                                                                                              Size (bytes):30888
                                                                                                              Entropy (8bit):6.550270680442998
                                                                                                              Encrypted:false
                                                                                                              SSDEEP:
                                                                                                              MD5:96D7E9527C5D8BDBA798F72B5FD9B94A
                                                                                                              SHA1:C9CE9813C74493084D6E3DDA37C35C8822CA381F
                                                                                                              SHA-256:6942DC9FDBB229D066BA3E1844883B9DA3EAE21F7035FFF2674C3F19C6331B55
                                                                                                              SHA-512:BE88433F513C4D9F58BDDFED57427DEC12BA0490E2D7C79176144732FBB7969956FA55B03E462C50EA3508389B3C29BC5A559F4B6002C6022C93D059C65B5C44
                                                                                                              Malicious:false
                                                                                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...f6............" ..0..F...........e... ........... ....................................`..................................e..O....................N...*...........d..8............................................ ............... ..H............text....E... ...F.................. ..`.rsrc................H..............@..@.reloc...............L..............@..B................be......H.......\4..$0............................................................(....*..{....*"..}....*..{....*"..}....*V.(......(......(....*.0..7.........(....}.......}.......}......|......(...+..|....(....*..{....*"..}....*..{....*"..}....*..{....*"..}....*..{....*"..}....*..(......(......(......(.......(....*.0..?.........(....}3......}4......}5......}2.....|3.....(...+..|3...(....*..0..7.........(....}#......}$......}".....|#.....(...+..|#...(....*..0..?.........(....}.......}

                                                                                                              C:\Program Files\FastestVPN\nfapi.dll (copy)

                                                                                                              Download File
                                                                                                              Process:C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmp
                                                                                                              File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                              Category:dropped
                                                                                                              Size (bytes):159368
                                                                                                              Entropy (8bit):6.32384599449582
                                                                                                              Encrypted:false
                                                                                                              SSDEEP:
                                                                                                              MD5:7AE17C855F3CC63174E90EA527B6138B
                                                                                                              SHA1:0FE1E1B2252511F33EDA3FFCF1F8FC8586AB040A
                                                                                                              SHA-256:26FF04208EC4D26EF4DDD9B3CF01C4D2A1544550BCD59EFDE6F30170053A1170
                                                                                                              SHA-512:453BA41332A704F491FC9E1EE5FBE9F883EDDB4C26A71D207C93992726E9C5B7FEDC48EEEE2A2087F64B083F9473EE794FB2C8F3B77C9DBCBBC47B67816BD156
                                                                                                              Malicious:false
                                                                                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........y..............Y.......................................................................Rich....................PE..L.....[...........!.........................................................`..................................................P.... ..`............@.......0..(...0...............................0...@............................................text....w.......................... ..`.rdata...A.......P..................@..@.data....6....... ..................@....rsrc...`.... ......................@..@.reloc..2(...0...0..................@..B................................................................................................................................................................................................................................................................................................................

                                                                                                              C:\Program Files\FastestVPN\subinacl.exe (copy)

                                                                                                              Download File
                                                                                                              Process:C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmp
                                                                                                              File Type:PE32 executable (console) Intel 80386, for MS Windows
                                                                                                              Category:dropped
                                                                                                              Size (bytes):301224
                                                                                                              Entropy (8bit):5.823114295644
                                                                                                              Encrypted:false
                                                                                                              SSDEEP:
                                                                                                              MD5:4798226EE22C513302EE57D3AA94398B
                                                                                                              SHA1:F42C6CFA4068263D955608DE47E60D099AD8B394
                                                                                                              SHA-256:38F32C75433A2AF902D33511BC3BBBE5BBF66D87FEC7D3AD1694AECEEB7E485E
                                                                                                              SHA-512:94BB5E38CBCDC1E40BBD3AB14A3C92C8C90F64EA1910108BB2DE80E00BEA358A13A063031B5E3417A55102DB238488F5C3E766A1AF3ACEDB8806FEC5DD81990C
                                                                                                              Malicious:false
                                                                                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........._.Y.1.Y.1.Y.1..l.[.1...>.].1.[.5.[.1.9.|.X.1...l.D.1.Y.0.p.1...n.V.1...Q.M.1...o.X.1...k.X.1.RichY.1.........PE..L...[..@.................J...................`...............................P................... ...........................=..T....@...............n...*..............................................@............................................text....I.......J.................. ..`.data...L....`.......N..............@....rsrc........@.......^..............@..@........................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                              C:\Program Files\FastestVPN\unins000.dat

                                                                                                              Download File
                                                                                                              Process:C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmp
                                                                                                              File Type:InnoSetup Log 64-bit FastestVPN, version 0x418, 26343 bytes, 216041\37\user\, C:\Program Files\FastestVPN\376\377\377\00
                                                                                                              Category:dropped
                                                                                                              Size (bytes):26343
                                                                                                              Entropy (8bit):3.449038341316555
                                                                                                              Encrypted:false
                                                                                                              SSDEEP:
                                                                                                              MD5:3CA84F4D8DDD87F79206C6B5961475D8
                                                                                                              SHA1:7ADF84B6DBC0BB3B2C7F62326ED1F2D5381FBE33
                                                                                                              SHA-256:47E052534DDF9525D564955D4994A77809BA4EF22FC8FADE26F607BC7DD000DA
                                                                                                              SHA-512:016C25A9DE4408FF34603DF6BFF3B6B61B4870B8267A52CB37314AA6182DE4389D8EC133047737FA796BA903613E83981C4DF25950A02222536A5C4C11A8BA9A
                                                                                                              Malicious:false
                                                                                                              Preview:Inno Setup Uninstall Log (b) 64-bit.............................FastestVPN......................................................................................................................FastestVPN...............................................................................................................................f....................................................................................................................H........A.A.......w........2.1.6.0.4.1......e.n.g.i.n.e.e.r......C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.F.a.s.t.e.s.t.V.P.N................%...... ........................C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.F.a.s.t.e.s.t.V.P.N......C.:.\.P.r.o.g.r.a.m.D.a.t.a.\.M.i.c.r.o.s.o.f.t.\.W.i.n.d.o.w.s.\.S.t.a.r.t. .M.e.n.u.\.P.r.o.g.r.a.m.s.\.F.a.s.t.e.s.t.V.P.N......F.a.s.t.e.s.t.V.P.N......e.n........................."...<........C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.F.a.s.t.e.s.t.V.P.N.................C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.F.a.s.t.e.s.t.V.P.N.\.B.o.

                                                                                                              C:\Program Files\FastestVPN\unins000.exe (copy)

                                                                                                              Download File
                                                                                                              Process:C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmp
                                                                                                              File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                              Category:dropped
                                                                                                              Size (bytes):3070013
                                                                                                              Entropy (8bit):6.39701754184779
                                                                                                              Encrypted:false
                                                                                                              SSDEEP:
                                                                                                              MD5:A2386053A831B1C65F9BB923F4F17A7B
                                                                                                              SHA1:530BC9411C100138963776A527966EA98D2D1FD9
                                                                                                              SHA-256:3AE0793AF74140734EC43A261FAD664E5871890F28F9CCC692B68B3D6E1A26E5
                                                                                                              SHA-512:2E149D81B13101F9C38EE67396A92527AE5BFD8761D8187BAB635C7736B316E31D9A246DC14D934F28EEE4076F9B3FA78751F912D9CFEB6A032470997382D76F
                                                                                                              Malicious:false
                                                                                                              Preview:MZP.....................@.......................InUn....................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L.....gf..................*...........*.......*...@..........................P/...........@......@...................P,.n.....,.j:....,.$....................................................p,.......................,......@,.(....................text.....*.......*................. ..`.itext..$.....*..0....*............. ..`.data.........*.......*.............@....bss.....|....+..........................idata..j:....,..<...f+.............@....didata.(....@,.......+.............@....edata..n....P,.......+.............@..@.tls....X....`,..........................rdata..]....p,.......+.............@..@.rsrc...$.....,.......+.............@..@.............`0......./.............@..@........................................................

                                                                                                              C:\ProgramData\FastestVPN\ServicePort.txt

                                                                                                              Download File
                                                                                                              Process:C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe
                                                                                                              File Type:ASCII text, with no line terminators
                                                                                                              Category:dropped
                                                                                                              Size (bytes):4
                                                                                                              Entropy (8bit):1.5
                                                                                                              Encrypted:false
                                                                                                              SSDEEP:
                                                                                                              MD5:3499738F724B2AE08A1871B6A0A7D175
                                                                                                              SHA1:A1AB9117DC426032D0E013BB62EDF31CD37B1CAF
                                                                                                              SHA-256:715FCF6424D0AC2F19B5A65364795EBB982885F040E93A1BF4FDD594D9478251
                                                                                                              SHA-512:3B1F29ADDCC165F7807149B13451ABE9DB7E0258F5A77F5802AEA11672B37CBC3439D4D8EB2AAB81F37B302B6631CD9573D64CF281FE4C9E44C672BF31BFF902
                                                                                                              Malicious:false
                                                                                                              Preview:9030

                                                                                                              C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

                                                                                                              Download File
                                                                                                              Process:C:\Windows\System32\svchost.exe
                                                                                                              File Type:Extensible storage user DataBase, version 0x620, checksum 0xd2330d1b, page size 16384, Windows version 10.0
                                                                                                              Category:dropped
                                                                                                              Size (bytes):1310720
                                                                                                              Entropy (8bit):0.6290834696739398
                                                                                                              Encrypted:false
                                                                                                              SSDEEP:
                                                                                                              MD5:B690CFDF9B8273796BBCD1647BF81E10
                                                                                                              SHA1:77CECAAE8291E94B99E00C78FC0AD6758BD6C7CE
                                                                                                              SHA-256:0C6591A309F495EC1FA9E5B54AAFCB4A2E85C0D51D0E6ED98420CBC469F4D7A4
                                                                                                              SHA-512:218451FD08FC4B3DBFF11AAB030697668981D52165D10A060ACA1A8F66970BC972C8378885C0B2A05FF7520BCF802AC8ED378499EA1BB57FDC7822F9ABE85288
                                                                                                              Malicious:false
                                                                                                              Preview:.3..... .......P.......X\...;...{......................0.j.....,'...|y..%...|..h.g.....,'...|y.0.j.........D./..;...{..........................................................................................................eJ......n....@...................................................................................................... ............................................................................................................................................................................................................2...{......................................,'...|y................. v..,'...|y..........................#......0.j.....................................................................................................................................................................................................................................................................................................................................................

                                                                                                              C:\ProgramData\Microsoft\Windows\Start Menu\Programs\FastestVPN\FastestVPN.lnk

                                                                                                              Download File
                                                                                                              Process:C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmp
                                                                                                              File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Icon number=0, Archive, ctime=Thu Oct 3 07:37:06 2024, mtime=Thu Oct 3 07:37:06 2024, atime=Thu Jun 27 19:18:16 2024, length=2059432, window=hide
                                                                                                              Category:dropped
                                                                                                              Size (bytes):1765
                                                                                                              Entropy (8bit):3.2391972723006104
                                                                                                              Encrypted:false
                                                                                                              SSDEEP:
                                                                                                              MD5:3CE49B4333613751FA274C353E4F5C30
                                                                                                              SHA1:0BA240752ADBE04C498EB708384594B92D30E189
                                                                                                              SHA-256:F6CF8B16BED1BC7998C58FBD614FF3F7805C9AF364C612C65AE4D64E874FA346
                                                                                                              SHA-512:C7873A0F45FCA9F8096A30B02C75A9D887206B65B1BFCDDFA67C24A078DE7545D7EEFA4CA9E26EC241C1A5F42D3B3D6D2D62945814F25CF7D71C3A029D0ACF8E
                                                                                                              Malicious:false
                                                                                                              Preview:L..................F.@.. ...-..mo......mo......$.....l...........................P.O. .:i.....+00.../C:\.....................1.....EW.3..PROGRA~1..t......O.IEW.5....B...............J.......j.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....^.1.....CY.D..FASTES~1..F......CY.DCY.D..........................GP{.F.a.s.t.e.s.t.V.P.N.....j.2..l...XH. .FASTES~1.EXE..N......CY.DCY.D..............................F.a.s.t.e.s.t.V.P.N...e.x.e.......Y...............-.......X.............q.....C:\Program Files\FastestVPN\FastestVPN.exe..9.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.F.a.s.t.e.s.t.V.P.N.\.F.a.s.t.e.s.t.V.P.N...e.x.e...C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.F.a.s.t.e.s.t.V.P.N.(.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.F.a.s.t.e.s.t.V.P.N.\.a.p.p.-.i.c.o.n...i.c.o.........%SystemDrive%\Program Files\FastestVPN\app-icon.ico.....................................................................................................................................

                                                                                                              C:\ProgramData\Microsoft\Windows\Start Menu\Programs\FastestVPN\Uninstall FastestVPN.lnk

                                                                                                              Download File
                                                                                                              Process:C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmp
                                                                                                              File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Archive, ctime=Thu Oct 3 07:37:06 2024, mtime=Thu Oct 3 07:37:06 2024, atime=Thu Oct 3 07:36:40 2024, length=3070013, window=hide
                                                                                                              Category:dropped
                                                                                                              Size (bytes):885
                                                                                                              Entropy (8bit):4.560410596463518
                                                                                                              Encrypted:false
                                                                                                              SSDEEP:
                                                                                                              MD5:75D4A0B8649AEEDCCD5604FDD51CC86E
                                                                                                              SHA1:9D7E41455D5B31D4E5BF880F35B11C10D504B16F
                                                                                                              SHA-256:3F7854A9A804477798C2803C3F4B55B7DAD055D98D818ED17ECC0CA52B0BA5DF
                                                                                                              SHA-512:7E9D1C0D88AC36E4261790548E28A5AE467BB31ACB97C8A72A7A0E7C65FBFDA85FBFAE0030E95B6941E36309EEFB921F5572716A1964D29D0C36E75791FC7EFA
                                                                                                              Malicious:false
                                                                                                              Preview:L..................F.... ....%.mo...k..mo...oh.^o...=............................P.O. .:i.....+00.../C:\.....................1.....CY.D..PROGRA~1..t......O.ICY.D....B...............J.......+.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....^.1.....CY.D..FASTES~1..F......CY.DCY.D..........................GP{.F.a.s.t.e.s.t.V.P.N.....f.2.=...CY.D .unins000.exe..J......CY.DCY.D........................... ..u.n.i.n.s.0.0.0...e.x.e.......W...............-.......V.............q.....C:\Program Files\FastestVPN\unins000.exe..7.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.F.a.s.t.e.s.t.V.P.N.\.u.n.i.n.s.0.0.0...e.x.e...C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.F.a.s.t.e.s.t.V.P.N.`.......X.......216041...........hT..CrF.f4... ....Jc...-...-$..hT..CrF.f4... ....Jc...-...-$.E.......9...1SPS..mD..pH.H@..=x.....h....H.....K...YM...?................

                                                                                                              C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_FastestVPN.Windo_53ebd9cdf731fce6dc6bf88ca253274667038a7_2affa00b_39838f93-b854-4d8f-8173-eadf40850556\Report.wer

                                                                                                              Download File
                                                                                                              Process:C:\Windows\SysWOW64\WerFault.exe
                                                                                                              File Type:Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                                                                                              Category:dropped
                                                                                                              Size (bytes):65536
                                                                                                              Entropy (8bit):1.0631724152915143
                                                                                                              Encrypted:false
                                                                                                              SSDEEP:
                                                                                                              MD5:6932F6D633DED00435B51008CDE0B7D1
                                                                                                              SHA1:68267F5771098F93C164FA2BBC5D403D15895936
                                                                                                              SHA-256:D0738C623E28344156B004BFAEFCAACD5D06F511377B9A2F68176D20C764EFF5
                                                                                                              SHA-512:7CF2E7BEDA056C562D0A52B0C76D31084AA19D936A519B6B62EF52D79A4BDE3BF789EA953FE470C60C62380BEC560BD0ABDBD404337A999302D4C601A0244E48
                                                                                                              Malicious:false
                                                                                                              Preview:..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.C.L.R.2.0.r.3.....E.v.e.n.t.T.i.m.e.=.1.3.3.7.2.4.1.8.2.5.3.4.8.4.7.6.7.1.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.7.2.4.1.8.2.5.4.0.7.5.7.5.7.8.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.3.9.8.3.8.f.9.3.-.b.8.5.4.-.4.d.8.f.-.8.1.7.3.-.e.a.d.f.4.0.8.5.0.5.5.6.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.3.0.5.2.6.e.1.3.-.0.1.7.f.-.4.c.b.a.-.9.1.0.8.-.0.f.e.e.4.0.8.a.9.9.d.3.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.F.a.s.t.e.s.t.V.P.N...W.i.n.d.o.w.s.S.e.r.v.i.c.e...e.x.e.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e.=.F.a.s.t.e.s.t.V.P.N...W.i.n.d.o.w.s.S.e.r.v.i.c.e...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.0.9.e.c.-.0.0.0.1.-.0.0.1.5.-.c.7.2.8.-.7.e.7.d.6.f.1.5.d.b.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.b.3.7.5.a.5.b.0.1.c.c.e.6.9.2.0.b.8.4.1.1.a.f.c.e.d.8.6.5.7.1.0.0.0.0.0.0.0.0.0.!.0.0.0.0.a.b.1.8.

                                                                                                              C:\ProgramData\Microsoft\Windows\WER\Temp\WERD38C.tmp.dmp

                                                                                                              Download File
                                                                                                              Process:C:\Windows\SysWOW64\WerFault.exe
                                                                                                              File Type:Mini DuMP crash report, 15 streams, Thu Oct 3 08:37:33 2024, 0x1205a4 type
                                                                                                              Category:dropped
                                                                                                              Size (bytes):221389
                                                                                                              Entropy (8bit):4.0683823568961275
                                                                                                              Encrypted:false
                                                                                                              SSDEEP:
                                                                                                              MD5:DA8874BEF3719B104CBB3E60DC6DA3A5
                                                                                                              SHA1:FFDF1D7E6C78C5655A444E9FD8D8B76A32CD205A
                                                                                                              SHA-256:2DE31866FC9D4EE5B57CA991470D252B83FFFCC21091236CCE497824DCA0B930
                                                                                                              SHA-512:566299DFE928A37E43FBEBF92780BEC331043BF9A2D77FC51A9EF54A28D06BA6C9CA7E451570D96414D71B90D7F9F9BDBFA4A2621BF0821D9555AF07FF2A108C
                                                                                                              Malicious:false
                                                                                                              Preview:MDMP..a..... ........W.f....................................$............#...@..........`.......8...........T...........h*..e6......................................................................................................eJ......\ ......GenuineIntel............T............W.f.............................0..............,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.......................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                              C:\ProgramData\Microsoft\Windows\WER\Temp\WERD4C5.tmp.WERInternalMetadata.xml

                                                                                                              Download File
                                                                                                              Process:C:\Windows\SysWOW64\WerFault.exe
                                                                                                              File Type:XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                                                                                              Category:dropped
                                                                                                              Size (bytes):8480
                                                                                                              Entropy (8bit):3.7062545963510525
                                                                                                              Encrypted:false
                                                                                                              SSDEEP:
                                                                                                              MD5:3755451125F21EB7E9519FC60DAB774D
                                                                                                              SHA1:27B592A0890B113B8814DB9F16B7DD163EE3C443
                                                                                                              SHA-256:D345EE9064D8D318AF19CE14D7C255893497B2E0520FC7721B16B20181EAC234
                                                                                                              SHA-512:5499E88A42DCEEA38896E217BF3CEFDD2820E499719DDA8B8FF2955085372AA335C54062E05F55D5265EBC2801A5F536E57C2A4982E43644D440CA285671A5D4
                                                                                                              Malicious:false
                                                                                                              Preview:..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.2.5.4.0.<./.P.i.

                                                                                                              C:\ProgramData\Microsoft\Windows\WER\Temp\WERD4F5.tmp.xml

                                                                                                              Download File
                                                                                                              Process:C:\Windows\SysWOW64\WerFault.exe
                                                                                                              File Type:XML 1.0 document, ASCII text, with CRLF line terminators
                                                                                                              Category:dropped
                                                                                                              Size (bytes):4887
                                                                                                              Entropy (8bit):4.553926424704233
                                                                                                              Encrypted:false
                                                                                                              SSDEEP:
                                                                                                              MD5:369A002438CC31EFE729BA5495E4ABD9
                                                                                                              SHA1:3B23410F895655B7DF5E3B479B711F860B2BF457
                                                                                                              SHA-256:8C61E97B39C6285413FDA6D5B617303B2D678E4BCAEF72FC464B2F61D22B666E
                                                                                                              SHA-512:4B3BD9861FCEF04ECCB594F0A2350318D4956634028F06C20E07544A235BDF71D22EACCDC11274CECAB9110C6A5EBE2F6987831A84E5C550B30FB697BB98CBDE
                                                                                                              Malicious:false
                                                                                                              Preview:<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="527020" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

                                                                                                              C:\ProgramData\Microsoft\Windows\WER\Temp\WERD503.tmp.csv

                                                                                                              Download File
                                                                                                              Process:C:\Windows\System32\svchost.exe
                                                                                                              File Type:data
                                                                                                              Category:dropped
                                                                                                              Size (bytes):83916
                                                                                                              Entropy (8bit):3.0371692641074217
                                                                                                              Encrypted:false
                                                                                                              SSDEEP:
                                                                                                              MD5:6E76D90ADC16568A18D36ACB63040860
                                                                                                              SHA1:D0452533F94AB5E9A1F8D280A8F329B064EE7F97
                                                                                                              SHA-256:CF41BB326754EA7E83FAAE7304292EFA34D0089DEBD104918CCD6D1F981F5228
                                                                                                              SHA-512:5063BDBADD504DEB66464DC825BBC2F835C9493B10F118D39705D9E1212BFCDE88A91FAF148F6EB7DA4E74BC8DD89FA8F5C5851CF9C0BE73BFBB4532C3CC99FE
                                                                                                              Malicious:false
                                                                                                              Preview:I.m.a.g.e.N.a.m.e.,.U.n.i.q.u.e.P.r.o.c.e.s.s.I.d.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.,.W.o.r.k.i.n.g.S.e.t.P.r.i.v.a.t.e.S.i.z.e.,.H.a.r.d.F.a.u.l.t.C.o.u.n.t.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.H.i.g.h.W.a.t.e.r.m.a.r.k.,.C.y.c.l.e.T.i.m.e.,.C.r.e.a.t.e.T.i.m.e.,.U.s.e.r.T.i.m.e.,.K.e.r.n.e.l.T.i.m.e.,.B.a.s.e.P.r.i.o.r.i.t.y.,.P.e.a.k.V.i.r.t.u.a.l.S.i.z.e.,.V.i.r.t.u.a.l.S.i.z.e.,.P.a.g.e.F.a.u.l.t.C.o.u.n.t.,.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.P.e.a.k.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.Q.u.o.t.a.P.e.a.k.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.e.a.k.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.e.a.k.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.r.i.v.a.t.e.P.a.g.e.C.o.u.n.t.,.R.e.a.d.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.W.r.i.t.e.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.O.t.h.e.r.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.R.e.a.d.T.r.a.n.s.f.e.r.C.o.u.n.t.,.W.r.i.t.e.T.r.a.n.s.f.e.r.C.o.u.n.t.,.O.t.h.e.r.T.r.a.n.s.f.e.r.C.o.u.n.t.,.H.a.n.

                                                                                                              C:\ProgramData\Microsoft\Windows\WER\Temp\WERD571.tmp.txt

                                                                                                              Download File
                                                                                                              Process:C:\Windows\System32\svchost.exe
                                                                                                              File Type:data
                                                                                                              Category:dropped
                                                                                                              Size (bytes):13340
                                                                                                              Entropy (8bit):2.6857406695138892
                                                                                                              Encrypted:false
                                                                                                              SSDEEP:
                                                                                                              MD5:E6DF55973678249E001EC71477DEE16F
                                                                                                              SHA1:6A0D408CE12E148643072E34D138D8E87218E1C4
                                                                                                              SHA-256:6F5525D21A9C22244B239F36892C306F38A22FB381B2C4C15C331B7F105D1DB5
                                                                                                              SHA-512:6ADB332A954E8BDD27D9F818653850AA8859637710DED4316907BB5B11D09848A795B4EF09CEAE759AA5457F84D8797FDC62FDA345BF9391F960B15D5759FBC9
                                                                                                              Malicious:false
                                                                                                              Preview:B...T.i.m.e.r.R.e.s.o.l.u.t.i.o.n. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1.5.6.2.5.0.....B...P.a.g.e.S.i.z.e. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .4.0.9.6.....B...N.u.m.b.e.r.O.f.P.h.y.s.i.c.a.l.P.a.g.e.s. . . . . . . . . . . . . . . . . . . . . . . . . . .1.0.4.8.3.3.3.....B...L.o.w.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . . . . . . . . .2.....B...H.i.g.h.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . .1.3.1.0.7.1.9.....B...A.l.l.o.c.a.t.i.o.n.G.r.a.n.u.l.a.r.i.t.y. . . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.i.n.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.a.x.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . .1.4.0.7.3.7.4.8.8.2.8.9.7.9.1.....B...A.c.t.i.v.e.P.r.o.c.e.s.s.o.r.s.A.f.f.i.n.i.t.y.M.a.s.k. . . . . . .

                                                                                                              C:\Users\Public\Desktop\FastestVPN.lnk

                                                                                                              Download File
                                                                                                              Process:C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmp
                                                                                                              File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Icon number=0, Archive, ctime=Thu Oct 3 07:37:06 2024, mtime=Thu Oct 3 07:37:19 2024, atime=Thu Jun 27 19:18:16 2024, length=2059432, window=hide
                                                                                                              Category:dropped
                                                                                                              Size (bytes):1747
                                                                                                              Entropy (8bit):3.223674190674166
                                                                                                              Encrypted:false
                                                                                                              SSDEEP:
                                                                                                              MD5:73EBA3FA08B175BFBDFFD8D3D672920B
                                                                                                              SHA1:ED7D52725E4B4B44EFB8E6DB302844700569BAB7
                                                                                                              SHA-256:A1EE28AE3951F311E55A14237A698FB5FC1A6865D39B8B832805B1444FA917E9
                                                                                                              SHA-512:10D97A01C6F3534E480103D7A5719251F68E517A45D4A3724845DAEA36ECB1D41091E5E2442FD97CF8A518B4AAEEECB346784CFE57D2DBE759028ADD76D52C26
                                                                                                              Malicious:false
                                                                                                              Preview:L..................F.@.. ...-..mo....T^uo......$.....l...........................P.O. .:i.....+00.../C:\.....................1.....CY.D..PROGRA~1..t......O.ICY.D....B...............J.......+.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....^.1.....CY.D..FASTES~1..F......CY.DCY.D..........................GP{.F.a.s.t.e.s.t.V.P.N.....j.2..l...XH. .FASTES~1.EXE..N......CY.DCY.D..............................F.a.s.t.e.s.t.V.P.N...e.x.e.......Y...............-.......X.............q.....C:\Program Files\FastestVPN\FastestVPN.exe..0.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.F.a.s.t.e.s.t.V.P.N.\.F.a.s.t.e.s.t.V.P.N...e.x.e...C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.F.a.s.t.e.s.t.V.P.N.(.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.F.a.s.t.e.s.t.V.P.N.\.a.p.p.-.i.c.o.n...i.c.o.........%SystemDrive%\Program Files\FastestVPN\app-icon.ico.......................................................................................................................................................

                                                                                                              C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F2E248BEDDBB2D85122423C41028BFD4

                                                                                                              Download File
                                                                                                              Process:C:\Program Files\FastestVPN\FastestVPN.exe
                                                                                                              File Type:Certificate, Version=3
                                                                                                              Category:dropped
                                                                                                              Size (bytes):1428
                                                                                                              Entropy (8bit):7.688784034406474
                                                                                                              Encrypted:false
                                                                                                              SSDEEP:
                                                                                                              MD5:78F2FCAA601F2FB4EBC937BA532E7549
                                                                                                              SHA1:DDFB16CD4931C973A2037D3FC83A4D7D775D05E4
                                                                                                              SHA-256:552F7BDCF1A7AF9E6CE672017F4F12ABF77240C78E761AC203D1D9D20AC89988
                                                                                                              SHA-512:BCAD73A7A5AFB7120549DD54BA1F15C551AE24C7181F008392065D1ED006E6FA4FA5A60538D52461B15A12F5292049E929CFFDE15CC400DEC9CDFCA0B36A68DD
                                                                                                              Malicious:false
                                                                                                              Preview:0...0..x..........W..!2.9...wu\0...*.H........0b1.0...U....US1.0...U....DigiCert Inc1.0...U....www.digicert.com1!0...U....DigiCert Trusted Root G40...130801120000Z..380115120000Z0b1.0...U....US1.0...U....DigiCert Inc1.0...U....www.digicert.com1!0...U....DigiCert Trusted Root G40.."0...*.H.............0..........sh..]J<0"0i3..%..!=..Y..).=X.v..{....0....8..V.m...y....._..<R.R....~...W.YUr.h.p..u.js2...D.......t;mq.-... .. .c)-..^N..!a.4...^.[......4@_.zf.w.H.fWW.TX..+.O.0.V..{]..O^.5.1..^......@.y.x...j.8.....7...}...>..p.U.A2...s*n..|!L....u]xf.:1D.3@...ZI...g.'..O9..X..$\F.d..i.v.v=Y]Bv...izH....f.t..K...c....:.=...E%...D.+~....am.3...K...}....!........p,A`..c.D..vb~.....d.3....C....w.....!..T)%.l..RQGt.&..Au.z._.?..A..[..P.1..r."..|Lu?c.!_. Qko....O..E_. ........~.&...i/..-............B0@0...U.......0....0...U...........0...U..........q]dL..g?....O0...*.H..............a.}.l.........dh.V.w.p...J...x\.._...)V.6I]Dc...f.#.=y.mk.T..<.C@..P.R..;...ik.

                                                                                                              C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F2E248BEDDBB2D85122423C41028BFD4

                                                                                                              Download File
                                                                                                              Process:C:\Program Files\FastestVPN\FastestVPN.exe
                                                                                                              File Type:data
                                                                                                              Category:dropped
                                                                                                              Size (bytes):254
                                                                                                              Entropy (8bit):3.0479968492632117
                                                                                                              Encrypted:false
                                                                                                              SSDEEP:
                                                                                                              MD5:F3BE983174E28EFDF71CA1836A840061
                                                                                                              SHA1:DEA84D649410516D964BF8CEDD0ABE7497E66B95
                                                                                                              SHA-256:C2156CB0B40A397E93DCF32701144C0F95691D6378FEB04246DBA17D59021A6A
                                                                                                              SHA-512:206E60686075C7E39BE3337D7D2E05ACC472A8DDAF60108E84A3EBB1C2EC4109AFC26031B422CE37B058411FA5784B459B181BFC0976176C1763066C8A06A344
                                                                                                              Malicious:false
                                                                                                              Preview:p...... ....l...;.B.o...(....................................................... ............n......................h.t.t.p.:././.c.a.c.e.r.t.s...d.i.g.i.c.e.r.t...c.o.m./.D.i.g.i.C.e.r.t.T.r.u.s.t.e.d.R.o.o.t.G.4...c.r.t...".5.a.2.8.6.4.1.7.-.5.9.4."...

                                                                                                              C:\Users\user\AppData\Local\FastestVPN\FastestVPN.exe_Url_eplmg30frbssdwvao0rtvq0jja20avcl\2b0izbqy.newcfg

                                                                                                              Download File
                                                                                                              Process:C:\Program Files\FastestVPN\FastestVPN.exe
                                                                                                              File Type:XML 1.0 document, ASCII text, with CRLF line terminators
                                                                                                              Category:dropped
                                                                                                              Size (bytes):390
                                                                                                              Entropy (8bit):4.9765302535826725
                                                                                                              Encrypted:false
                                                                                                              SSDEEP:
                                                                                                              MD5:45DAEA68DD1BC355B0998E4BAAFC7BD3
                                                                                                              SHA1:4CA64148D57DE12589C7DB4E696016B36B1CD1AD
                                                                                                              SHA-256:8F38A36F7D918BF43AA765CA1847FDF6F7ECB5BAA3AB1015CC5254A373DD715A
                                                                                                              SHA-512:C903CEBF3B66F55AAAF95B34C5951942D72136CE1A9289F74FB63E8741C12F17B6B6BFA1696FC94447F71058C85E48ABC20491CBEC5532EAB2DC254EF70C1FF3
                                                                                                              Malicious:false
                                                                                                              Preview:<?xml version="1.0" encoding="utf-8"?>..<configuration>.. <appSettings>.. <add key="AppCenterEnabled" value="True" />.. <add key="AppCenterServiceEnabled_analytics" value="True" />.. <add key="AppCenterServiceEnabled_crashes" value="True" />.. <add key="AppCenterInstallId" value="11aaee64-9253-4209-996b-2e176b5aa7a9" />.. </appSettings>..</configuration>

                                                                                                              C:\Users\user\AppData\Local\FastestVPN\FastestVPN.exe_Url_eplmg30frbssdwvao0rtvq0jja20avcl\331i3ane.newcfg

                                                                                                              Download File
                                                                                                              Process:C:\Program Files\FastestVPN\FastestVPN.exe
                                                                                                              File Type:XML 1.0 document, ASCII text, with CRLF line terminators
                                                                                                              Category:dropped
                                                                                                              Size (bytes):393
                                                                                                              Entropy (8bit):4.967704403726679
                                                                                                              Encrypted:false
                                                                                                              SSDEEP:
                                                                                                              MD5:2675A51F9E4B14279DD58E09F83571C2
                                                                                                              SHA1:4377536FD69662CC193E3E0430914915569B389E
                                                                                                              SHA-256:99753375203B0FED2095C849859BF32554D131450AB972CDA657BEDC0E1947E3
                                                                                                              SHA-512:3A87766A694B0F5CE5D405B4814ED8F8702DF4CF3F5214615F72E33015BFA359AA943B4E57F032D2AEC7E0451A5E0921369504FE3CC62E40AB2C7887E10783E8
                                                                                                              Malicious:false
                                                                                                              Preview:<?xml version="1.0" encoding="utf-8"?>..<configuration>.. <appSettings>.. <add key="AppCenterEnabled" value="False" />.. <add key="AppCenterServiceEnabled_analytics" value="False" />.. <add key="AppCenterServiceEnabled_crashes" value="False" />.. <add key="AppCenterInstallId" value="11aaee64-9253-4209-996b-2e176b5aa7a9" />.. </appSettings>..</configuration>

                                                                                                              C:\Users\user\AppData\Local\FastestVPN\FastestVPN.exe_Url_eplmg30frbssdwvao0rtvq0jja20avcl\3l3vz34y.newcfg

                                                                                                              Download File
                                                                                                              Process:C:\Program Files\FastestVPN\FastestVPN.exe
                                                                                                              File Type:XML 1.0 document, ASCII text, with CRLF line terminators
                                                                                                              Category:dropped
                                                                                                              Size (bytes):391
                                                                                                              Entropy (8bit):4.982245676652186
                                                                                                              Encrypted:false
                                                                                                              SSDEEP:
                                                                                                              MD5:930C5FD2AEED8243B7F7B17F419AE7F5
                                                                                                              SHA1:08D87573C60837F3333A390F82343D4B5BD81D89
                                                                                                              SHA-256:A9ED9C86C36772982AB2C2E059F65FC5E16E3F2A720888EFC64DB31F7BBA326A
                                                                                                              SHA-512:BC0E53B365F7169213325DE8E534F8ABE99E1AD03A8C45A1710A88247E673337CCDCC667E9C1585B2F8543E1D9F6B1B1F65F9D85DAE743DE7F77AB680C5F1118
                                                                                                              Malicious:false
                                                                                                              Preview:<?xml version="1.0" encoding="utf-8"?>..<configuration>.. <appSettings>.. <add key="AppCenterEnabled" value="True" />.. <add key="AppCenterServiceEnabled_analytics" value="True" />.. <add key="AppCenterServiceEnabled_crashes" value="False" />.. <add key="AppCenterInstallId" value="11aaee64-9253-4209-996b-2e176b5aa7a9" />.. </appSettings>..</configuration>

                                                                                                              C:\Users\user\AppData\Local\FastestVPN\FastestVPN.exe_Url_eplmg30frbssdwvao0rtvq0jja20avcl\AppCenter.config (copy)

                                                                                                              Download File
                                                                                                              Process:C:\Program Files\FastestVPN\FastestVPN.exe
                                                                                                              File Type:XML 1.0 document, ASCII text, with CRLF line terminators
                                                                                                              Category:dropped
                                                                                                              Size (bytes):166
                                                                                                              Entropy (8bit):4.816940765206284
                                                                                                              Encrypted:false
                                                                                                              SSDEEP:
                                                                                                              MD5:90401247D5A6AF2729E2F23FBA0A6351
                                                                                                              SHA1:977D37740A245C9A41AD5B8916C07A699B181A09
                                                                                                              SHA-256:C4622D6EF948D316ED1C28E5BD2EE8CCE28BE710E9815CA67BDFF4C2648AACA4
                                                                                                              SHA-512:1F47BC3EFD2AB121663FF12F753DF519DE18CFDE43C79C475D7CEC32D70AFC7CE8A696EBCE5BA2519CBAA4F58FBEDDEC082B3AC6EFCE50996D54A2975B2C27DE
                                                                                                              Malicious:false
                                                                                                              Preview:<?xml version="1.0" encoding="utf-8"?>..<configuration>.. <appSettings>.. <add key="AppCenterEnabled" value="False" />.. </appSettings>..</configuration>

                                                                                                              C:\Users\user\AppData\Local\FastestVPN\FastestVPN.exe_Url_eplmg30frbssdwvao0rtvq0jja20avcl\qymr0qnd.newcfg

                                                                                                              Download File
                                                                                                              Process:C:\Program Files\FastestVPN\FastestVPN.exe
                                                                                                              File Type:XML 1.0 document, ASCII text, with CRLF line terminators
                                                                                                              Category:dropped
                                                                                                              Size (bytes):306
                                                                                                              Entropy (8bit):4.786578375552194
                                                                                                              Encrypted:false
                                                                                                              SSDEEP:
                                                                                                              MD5:9BD7587F34E11ECFAD8B5DEEED8364B6
                                                                                                              SHA1:93765EE7A4A27B2F84134001FAAB307984BD58BE
                                                                                                              SHA-256:B9870C1A6239C96F710CEB8B8E21A745433A8C8151B0D2FD9C17A0D2C4AB1C29
                                                                                                              SHA-512:7B0B26DFE2CD19BF210AE3E916D95D9EE97D6677C11979D2F8787C2EC9F682FC52078B4D126BC4671661CFD98EF8D7C9AE18F9AE5F8D6DF141F8B25B52A5D5C3
                                                                                                              Malicious:false
                                                                                                              Preview:<?xml version="1.0" encoding="utf-8"?>..<configuration>.. <appSettings>.. <add key="AppCenterEnabled" value="False" />.. <add key="AppCenterServiceEnabled_analytics" value="False" />.. <add key="AppCenterServiceEnabled_crashes" value="False" />.. </appSettings>..</configuration>

                                                                                                              C:\Users\user\AppData\Local\FastestVPN\FastestVPN.exe_Url_eplmg30frbssdwvao0rtvq0jja20avcl\teihrqao.newcfg

                                                                                                              Download File
                                                                                                              Process:C:\Program Files\FastestVPN\FastestVPN.exe
                                                                                                              File Type:XML 1.0 document, ASCII text, with CRLF line terminators
                                                                                                              Category:dropped
                                                                                                              Size (bytes):392
                                                                                                              Entropy (8bit):4.979281200678964
                                                                                                              Encrypted:false
                                                                                                              SSDEEP:
                                                                                                              MD5:B86D5BFE04DFAB1A823BDD7BB6A02EFD
                                                                                                              SHA1:0C922B6C75B3D176909D52B3CEAED6E387C507E7
                                                                                                              SHA-256:F5A96C9F90579D15FC75AA54801DA98205A8B00F3413D20A2A8EC43B31E9A5D3
                                                                                                              SHA-512:25256A7744D2D4B48EB7BE27A933C08EC0F22943690B688E7182733801B91E47920C298A68BC0B3A778868A6887D896616B7099898066EF386D1130497D6461D
                                                                                                              Malicious:false
                                                                                                              Preview:<?xml version="1.0" encoding="utf-8"?>..<configuration>.. <appSettings>.. <add key="AppCenterEnabled" value="True" />.. <add key="AppCenterServiceEnabled_analytics" value="False" />.. <add key="AppCenterServiceEnabled_crashes" value="False" />.. <add key="AppCenterInstallId" value="11aaee64-9253-4209-996b-2e176b5aa7a9" />.. </appSettings>..</configuration>

                                                                                                              C:\Users\user\AppData\Local\FastestVPN\FastestVPN.exe_Url_eplmg30frbssdwvao0rtvq0jja20avcl\yfewp3bb.newcfg

                                                                                                              Download File
                                                                                                              Process:C:\Program Files\FastestVPN\FastestVPN.exe
                                                                                                              File Type:XML 1.0 document, ASCII text, with CRLF line terminators
                                                                                                              Category:dropped
                                                                                                              Size (bytes):237
                                                                                                              Entropy (8bit):4.807606594598902
                                                                                                              Encrypted:false
                                                                                                              SSDEEP:
                                                                                                              MD5:183EBDEC24DDC45FF5E38C915A0F1F2E
                                                                                                              SHA1:E1FFE9DA68D9F934FD66E0EB15857C9C1F9BC48D
                                                                                                              SHA-256:6165A855053058DA8ABDE8798FABCD9F0E6ECAD175E52A3DFE0F3CF081C82E4E
                                                                                                              SHA-512:41F7B750B6CE0B096A3D5FD7ECF6CD1E222C7B26C4FF3F0463B1AAB2D5718245CF4A91AB396B02ED8B125A55E62574D5E11949B95C5A636899CD1A2F4F795D06
                                                                                                              Malicious:false
                                                                                                              Preview:<?xml version="1.0" encoding="utf-8"?>..<configuration>.. <appSettings>.. <add key="AppCenterEnabled" value="False" />.. <add key="AppCenterServiceEnabled_analytics" value="False" />.. </appSettings>..</configuration>

                                                                                                              C:\Users\user\AppData\Local\FastestVPN\FastestVPN.exe_Url_eplmg30frbssdwvao0rtvq0jja20avcl\yqrdf5k5.newcfg

                                                                                                              Download File
                                                                                                              Process:C:\Program Files\FastestVPN\FastestVPN.exe
                                                                                                              File Type:XML 1.0 document, ASCII text, with CRLF line terminators
                                                                                                              Category:dropped
                                                                                                              Size (bytes):166
                                                                                                              Entropy (8bit):4.816940765206284
                                                                                                              Encrypted:false
                                                                                                              SSDEEP:
                                                                                                              MD5:90401247D5A6AF2729E2F23FBA0A6351
                                                                                                              SHA1:977D37740A245C9A41AD5B8916C07A699B181A09
                                                                                                              SHA-256:C4622D6EF948D316ED1C28E5BD2EE8CCE28BE710E9815CA67BDFF4C2648AACA4
                                                                                                              SHA-512:1F47BC3EFD2AB121663FF12F753DF519DE18CFDE43C79C475D7CEC32D70AFC7CE8A696EBCE5BA2519CBAA4F58FBEDDEC082B3AC6EFCE50996D54A2975B2C27DE
                                                                                                              Malicious:false
                                                                                                              Preview:<?xml version="1.0" encoding="utf-8"?>..<configuration>.. <appSettings>.. <add key="AppCenterEnabled" value="False" />.. </appSettings>..</configuration>

                                                                                                              C:\Users\user\AppData\Local\FastestVPN\localdata.xml

                                                                                                              Download File
                                                                                                              Process:C:\Program Files\FastestVPN\FastestVPN.exe
                                                                                                              File Type:XML 1.0 document, ASCII text, with CRLF line terminators
                                                                                                              Category:dropped
                                                                                                              Size (bytes):554
                                                                                                              Entropy (8bit):5.190490363715085
                                                                                                              Encrypted:false
                                                                                                              SSDEEP:
                                                                                                              MD5:770A9E878C690857807301C669D8002B
                                                                                                              SHA1:EAEB35A2A438ADEE17B4020D4832355769EB2013
                                                                                                              SHA-256:F54977607FE77962DC2E7CC4FC0AED2990D25A249E58AA9813F42EFD0CF51200
                                                                                                              SHA-512:1E223D5C4213517B3400B887F320E42F19BC3C3F974ED4A4FBFA48157E2D5030BDA6DD9800A477DBE7FD8E76860DC24EE947F1FD9EE67294A5A9A6C1E8666CD3
                                                                                                              Malicious:false
                                                                                                              Preview:<?xml version="1.0" encoding="utf-8"?>..<Settings xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema">.. <SplitTunnelingStatus>false</SplitTunnelingStatus>.. <HasSeenSplitTunneling>false</HasSeenSplitTunneling>.. <ConnectOnLaunch>false</ConnectOnLaunch>.. <EnableAdBlock>false</EnableAdBlock>.. <RedialOnDrop>false</RedialOnDrop>.. <IsIKSEnabled>false</IsIKSEnabled>.. <IsConnectFallbackEnabled>false</IsConnectFallbackEnabled>.. <IsMinimizeLaunchEnabled>false</IsMinimizeLaunchEnabled>..</Settings>

                                                                                                              C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\FastestVPN.WindowsService.exe.log

                                                                                                              Download File
                                                                                                              Process:C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe
                                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                                              Category:modified
                                                                                                              Size (bytes):1803
                                                                                                              Entropy (8bit):5.3407719505798275
                                                                                                              Encrypted:false
                                                                                                              SSDEEP:
                                                                                                              MD5:077007B5E9C8A61A51283FAC0B0B1260
                                                                                                              SHA1:F9EABAC9D0664999C4D46AEB57C99D9041FD7F49
                                                                                                              SHA-256:DD99B5C1E5B54D11E9BE692C4201D18FC5CF4764B5EFFA232EFF142617F9EA2A
                                                                                                              SHA-512:007E65ABAA38E36B0DD4DD58EDFFDD4538B0F6D269F7067FEED2176DE1971EACF39E0E4BCF4365A383765C1DD49DDD2BFFA044EF94A8B50BB4270A17B74411FF
                                                                                                              Malicious:false
                                                                                                              Preview:1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.ServiceProcess, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..3,"System.Configuration.Install, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Confe64a9051#\48ee4ec9441351bbe4d9095c96b8ea01\System.Configuration.Install.ni.dll",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\2192b0d5aa4aa14486ae08118d3b9fcc\System.Configuration.ni.dll",0..3,"System.X

                                                                                                              C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\FastestVPN.exe.log

                                                                                                              Download File
                                                                                                              Process:C:\Program Files\FastestVPN\FastestVPN.exe
                                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                                              Category:dropped
                                                                                                              Size (bytes):1785
                                                                                                              Entropy (8bit):5.341273156781821
                                                                                                              Encrypted:false
                                                                                                              SSDEEP:
                                                                                                              MD5:595CF857FACB9D100C163C39E2F2FE08
                                                                                                              SHA1:BD30AB70391652932B3BE7EF5D84A9B4C617B7FF
                                                                                                              SHA-256:A2E82A1EA4819A2C30BB6C841870CDA86A8DF0DF1B7ED5D18DC707F1B3962995
                                                                                                              SHA-512:A583D205C967908D847EC7EAD1ED1E039E9BAE253406690D71E621108189374E15E4BAE206C492D85E971EEBD18B8B7A621D686802B4D57126DDB4A1CFFE2ADA
                                                                                                              Malicious:false
                                                                                                              Preview:1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..3,"WindowsBase, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35","C:\Windows\assembly\NativeImages_v4.0.30319_32\WindowsBase\4d760e3e4675c4a4c66b64205fb0d001\WindowsBase.ni.dll",0..3,"PresentationCore, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35","C:\Windows\assembly\NativeImages_v4.0.30319_32\PresentationCore\17470ef0c7a174f38bdcadacc3e310ad\PresentationCore.ni.dll",0..3,"PresentationFramework, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35","C:\Windows\assembly\NativeImages_v4.0.30319_32\Presentatio5ae0f00f#\

                                                                                                              C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                                                              Download File
                                                                                                              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                              File Type:data
                                                                                                              Category:dropped
                                                                                                              Size (bytes):1312
                                                                                                              Entropy (8bit):5.395187963236686
                                                                                                              Encrypted:false
                                                                                                              SSDEEP:
                                                                                                              MD5:21B12AEB889D1048E0D7388F1A5DF797
                                                                                                              SHA1:769895D3B723A58A0F2092F714D04E4D3C6A03DA
                                                                                                              SHA-256:452C74988D637E9BB2CE3996C8AA2AD831A3C9D266048A8636C4DF6ABB4E7F3F
                                                                                                              SHA-512:6D2BEB34D397A11D5C42173992EB67E81FC5207F065CA91B4BA9C0FE13553A58412103CEDB873C8D2EB958180B1CC3F64243C5D9F854BBE5BEB814B390634864
                                                                                                              Malicious:false
                                                                                                              Preview:@...e...................................".......................P................1]...E...........(.Microsoft.PowerShell.Commands.ManagementH...............o..b~.D.poM......... .Microsoft.PowerShell.ConsoleHost0......................C.l]..7.s........System..4....................D...{..|f........System.Core.D...............4..7..D.#V.............System.Management.AutomationL.................*gQ?O.....x5.......#.Microsoft.Management.Infrastructure.<................t.,.lG....M...........System.Management...@................z.U..G...5.f.1........System.DirectoryServices4.................%...K... ...........System.Xml..8..................1...L..U;V.<}........System.Numerics.4.....................@.[8]'.\........System.Data.<...............i..VdqF...|...........System.ConfigurationH................WY..2.M.&..g*(g........Microsoft.PowerShell.Security...<...............V.}...@...i...........System.Transactions.D....................+.H..!...e........System.Configuration.Ins

                                                                                                              C:\Users\user\AppData\Local\Temp\2807bd9f

                                                                                                              Download File
                                                                                                              Process:C:\Program Files\FastestVPN\Resources\ComDebug.exe
                                                                                                              File Type:PNG image data, 4064 x 340, 8-bit/color RGB, non-interlaced
                                                                                                              Category:dropped
                                                                                                              Size (bytes):1075019
                                                                                                              Entropy (8bit):7.995986448343732
                                                                                                              Encrypted:true
                                                                                                              SSDEEP:
                                                                                                              MD5:3F4310D49A7F77CAF6BD8BB44914E795
                                                                                                              SHA1:861BE741EBDB486FCD8AF06EC7F478BE8F82B8B1
                                                                                                              SHA-256:0CF1B6B5687415103900DA176EBEE19DC991000E8194D209BC514E00B7861790
                                                                                                              SHA-512:8A05B0A2715EF228AD470977F7C6AAACA03DEE9ADE777CDDA0F89343465A4FF0378196018C96689637C2ADD6853F4EAB20D715AB568C1F237A0017D69D714781
                                                                                                              Malicious:false
                                                                                                              Preview:.PNG........IHDR.......T.....!.S... .IDATx..]y............./h.(&F....Y.b..Q..b.F0...0..@.k...."F.(.....;.q7..*.k.f..k{......W....4../.........s.;..../..D.@...HHHH..d.?....B..PJ!.e......z|).G.../.0d^..A.\....!s)UU...[.E!...0H....o..2oQU5^=..EQ....i......3......i.^.Y].4\..<. H.._.R..i........{...:..y.....*...!.....i...k...R=PT.w>..f.qu..z#.m..[$$.A.}..........B2O.M..$.R..(.....@S.....P.*$.......N.?X.H>.J..W....N M...J.....j.A)...6jQ..Qb.W+..s.U .!....3d- ..B.C..Z...~.3....'...l...R..........H~.....+....H.$..Kt.%j....W..5...t]...V...z...... .W..n....5UQT...".h..@.0...6f.#.G.x. ...........B...5....u.G...EP...:. ..a n.g.|..y...x).76B..?..!.`7...9..*D.@.. ...2s......O.qu.....|.$......V....H.|../G,.(....B....j!.1|..3......._.O1._/I.$.....q.1.O.I.J....W..d.|N....'..........T&....@.O)?.Pa.a `..|.......!J],_.5.:Y>.X...)...H~.! ..F.....Jx....PJ.j....o...]B.......I. ...8...\..Rg.....=..O....H._......4.k..WTES5....xV.=....<.......I>a...)p4]SHeu...0......h$@

                                                                                                              C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_2wu2ctfd.jjo.ps1

                                                                                                              Download File
                                                                                                              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                              File Type:ASCII text, with no line terminators
                                                                                                              Category:dropped
                                                                                                              Size (bytes):60
                                                                                                              Entropy (8bit):4.038920595031593
                                                                                                              Encrypted:false
                                                                                                              SSDEEP:
                                                                                                              MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                                              SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                                              SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                                              SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                                              Malicious:false
                                                                                                              Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                                              C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_saeirdn5.xn2.psm1

                                                                                                              Download File
                                                                                                              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                              File Type:ASCII text, with no line terminators
                                                                                                              Category:dropped
                                                                                                              Size (bytes):60
                                                                                                              Entropy (8bit):4.038920595031593
                                                                                                              Encrypted:false
                                                                                                              SSDEEP:
                                                                                                              MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                                              SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                                              SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                                              SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                                              Malicious:false
                                                                                                              Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                                              C:\Users\user\AppData\Local\Temp\is-28AK4.tmp\_isetup\_setup64.tmp

                                                                                                              Download File
                                                                                                              Process:C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmp
                                                                                                              File Type:PE32+ executable (console) x86-64, for MS Windows
                                                                                                              Category:dropped
                                                                                                              Size (bytes):6144
                                                                                                              Entropy (8bit):4.720366600008286
                                                                                                              Encrypted:false
                                                                                                              SSDEEP:
                                                                                                              MD5:E4211D6D009757C078A9FAC7FF4F03D4
                                                                                                              SHA1:019CD56BA687D39D12D4B13991C9A42EA6BA03DA
                                                                                                              SHA-256:388A796580234EFC95F3B1C70AD4CB44BFDDC7BA0F9203BF4902B9929B136F95
                                                                                                              SHA-512:17257F15D843E88BB78ADCFB48184B8CE22109CC2C99E709432728A392AFAE7B808ED32289BA397207172DE990A354F15C2459B6797317DA8EA18B040C85787E
                                                                                                              Malicious:false
                                                                                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......^...............l...............=\......=\......=\......Rich............................PE..d.....R..........#............................@.............................`.......,......................................................<!.......P..H....@..0.................................................................... ...............................text............................... ..`.rdata..|.... ......................@..@.data...,....0......................@....pdata..0....@......................@..@.rsrc...H....P......................@..@................................................................................................................................................................................................................................................................................................................................

                                                                                                              C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmp

                                                                                                              Download File
                                                                                                              Process:C:\Users\user\Desktop\OqAVRCkQ3T.exe
                                                                                                              File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                              Category:dropped
                                                                                                              Size (bytes):3045888
                                                                                                              Entropy (8bit):6.41066353205617
                                                                                                              Encrypted:false
                                                                                                              SSDEEP:
                                                                                                              MD5:259E3EE4646FC251C3513EEF2683479F
                                                                                                              SHA1:BE09457567F0562E8942A28BD90759F6DCE6DCB5
                                                                                                              SHA-256:BD9F32A9B7B9663A3AFDD1DC0CCC3D6423783B360DB341691FE2FE71C543EC53
                                                                                                              SHA-512:56607419EF2E2F98A8DAA6478DEA4B49925F4A17AB649E450F34331490281E2FCF976F17813F1A80FA460EE258C02901528A43B508093098135C1FADB5902B24
                                                                                                              Malicious:false
                                                                                                              Preview:MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L.....gf..................*...........*.......*...@..........................P/...........@......@...................P,.n.....,.j:....,.$....................................................p,.......................,......@,.(....................text.....*.......*................. ..`.itext..$.....*..0....*............. ..`.data.........*.......*.............@....bss.....|....+..........................idata..j:....,..<...f+.............@....didata.(....@,.......+.............@....edata..n....P,.......+.............@..@.tls....X....`,..........................rdata..]....p,.......+.............@..@.rsrc...$.....,.......+.............@..@.............`0......./.............@..@........................................................

                                                                                                              C:\Users\user\AppData\Local\Temp\{4cb0eb0d-a103-7c4c-aedf-5caef9610c0c}\SETB0B2.tmp

                                                                                                              Download File
                                                                                                              Process:C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exe
                                                                                                              File Type:Windows setup INFormation
                                                                                                              Category:dropped
                                                                                                              Size (bytes):7537
                                                                                                              Entropy (8bit):5.046488463217706
                                                                                                              Encrypted:false
                                                                                                              SSDEEP:
                                                                                                              MD5:50D29CA2E3DDB8A696923420EC2AC4FA
                                                                                                              SHA1:D85F4E65FE10F13DED1780DDBD074EDFC75F2D25
                                                                                                              SHA-256:817DFF7F4944A255A0A33B8D74EB60A755D8D268CC7AFD46FCE41E102E0A004B
                                                                                                              SHA-512:03778A9CDDD23639C88E24BB5D0446DA3A400BB6B3321FB35887CD23D88D0F7AD3FE911642CC7F8D16D29CD9E42106851B0028379E8DBCB3C6721C238FC4A0D3
                                                                                                              Malicious:false
                                                                                                              Preview:; ****************************************************************************..; * Copyright (C) 2002-2014 OpenVPN Technologies, Inc. *..; * This program is free software; you can redistribute it and/or modify *..; * it under the terms of the GNU General Public License version 2 *..; * as published by the Free Software Foundation. *..; ****************************************************************************....; SYNTAX CHECKER..; cd \WINDDK\3790\tools\chkinf..; chkinf c:\src\openvpn\tap-win32\i386\oemvista.inf..; OUTPUT -> file:///c:/WINDDK/3790/tools/chkinf/htm/c%23+src+openvpn+tap-win32+i386+__OemWin2k.htm....; INSTALL/REMOVE DRIVER..; tapinstall install OemVista.inf tapoas..; tapinstall update OemVista.inf tapoas..; tapinstall remove tapoas....;*********************************************************..; Note to Developers:..;..; If you are bundling the TAP-Windows driver with your app,..; you should try

                                                                                                              C:\Users\user\AppData\Local\Temp\{4cb0eb0d-a103-7c4c-aedf-5caef9610c0c}\SETB0C2.tmp

                                                                                                              Download File
                                                                                                              Process:C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exe
                                                                                                              File Type:data
                                                                                                              Category:dropped
                                                                                                              Size (bytes):10711
                                                                                                              Entropy (8bit):7.2254581318251425
                                                                                                              Encrypted:false
                                                                                                              SSDEEP:
                                                                                                              MD5:225E7BA0E5E2D46813E5C858A4D0D5B0
                                                                                                              SHA1:5DD49014764F634164520583FD0CEC87AB1A1625
                                                                                                              SHA-256:B0BAF5CB84FA4ACB34B77A6231052061DA6B8676D216833724B7A602622161FB
                                                                                                              SHA-512:9C77ADF7E71ACA94489DFEB536F796A017B7C05771962274BAE2C614E2AE6799CCEB36CC58AC470184C37F52DEAC75988BB14E6A329F432C6D7CEDBCA18272A8
                                                                                                              Malicious:false
                                                                                                              Preview:0.)...*.H........).0.)....1.0...`.H.e......0..M..+.....7.....>0..:0...+.....7..........dG.'$....g..191023085812Z0...+.....7.....0..T0.... .}..ID.U..;.t.`.U..h.z.F.......K1..0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.:.1.0...0...0<..+.....7...1.0,...F.i.l.e........o.e.m.v.i.s.t.a...i.n.f...0U..+.....7...1G0E0...+.....7.......010...`.H.e....... .}..ID.U..;.t.`.U..h.z.F.......K0....._Ne...=.....N.._-%1..0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.:.1.0...0...0<..+.....7...1.0,...F.i.l.e........o.e.m.v.i.s.t.a...i.n.f...0.....D.......L..S.4..b.1..0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.:.1.0...0...0:..+.....7...1,0*...F.i.l.e........t.a.p.0.9.0.1...s.y.s...0.... .?;..{.x....H..4...k).VB.......1..0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.:.1.0...0...0:..+.....7...1,0*...F.i.l.e........t.a.p.0.9.0.1...s.y.s...0]..+.....7...1O0M0...+.....7...0...........010...`.H.e....... .?;..{.x....H..4...k).VB...........0...0....+.

                                                                                                              C:\Users\user\AppData\Local\Temp\{4cb0eb0d-a103-7c4c-aedf-5caef9610c0c}\SETB0E3.tmp

                                                                                                              Download File
                                                                                                              Process:C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exe
                                                                                                              File Type:PE32+ executable (native) x86-64, for MS Windows
                                                                                                              Category:dropped
                                                                                                              Size (bytes):39920
                                                                                                              Entropy (8bit):6.333649052940754
                                                                                                              Encrypted:false
                                                                                                              SSDEEP:
                                                                                                              MD5:059E578D456043A8C3B76EC365B375F3
                                                                                                              SHA1:42189B6A1B8C736397113BFC2283F5E1E1A44E8E
                                                                                                              SHA-256:A0170CF78105CE757E0549D79E4AE7C412240E8B81D262A24D76A047F181F881
                                                                                                              SHA-512:99E6B6AF018D0E3509D9DBE00301A7D5D6645A2070A8144ACFF04842F8BBACCD81E7651578D08F47639CD2B7D00EB64ACDDFA8725BCE9A073580B7FCF7964E6A
                                                                                                              Malicious:false
                                                                                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........~..[...[...[....w..Z....w..^...[...m....w.._....w..^.../t..Q.../t..Z.../t..Z...Rich[...........................PE..d......].........."......Z.....................@....................................P.....`A....................................................<.......X....p..H....x...#...........R..8............................S...............P...............................text...W>.......@.................. ..h.rdata..|....P.......D..............@..H.data........`.......P..............@....pdata..H....p.......R..............@..HPAGE.................V.............. ..`INIT.................d.............. ..b.rsrc...X............p..............@..B.reloc...............v..............@..B................................................................................................................................................................................

                                                                                                              C:\Users\user\AppData\Local\Temp\{4cb0eb0d-a103-7c4c-aedf-5caef9610c0c}\oemvista.inf (copy)

                                                                                                              Download File
                                                                                                              Process:C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exe
                                                                                                              File Type:Windows setup INFormation
                                                                                                              Category:dropped
                                                                                                              Size (bytes):7537
                                                                                                              Entropy (8bit):5.046488463217706
                                                                                                              Encrypted:false
                                                                                                              SSDEEP:
                                                                                                              MD5:50D29CA2E3DDB8A696923420EC2AC4FA
                                                                                                              SHA1:D85F4E65FE10F13DED1780DDBD074EDFC75F2D25
                                                                                                              SHA-256:817DFF7F4944A255A0A33B8D74EB60A755D8D268CC7AFD46FCE41E102E0A004B
                                                                                                              SHA-512:03778A9CDDD23639C88E24BB5D0446DA3A400BB6B3321FB35887CD23D88D0F7AD3FE911642CC7F8D16D29CD9E42106851B0028379E8DBCB3C6721C238FC4A0D3
                                                                                                              Malicious:false
                                                                                                              Preview:; ****************************************************************************..; * Copyright (C) 2002-2014 OpenVPN Technologies, Inc. *..; * This program is free software; you can redistribute it and/or modify *..; * it under the terms of the GNU General Public License version 2 *..; * as published by the Free Software Foundation. *..; ****************************************************************************....; SYNTAX CHECKER..; cd \WINDDK\3790\tools\chkinf..; chkinf c:\src\openvpn\tap-win32\i386\oemvista.inf..; OUTPUT -> file:///c:/WINDDK/3790/tools/chkinf/htm/c%23+src+openvpn+tap-win32+i386+__OemWin2k.htm....; INSTALL/REMOVE DRIVER..; tapinstall install OemVista.inf tapoas..; tapinstall update OemVista.inf tapoas..; tapinstall remove tapoas....;*********************************************************..; Note to Developers:..;..; If you are bundling the TAP-Windows driver with your app,..; you should try

                                                                                                              C:\Users\user\AppData\Local\Temp\{4cb0eb0d-a103-7c4c-aedf-5caef9610c0c}\tap0901.cat (copy)

                                                                                                              Download File
                                                                                                              Process:C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exe
                                                                                                              File Type:data
                                                                                                              Category:dropped
                                                                                                              Size (bytes):10711
                                                                                                              Entropy (8bit):7.2254581318251425
                                                                                                              Encrypted:false
                                                                                                              SSDEEP:
                                                                                                              MD5:225E7BA0E5E2D46813E5C858A4D0D5B0
                                                                                                              SHA1:5DD49014764F634164520583FD0CEC87AB1A1625
                                                                                                              SHA-256:B0BAF5CB84FA4ACB34B77A6231052061DA6B8676D216833724B7A602622161FB
                                                                                                              SHA-512:9C77ADF7E71ACA94489DFEB536F796A017B7C05771962274BAE2C614E2AE6799CCEB36CC58AC470184C37F52DEAC75988BB14E6A329F432C6D7CEDBCA18272A8
                                                                                                              Malicious:false
                                                                                                              Preview:0.)...*.H........).0.)....1.0...`.H.e......0..M..+.....7.....>0..:0...+.....7..........dG.'$....g..191023085812Z0...+.....7.....0..T0.... .}..ID.U..;.t.`.U..h.z.F.......K1..0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.:.1.0...0...0<..+.....7...1.0,...F.i.l.e........o.e.m.v.i.s.t.a...i.n.f...0U..+.....7...1G0E0...+.....7.......010...`.H.e....... .}..ID.U..;.t.`.U..h.z.F.......K0....._Ne...=.....N.._-%1..0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.:.1.0...0...0<..+.....7...1.0,...F.i.l.e........o.e.m.v.i.s.t.a...i.n.f...0.....D.......L..S.4..b.1..0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.:.1.0...0...0:..+.....7...1,0*...F.i.l.e........t.a.p.0.9.0.1...s.y.s...0.... .?;..{.x....H..4...k).VB.......1..0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.:.1.0...0...0:..+.....7...1,0*...F.i.l.e........t.a.p.0.9.0.1...s.y.s...0]..+.....7...1O0M0...+.....7...0...........010...`.H.e....... .?;..{.x....H..4...k).VB...........0...0....+.

                                                                                                              C:\Users\user\AppData\Local\Temp\{4cb0eb0d-a103-7c4c-aedf-5caef9610c0c}\tap0901.sys (copy)

                                                                                                              Download File
                                                                                                              Process:C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exe
                                                                                                              File Type:PE32+ executable (native) x86-64, for MS Windows
                                                                                                              Category:dropped
                                                                                                              Size (bytes):39920
                                                                                                              Entropy (8bit):6.333649052940754
                                                                                                              Encrypted:false
                                                                                                              SSDEEP:
                                                                                                              MD5:059E578D456043A8C3B76EC365B375F3
                                                                                                              SHA1:42189B6A1B8C736397113BFC2283F5E1E1A44E8E
                                                                                                              SHA-256:A0170CF78105CE757E0549D79E4AE7C412240E8B81D262A24D76A047F181F881
                                                                                                              SHA-512:99E6B6AF018D0E3509D9DBE00301A7D5D6645A2070A8144ACFF04842F8BBACCD81E7651578D08F47639CD2B7D00EB64ACDDFA8725BCE9A073580B7FCF7964E6A
                                                                                                              Malicious:false
                                                                                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........~..[...[...[....w..Z....w..^...[...m....w.._....w..^.../t..Q.../t..Z.../t..Z...Rich[...........................PE..d......].........."......Z.....................@....................................P.....`A....................................................<.......X....p..H....x...#...........R..8............................S...............P...............................text...W>.......@.................. ..h.rdata..|....P.......D..............@..H.data........`.......P..............@....pdata..H....p.......R..............@..HPAGE.................V.............. ..`INIT.................d.............. ..b.rsrc...X............p..............@..B.reloc...............v..............@..B................................................................................................................................................................................

                                                                                                              C:\Users\user\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\FastestVPN.lnk

                                                                                                              Download File
                                                                                                              Process:C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmp
                                                                                                              File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Icon number=0, Archive, ctime=Thu Oct 3 07:37:06 2024, mtime=Thu Oct 3 07:37:19 2024, atime=Thu Jun 27 19:18:16 2024, length=2059432, window=hide
                                                                                                              Category:dropped
                                                                                                              Size (bytes):1771
                                                                                                              Entropy (8bit):3.227982053499729
                                                                                                              Encrypted:false
                                                                                                              SSDEEP:
                                                                                                              MD5:97A0FE942553355B6DDC330204836B9A
                                                                                                              SHA1:7D5E6B7FB0A0B92C0AA72C8FDF927B35BAD2A350
                                                                                                              SHA-256:A1E656717A298188006CFF79FCC72573DD858A4DD667F9A7835CC027073FDC87
                                                                                                              SHA-512:693AEEF82409C364264C9E75E3C6F4153811558CF4B100DACA30C357CD1109203576FEC11305B7A07C6E1042ADFA7A2FA2430E305A90B99D17A23B487E221C35
                                                                                                              Malicious:false
                                                                                                              Preview:L..................F.@.. ...-..mo....{euo......$.....l...........................P.O. .:i.....+00.../C:\.....................1.....CY.D..PROGRA~1..t......O.ICY.D....B...............J.......+.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....^.1.....CY.D..FASTES~1..F......CY.DCY.D..........................GP{.F.a.s.t.e.s.t.V.P.N.....j.2..l...XH. .FASTES~1.EXE..N......CY.DCY.D..............................F.a.s.t.e.s.t.V.P.N...e.x.e.......Y...............-.......X.............q.....C:\Program Files\FastestVPN\FastestVPN.exe..<.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.F.a.s.t.e.s.t.V.P.N.\.F.a.s.t.e.s.t.V.P.N...e.x.e...C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.F.a.s.t.e.s.t.V.P.N.(.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.F.a.s.t.e.s.t.V.P.N.\.a.p.p.-.i.c.o.n...i.c.o.........%SystemDrive%\Program Files\FastestVPN\app-icon.ico...............................................................................................................................

                                                                                                              C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\FastestVPN.lnk

                                                                                                              Download File
                                                                                                              Process:C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmp
                                                                                                              File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Thu Oct 3 07:37:06 2024, mtime=Thu Oct 3 07:37:19 2024, atime=Thu Jun 27 19:18:16 2024, length=2059432, window=hide
                                                                                                              Category:dropped
                                                                                                              Size (bytes):1801
                                                                                                              Entropy (8bit):3.24090319868049
                                                                                                              Encrypted:false
                                                                                                              SSDEEP:
                                                                                                              MD5:C889855095511A119616CD0471793AAE
                                                                                                              SHA1:F474F5E48A6D5DF644E65DA381753B9D15DA2101
                                                                                                              SHA-256:0B49BE4B2F48BB99484D75A87C3A730EE5F0EF953CAB558556BFFE2CDA8D50A4
                                                                                                              SHA-512:AF9803034EAFE481D473C9876C81A53822E59F20B3BFDD0DF4ECE5BED06EF263816089E6B372469F15801AD496DD0713691627FFE003A1A8C6660173D9BEA1F2
                                                                                                              Malicious:false
                                                                                                              Preview:L..................F.@.. ...-..mo...3gquo......$.....l...........................P.O. .:i.....+00.../C:\.....................1.....CY.D..PROGRA~1..t......O.ICY.D....B...............J.......+.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....^.1.....CY.D..FASTES~1..F......CY.DCY.D..........................GP{.F.a.s.t.e.s.t.V.P.N.....j.2..l...XH. .FASTES~1.EXE..N......CY.DCY.D..............................F.a.s.t.e.s.t.V.P.N...e.x.e.......Y...............-.......X.............q.....C:\Program Files\FastestVPN\FastestVPN.exe..B.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.F.a.s.t.e.s.t.V.P.N.\.F.a.s.t.e.s.t.V.P.N...e.x.e...C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.F.a.s.t.e.s.t.V.P.N...-.a.u.t.o.r.u.n.(.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.F.a.s.t.e.s.t.V.P.N.\.a.p.p.-.i.c.o.n...i.c.o.........%SystemDrive%\Program Files\FastestVPN\app-icon.ico.................................................................................................

                                                                                                              C:\Windows\INF\oem4.inf

                                                                                                              Download File
                                                                                                              Process:C:\Windows\System32\drvinst.exe
                                                                                                              File Type:Windows setup INFormation
                                                                                                              Category:dropped
                                                                                                              Size (bytes):7537
                                                                                                              Entropy (8bit):5.046488463217706
                                                                                                              Encrypted:false
                                                                                                              SSDEEP:
                                                                                                              MD5:50D29CA2E3DDB8A696923420EC2AC4FA
                                                                                                              SHA1:D85F4E65FE10F13DED1780DDBD074EDFC75F2D25
                                                                                                              SHA-256:817DFF7F4944A255A0A33B8D74EB60A755D8D268CC7AFD46FCE41E102E0A004B
                                                                                                              SHA-512:03778A9CDDD23639C88E24BB5D0446DA3A400BB6B3321FB35887CD23D88D0F7AD3FE911642CC7F8D16D29CD9E42106851B0028379E8DBCB3C6721C238FC4A0D3
                                                                                                              Malicious:false
                                                                                                              Preview:; ****************************************************************************..; * Copyright (C) 2002-2014 OpenVPN Technologies, Inc. *..; * This program is free software; you can redistribute it and/or modify *..; * it under the terms of the GNU General Public License version 2 *..; * as published by the Free Software Foundation. *..; ****************************************************************************....; SYNTAX CHECKER..; cd \WINDDK\3790\tools\chkinf..; chkinf c:\src\openvpn\tap-win32\i386\oemvista.inf..; OUTPUT -> file:///c:/WINDDK/3790/tools/chkinf/htm/c%23+src+openvpn+tap-win32+i386+__OemWin2k.htm....; INSTALL/REMOVE DRIVER..; tapinstall install OemVista.inf tapoas..; tapinstall update OemVista.inf tapoas..; tapinstall remove tapoas....;*********************************************************..; Note to Developers:..;..; If you are bundling the TAP-Windows driver with your app,..; you should try

                                                                                                              C:\Windows\INF\setupapi.dev.log

                                                                                                              Download File
                                                                                                              Process:C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exe
                                                                                                              File Type:Generic INItialization configuration [BeginLog]
                                                                                                              Category:dropped
                                                                                                              Size (bytes):58729
                                                                                                              Entropy (8bit):5.2043761249669
                                                                                                              Encrypted:false
                                                                                                              SSDEEP:
                                                                                                              MD5:C90EC0BC3E0A0E5E19A52276AB1DA080
                                                                                                              SHA1:D4AF124D28BBABCCBF0B0B69F102AFF57820587A
                                                                                                              SHA-256:E96B5BDB8E69911DD4830E61255F961D88FA4E7CC2727644AE20538CFEDF2976
                                                                                                              SHA-512:E5197384D56337ECF9E21D2BE98995F68887588A17B384D1F0C7084FD86E2F3F1F0C8DA348EB3AA40A48FE2C51031D56E388AADD92322EE5DA12B827BD64F179
                                                                                                              Malicious:false
                                                                                                              Preview:[Device Install Log].. OS Version = 10.0.19045.. Service Pack = 0.0.. Suite = 0x0100.. ProductType = 1.. Architecture = amd64....[BeginLog]....[Boot Session: 2023/10/03 09:57:02.288]....>>> [Setup Import Driver Package - C:\Windows\system32\spool\tools\Microsoft Print To PDF\prnms009.Inf]..>>> Section start 2023/10/03 09:57:37.904.. cmd: C:\Windows\System32\spoolsv.exe.. inf: Provider: Microsoft.. inf: Class GUID: {4D36E979-E325-11CE-BFC1-08002BE10318}.. inf: Driver Version: 06/21/2006,10.0.19041.1806.. inf: Catalog File: prnms009.cat.. ump: Import flags: 0x0000000D.. pol: {Driver package policy check} 09:57:37.920.. pol: {Driver package policy check - exit(0x00000000)} 09:57:37.920.. sto: {Stage Driver Package: C:\Windows\system32\spool\tools\Microsoft Print To PDF\prnms009.Inf} 09:57:37.920.. inf: {Query Configurability: C:\Windows\system32\spool\tools\Microsoft Print To PDF\prnms009.Inf} 09:57:37.920.. inf:

                                                                                                              C:\Windows\Logs\NetSetup\service.0.etl

                                                                                                              Download File
                                                                                                              Process:C:\Windows\System32\svchost.exe
                                                                                                              File Type:data
                                                                                                              Category:dropped
                                                                                                              Size (bytes):524288
                                                                                                              Entropy (8bit):0.4242403965382232
                                                                                                              Encrypted:false
                                                                                                              SSDEEP:
                                                                                                              MD5:A7954F37428F959A3BE7BAEECCA52CD1
                                                                                                              SHA1:AFFFD43829D6C6EBFA28B4703148E983CFBA0285
                                                                                                              SHA-256:D3F2ED6B7AFE1FA8DBC7E969D4800E4D7664DE638C244256844941E65D1DBBBE
                                                                                                              SHA-512:F962AE4CC2D9993F30039534EE88555AE88262C4ED39FB85512453F91F3F876CB1220D5FB1EFED65420E7CC4AEEBD2E88FF334ECDBD6B760943680B808514DEA
                                                                                                              Malicious:false
                                                                                                              Preview:....8...8...........................................!....................................?......................eJ......Xd.|o...Zb..................................................@.t.z.r.e.s...d.l.l.,.-.2.6.2.......................................................@.t.z.r.e.s...d.l.l.,.-.2.6.1...........................................................@K5..............?..............N.e.t.C.f.g.T.r.a.c.e...C.:.\.W.i.n.d.o.w.s.\.L.o.g.s.\.N.e.t.S.e.t.u.p.\.s.e.r.v.i.c.e...0...e.t.l.........P.P..........?..................................................................8.B..?......19041.1.amd64fre.vb_release.191206-1406.....7.@..?.......I.[.8+m.!N8$......NetSetupuser.pdb......4.@..?.........>*.....Nr8..a....NetSetupApi.pdb.db......4.@..?.........E_iC...F........NetSetupSvc.pdb.........4.@..?.........E_iC...F........NetSetupSvc.pdb.............................................................................................................................................................

                                                                                                              C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

                                                                                                              Download File
                                                                                                              Process:C:\Windows\System32\svchost.exe
                                                                                                              File Type:JSON data
                                                                                                              Category:dropped
                                                                                                              Size (bytes):55
                                                                                                              Entropy (8bit):4.306461250274409
                                                                                                              Encrypted:false
                                                                                                              SSDEEP:
                                                                                                              MD5:DCA83F08D448911A14C22EBCACC5AD57
                                                                                                              SHA1:91270525521B7FE0D986DB19747F47D34B6318AD
                                                                                                              SHA-256:2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
                                                                                                              SHA-512:96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
                                                                                                              Malicious:false
                                                                                                              Preview:{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

                                                                                                              C:\Windows\System32\DriverStore\Temp\{eba04833-fdea-4f40-ac46-b79bff73f8ea}\SETB286.tmp

                                                                                                              Download File
                                                                                                              Process:C:\Windows\System32\drvinst.exe
                                                                                                              File Type:Windows setup INFormation
                                                                                                              Category:dropped
                                                                                                              Size (bytes):7537
                                                                                                              Entropy (8bit):5.046488463217706
                                                                                                              Encrypted:false
                                                                                                              SSDEEP:
                                                                                                              MD5:50D29CA2E3DDB8A696923420EC2AC4FA
                                                                                                              SHA1:D85F4E65FE10F13DED1780DDBD074EDFC75F2D25
                                                                                                              SHA-256:817DFF7F4944A255A0A33B8D74EB60A755D8D268CC7AFD46FCE41E102E0A004B
                                                                                                              SHA-512:03778A9CDDD23639C88E24BB5D0446DA3A400BB6B3321FB35887CD23D88D0F7AD3FE911642CC7F8D16D29CD9E42106851B0028379E8DBCB3C6721C238FC4A0D3
                                                                                                              Malicious:false
                                                                                                              Preview:; ****************************************************************************..; * Copyright (C) 2002-2014 OpenVPN Technologies, Inc. *..; * This program is free software; you can redistribute it and/or modify *..; * it under the terms of the GNU General Public License version 2 *..; * as published by the Free Software Foundation. *..; ****************************************************************************....; SYNTAX CHECKER..; cd \WINDDK\3790\tools\chkinf..; chkinf c:\src\openvpn\tap-win32\i386\oemvista.inf..; OUTPUT -> file:///c:/WINDDK/3790/tools/chkinf/htm/c%23+src+openvpn+tap-win32+i386+__OemWin2k.htm....; INSTALL/REMOVE DRIVER..; tapinstall install OemVista.inf tapoas..; tapinstall update OemVista.inf tapoas..; tapinstall remove tapoas....;*********************************************************..; Note to Developers:..;..; If you are bundling the TAP-Windows driver with your app,..; you should try

                                                                                                              C:\Windows\System32\DriverStore\Temp\{eba04833-fdea-4f40-ac46-b79bff73f8ea}\SETB297.tmp

                                                                                                              Download File
                                                                                                              Process:C:\Windows\System32\drvinst.exe
                                                                                                              File Type:data
                                                                                                              Category:dropped
                                                                                                              Size (bytes):10711
                                                                                                              Entropy (8bit):7.2254581318251425
                                                                                                              Encrypted:false
                                                                                                              SSDEEP:
                                                                                                              MD5:225E7BA0E5E2D46813E5C858A4D0D5B0
                                                                                                              SHA1:5DD49014764F634164520583FD0CEC87AB1A1625
                                                                                                              SHA-256:B0BAF5CB84FA4ACB34B77A6231052061DA6B8676D216833724B7A602622161FB
                                                                                                              SHA-512:9C77ADF7E71ACA94489DFEB536F796A017B7C05771962274BAE2C614E2AE6799CCEB36CC58AC470184C37F52DEAC75988BB14E6A329F432C6D7CEDBCA18272A8
                                                                                                              Malicious:false
                                                                                                              Preview:0.)...*.H........).0.)....1.0...`.H.e......0..M..+.....7.....>0..:0...+.....7..........dG.'$....g..191023085812Z0...+.....7.....0..T0.... .}..ID.U..;.t.`.U..h.z.F.......K1..0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.:.1.0...0...0<..+.....7...1.0,...F.i.l.e........o.e.m.v.i.s.t.a...i.n.f...0U..+.....7...1G0E0...+.....7.......010...`.H.e....... .}..ID.U..;.t.`.U..h.z.F.......K0....._Ne...=.....N.._-%1..0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.:.1.0...0...0<..+.....7...1.0,...F.i.l.e........o.e.m.v.i.s.t.a...i.n.f...0.....D.......L..S.4..b.1..0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.:.1.0...0...0:..+.....7...1,0*...F.i.l.e........t.a.p.0.9.0.1...s.y.s...0.... .?;..{.x....H..4...k).VB.......1..0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.:.1.0...0...0:..+.....7...1,0*...F.i.l.e........t.a.p.0.9.0.1...s.y.s...0]..+.....7...1O0M0...+.....7...0...........010...`.H.e....... .?;..{.x....H..4...k).VB...........0...0....+.

                                                                                                              C:\Windows\System32\DriverStore\Temp\{eba04833-fdea-4f40-ac46-b79bff73f8ea}\SETB2A8.tmp

                                                                                                              Download File
                                                                                                              Process:C:\Windows\System32\drvinst.exe
                                                                                                              File Type:PE32+ executable (native) x86-64, for MS Windows
                                                                                                              Category:dropped
                                                                                                              Size (bytes):39920
                                                                                                              Entropy (8bit):6.333649052940754
                                                                                                              Encrypted:false
                                                                                                              SSDEEP:
                                                                                                              MD5:059E578D456043A8C3B76EC365B375F3
                                                                                                              SHA1:42189B6A1B8C736397113BFC2283F5E1E1A44E8E
                                                                                                              SHA-256:A0170CF78105CE757E0549D79E4AE7C412240E8B81D262A24D76A047F181F881
                                                                                                              SHA-512:99E6B6AF018D0E3509D9DBE00301A7D5D6645A2070A8144ACFF04842F8BBACCD81E7651578D08F47639CD2B7D00EB64ACDDFA8725BCE9A073580B7FCF7964E6A
                                                                                                              Malicious:false
                                                                                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........~..[...[...[....w..Z....w..^...[...m....w.._....w..^.../t..Q.../t..Z.../t..Z...Rich[...........................PE..d......].........."......Z.....................@....................................P.....`A....................................................<.......X....p..H....x...#...........R..8............................S...............P...............................text...W>.......@.................. ..h.rdata..|....P.......D..............@..H.data........`.......P..............@....pdata..H....p.......R..............@..HPAGE.................V.............. ..`INIT.................d.............. ..b.rsrc...X............p..............@..B.reloc...............v..............@..B................................................................................................................................................................................

                                                                                                              C:\Windows\System32\DriverStore\Temp\{eba04833-fdea-4f40-ac46-b79bff73f8ea}\oemvista.inf (copy)

                                                                                                              Download File
                                                                                                              Process:C:\Windows\System32\drvinst.exe
                                                                                                              File Type:Windows setup INFormation
                                                                                                              Category:dropped
                                                                                                              Size (bytes):7537
                                                                                                              Entropy (8bit):5.046488463217706
                                                                                                              Encrypted:false
                                                                                                              SSDEEP:
                                                                                                              MD5:50D29CA2E3DDB8A696923420EC2AC4FA
                                                                                                              SHA1:D85F4E65FE10F13DED1780DDBD074EDFC75F2D25
                                                                                                              SHA-256:817DFF7F4944A255A0A33B8D74EB60A755D8D268CC7AFD46FCE41E102E0A004B
                                                                                                              SHA-512:03778A9CDDD23639C88E24BB5D0446DA3A400BB6B3321FB35887CD23D88D0F7AD3FE911642CC7F8D16D29CD9E42106851B0028379E8DBCB3C6721C238FC4A0D3
                                                                                                              Malicious:false
                                                                                                              Preview:; ****************************************************************************..; * Copyright (C) 2002-2014 OpenVPN Technologies, Inc. *..; * This program is free software; you can redistribute it and/or modify *..; * it under the terms of the GNU General Public License version 2 *..; * as published by the Free Software Foundation. *..; ****************************************************************************....; SYNTAX CHECKER..; cd \WINDDK\3790\tools\chkinf..; chkinf c:\src\openvpn\tap-win32\i386\oemvista.inf..; OUTPUT -> file:///c:/WINDDK/3790/tools/chkinf/htm/c%23+src+openvpn+tap-win32+i386+__OemWin2k.htm....; INSTALL/REMOVE DRIVER..; tapinstall install OemVista.inf tapoas..; tapinstall update OemVista.inf tapoas..; tapinstall remove tapoas....;*********************************************************..; Note to Developers:..;..; If you are bundling the TAP-Windows driver with your app,..; you should try

                                                                                                              C:\Windows\System32\DriverStore\Temp\{eba04833-fdea-4f40-ac46-b79bff73f8ea}\tap0901.cat (copy)

                                                                                                              Download File
                                                                                                              Process:C:\Windows\System32\drvinst.exe
                                                                                                              File Type:data
                                                                                                              Category:dropped
                                                                                                              Size (bytes):10711
                                                                                                              Entropy (8bit):7.2254581318251425
                                                                                                              Encrypted:false
                                                                                                              SSDEEP:
                                                                                                              MD5:225E7BA0E5E2D46813E5C858A4D0D5B0
                                                                                                              SHA1:5DD49014764F634164520583FD0CEC87AB1A1625
                                                                                                              SHA-256:B0BAF5CB84FA4ACB34B77A6231052061DA6B8676D216833724B7A602622161FB
                                                                                                              SHA-512:9C77ADF7E71ACA94489DFEB536F796A017B7C05771962274BAE2C614E2AE6799CCEB36CC58AC470184C37F52DEAC75988BB14E6A329F432C6D7CEDBCA18272A8
                                                                                                              Malicious:false
                                                                                                              Preview:0.)...*.H........).0.)....1.0...`.H.e......0..M..+.....7.....>0..:0...+.....7..........dG.'$....g..191023085812Z0...+.....7.....0..T0.... .}..ID.U..;.t.`.U..h.z.F.......K1..0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.:.1.0...0...0<..+.....7...1.0,...F.i.l.e........o.e.m.v.i.s.t.a...i.n.f...0U..+.....7...1G0E0...+.....7.......010...`.H.e....... .}..ID.U..;.t.`.U..h.z.F.......K0....._Ne...=.....N.._-%1..0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.:.1.0...0...0<..+.....7...1.0,...F.i.l.e........o.e.m.v.i.s.t.a...i.n.f...0.....D.......L..S.4..b.1..0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.:.1.0...0...0:..+.....7...1,0*...F.i.l.e........t.a.p.0.9.0.1...s.y.s...0.... .?;..{.x....H..4...k).VB.......1..0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.:.1.0...0...0:..+.....7...1,0*...F.i.l.e........t.a.p.0.9.0.1...s.y.s...0]..+.....7...1O0M0...+.....7...0...........010...`.H.e....... .?;..{.x....H..4...k).VB...........0...0....+.

                                                                                                              C:\Windows\System32\DriverStore\Temp\{eba04833-fdea-4f40-ac46-b79bff73f8ea}\tap0901.sys (copy)

                                                                                                              Download File
                                                                                                              Process:C:\Windows\System32\drvinst.exe
                                                                                                              File Type:PE32+ executable (native) x86-64, for MS Windows
                                                                                                              Category:dropped
                                                                                                              Size (bytes):39920
                                                                                                              Entropy (8bit):6.333649052940754
                                                                                                              Encrypted:false
                                                                                                              SSDEEP:
                                                                                                              MD5:059E578D456043A8C3B76EC365B375F3
                                                                                                              SHA1:42189B6A1B8C736397113BFC2283F5E1E1A44E8E
                                                                                                              SHA-256:A0170CF78105CE757E0549D79E4AE7C412240E8B81D262A24D76A047F181F881
                                                                                                              SHA-512:99E6B6AF018D0E3509D9DBE00301A7D5D6645A2070A8144ACFF04842F8BBACCD81E7651578D08F47639CD2B7D00EB64ACDDFA8725BCE9A073580B7FCF7964E6A
                                                                                                              Malicious:false
                                                                                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........~..[...[...[....w..Z....w..^...[...m....w.._....w..^.../t..Q.../t..Z.../t..Z...Rich[...........................PE..d......].........."......Z.....................@....................................P.....`A....................................................<.......X....p..H....x...#...........R..8............................S...............P...............................text...W>.......@.................. ..h.rdata..|....P.......D..............@..H.data........`.......P..............@....pdata..H....p.......R..............@..HPAGE.................V.............. ..`INIT.................d.............. ..b.rsrc...X............p..............@..B.reloc...............v..............@..B................................................................................................................................................................................

                                                                                                              C:\Windows\System32\catroot2\dberr.txt

                                                                                                              Download File
                                                                                                              Process:C:\Windows\System32\drvinst.exe
                                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                                              Category:modified
                                                                                                              Size (bytes):3474
                                                                                                              Entropy (8bit):5.365714562912857
                                                                                                              Encrypted:false
                                                                                                              SSDEEP:
                                                                                                              MD5:64335833BF4DA66CE9ABD3BEB620A28B
                                                                                                              SHA1:E95531D6EF4ACF5758F46807A4BC62F85826D954
                                                                                                              SHA-256:ECF9221D072DEC3AC3C8B9430E323C46546F3E742D51AD5DA3FDCD9640397A04
                                                                                                              SHA-512:91FA12634FD721AC28AD47AF0EC75FE38C7407A381B27FE638F8A76F254AA2E9543BDAFCD66434CF423D8AEEA202D521A51A7DC79CD98530CE9848DE737C19A2
                                                                                                              Malicious:false
                                                                                                              Preview:CatalogDB: 08:57:12 03/10/2023: catdbsvc.cpp at line #6041 encountered JET error -1409..CatalogDB: 08:57:12 03/10/2023: catdbsvc.cpp at line #6699 encountered JET error -1409..CatalogDB: 08:57:12 03/10/2023: catdbsvc.cpp at line #4398 encountered JET error -1409..CatalogDB: 08:57:12 03/10/2023: catdbsvc.cpp at line #6041 encountered JET error -1409..CatalogDB: 08:57:12 03/10/2023: catdbsvc.cpp at line #6699 encountered JET error -1409..CatalogDB: 08:57:12 03/10/2023: catdbsvc.cpp at line #4398 encountered JET error -1409..CatalogDB: 08:57:12 03/10/2023: catdbsvc.cpp at line #2083 encountered JET error -1409..CatalogDB: 08:57:12 03/10/2023: catdbsvc.cpp at line #2459 encountered JET error -1409..CatalogDB: 08:57:12 03/10/2023: SyncAllDBs Corruption or Schema Change..CatalogDB: 08:57:12 03/10/2023: catdbsvc.cpp at line #891 encountered JET error -1409..CatalogDB: 08:57:12 03/10/2023: catdbsvc.cpp at line #1307 encountered JET error -1601..CatalogDB: 08:57:12 03/10/2023: SyncDB:: Sync sta

                                                                                                              C:\Windows\System32\drivers\SETBA95.tmp

                                                                                                              Download File
                                                                                                              Process:C:\Windows\System32\drvinst.exe
                                                                                                              File Type:PE32+ executable (native) x86-64, for MS Windows
                                                                                                              Category:dropped
                                                                                                              Size (bytes):39920
                                                                                                              Entropy (8bit):6.333649052940754
                                                                                                              Encrypted:false
                                                                                                              SSDEEP:
                                                                                                              MD5:059E578D456043A8C3B76EC365B375F3
                                                                                                              SHA1:42189B6A1B8C736397113BFC2283F5E1E1A44E8E
                                                                                                              SHA-256:A0170CF78105CE757E0549D79E4AE7C412240E8B81D262A24D76A047F181F881
                                                                                                              SHA-512:99E6B6AF018D0E3509D9DBE00301A7D5D6645A2070A8144ACFF04842F8BBACCD81E7651578D08F47639CD2B7D00EB64ACDDFA8725BCE9A073580B7FCF7964E6A
                                                                                                              Malicious:false
                                                                                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........~..[...[...[....w..Z....w..^...[...m....w.._....w..^.../t..Q.../t..Z.../t..Z...Rich[...........................PE..d......].........."......Z.....................@....................................P.....`A....................................................<.......X....p..H....x...#...........R..8............................S...............P...............................text...W>.......@.................. ..h.rdata..|....P.......D..............@..H.data........`.......P..............@....pdata..H....p.......R..............@..HPAGE.................V.............. ..`INIT.................d.............. ..b.rsrc...X............p..............@..B.reloc...............v..............@..B................................................................................................................................................................................

                                                                                                              C:\Windows\System32\drivers\fastestvpndriver.sys

                                                                                                              Download File
                                                                                                              Process:C:\Windows\System32\xcopy.exe
                                                                                                              File Type:PE32+ executable (native) x86-64, for MS Windows
                                                                                                              Category:dropped
                                                                                                              Size (bytes):104424
                                                                                                              Entropy (8bit):6.366713641084616
                                                                                                              Encrypted:false
                                                                                                              SSDEEP:
                                                                                                              MD5:95FD4F27F82A9E4D6E2A53AF7A9096E6
                                                                                                              SHA1:5F772C89901841AF1814C858359AC5FEB9BE3C24
                                                                                                              SHA-256:98CD2F27906E4FD7FA7FBE0EC747BADEF710BCA736A1AC5EE883756F2185818C
                                                                                                              SHA-512:6B2E2BA90B33F6658C903203317299057C83545D46549D468CDAA1D6F7BCE887310411B9BF6EEA9D19C214A2041BB5E14FD9395CC4E2FE9FC31AB03B88A75019
                                                                                                              Malicious:false
                                                                                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......>.d.z...z...z.....~...z.........}.....}...Y@..s....A..{....A..{...Richz...........................PE..d... [.\.........."..........L.................@....................................C.....`.................................................8p..P.......H....`.......R...E..........`#..8............................(..p............ ..`............................text...d........................... ..h.rdata....... ......................@..H.data...@....@.......$..............@....pdata.......`.......,..............@..HINIT.........p.......:.............. ....rsrc...H............J..............@..B.reloc...............P..............@..B................................................................................................................................................................................................................................

                                                                                                              C:\Windows\System32\drivers\tap0901.sys (copy)

                                                                                                              Download File
                                                                                                              Process:C:\Windows\System32\drvinst.exe
                                                                                                              File Type:PE32+ executable (native) x86-64, for MS Windows
                                                                                                              Category:dropped
                                                                                                              Size (bytes):39920
                                                                                                              Entropy (8bit):6.333649052940754
                                                                                                              Encrypted:false
                                                                                                              SSDEEP:
                                                                                                              MD5:059E578D456043A8C3B76EC365B375F3
                                                                                                              SHA1:42189B6A1B8C736397113BFC2283F5E1E1A44E8E
                                                                                                              SHA-256:A0170CF78105CE757E0549D79E4AE7C412240E8B81D262A24D76A047F181F881
                                                                                                              SHA-512:99E6B6AF018D0E3509D9DBE00301A7D5D6645A2070A8144ACFF04842F8BBACCD81E7651578D08F47639CD2B7D00EB64ACDDFA8725BCE9A073580B7FCF7964E6A
                                                                                                              Malicious:false
                                                                                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........~..[...[...[....w..Z....w..^...[...m....w.._....w..^.../t..Q.../t..Z.../t..Z...Rich[...........................PE..d......].........."......Z.....................@....................................P.....`A....................................................<.......X....p..H....x...#...........R..8............................S...............P...............................text...W>.......@.................. ..h.rdata..|....P.......D..............@..H.data........`.......P..............@....pdata..H....p.......R..............@..HPAGE.................V.............. ..`INIT.................d.............. ..b.rsrc...X............p..............@..B.reloc...............v..............@..B................................................................................................................................................................................

                                                                                                              C:\Windows\appcompat\Programs\Amcache.hve

                                                                                                              Download File
                                                                                                              Process:C:\Windows\SysWOW64\WerFault.exe
                                                                                                              File Type:MS Windows registry file, NT/2000 or above
                                                                                                              Category:dropped
                                                                                                              Size (bytes):1835008
                                                                                                              Entropy (8bit):4.468989466974875
                                                                                                              Encrypted:false
                                                                                                              SSDEEP:
                                                                                                              MD5:AA84C9682FBF514CE6D9E01D9BD5AC45
                                                                                                              SHA1:9B1E8BA452B06D1B72FF861A5941AC00A1F4E402
                                                                                                              SHA-256:313A7689082FC8FACA61B7844A26C3D051C433688183E3B9D7B2C23ADEDCB135
                                                                                                              SHA-512:BD908855F320E32AF55EBA8F460A1B912858EAB929B438EE33513AEF685CA76034A085FCB0F52101A655CDCA6EB03F23B096AA4E66CC6C2AF77C04C046E4F1BC
                                                                                                              Malicious:false
                                                                                                              Preview:regfH...H....\.Z.................... ...........\.A.p.p.C.o.m.p.a.t.\.P.r.o.g.r.a.m.s.\.A.m.c.a.c.h.e...h.v.e....c...b...#.......c...b...#...........c...b...#......rmtm...}o.................................................................................................................................................................................................................................................................................................................................................I........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                              \Device\ConDrv

                                                                                                              Download File
                                                                                                              Process:C:\Program Files\FastestVPN\subinacl.exe
                                                                                                              File Type:ASCII text
                                                                                                              Category:dropped
                                                                                                              Size (bytes):133
                                                                                                              Entropy (8bit):4.004784065185313
                                                                                                              Encrypted:false
                                                                                                              SSDEEP:
                                                                                                              MD5:CE8AE87D7F83FA032F2A60AB0B8F0FE4
                                                                                                              SHA1:203E8416D17D3A9E03509009A8F20F94C51C0381
                                                                                                              SHA-256:F3617B3A17F48864D33A4C32D4F9AE862B23E07F35504C8D4DBE79AC589D395D
                                                                                                              SHA-512:091E97EA19CCF4D6870F8EA861DCCC0F87E4928AC39C64A2AA1085C94EAE5F6707919A18FB3A56EE94F7483950F34128E7E8D321129F810C0847F3493F269682
                                                                                                              Malicious:false
                                                                                                              Preview:.Elapsed Time: 00 00:00:00.Done: 1, Modified 1, Failed 0, Syntax errors 0.Last Done : FastestVPNService.

                                                                                                              Static File Info

                                                                                                              General

                                                                                                              File type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                              Entropy (8bit):7.996342803371446
                                                                                                              TrID:
                                                                                                              • Win32 Executable (generic) a (10002005/4) 98.45%
                                                                                                              • Inno Setup installer (109748/4) 1.08%
                                                                                                              • Win32 EXE PECompact compressed (generic) (41571/9) 0.41%
                                                                                                              • Win16/32 Executable Delphi generic (2074/23) 0.02%
                                                                                                              • Generic Win/DOS Executable (2004/3) 0.02%
                                                                                                              File name:OqAVRCkQ3T.exe
                                                                                                              File size:30'699'768 bytes
                                                                                                              MD5:6d6a207d5513fa5ac6ead647f5d66a6a
                                                                                                              SHA1:913e0d1aadbc1593b76f6442bb89070bc4a5e224
                                                                                                              SHA256:649ec4858e572e0145e35a9faa712708949b7bb1bce1594154cda580d80a0ca9
                                                                                                              SHA512:ba7afc2ed1989758fa6da17407d81cf81c93fe3d0c7f896c03c2ac793551a3d9c26915d9f93d658644b7429647bb0a913d0e438ce6c429700cd8e2d998d0eace
                                                                                                              SSDEEP:786432:lEKDCFe7MJ0y1mLlV8zKFT8ZQ2eoq6QY09C1a:lEACM7MfsL0KFT12eSr09Ck
                                                                                                              TLSH:63673322B2C7E53EF0591FB306A2E050A4F76E516512FD5789F8B878CF314622D3E61A
                                                                                                              File Content Preview:MZP.....................@...............................................!..L.!..This program must be run under Win32..$7.......................................................................................................................................

                                                                                                              File Icon

                                                                                                              Icon Hash:701e0760791c0641

                                                                                                              Static PE Info

                                                                                                              General

                                                                                                              Entrypoint:0x4a83bc
                                                                                                              Entrypoint Section:.itext
                                                                                                              Digitally signed:true
                                                                                                              Imagebase:0x400000
                                                                                                              Subsystem:windows gui
                                                                                                              Image File Characteristics:RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE
                                                                                                              DLL Characteristics:DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
                                                                                                              Time Stamp:0x666711EF [Mon Jun 10 14:47:11 2024 UTC]
                                                                                                              TLS Callbacks:
                                                                                                              CLR (.Net) Version:
                                                                                                              OS Version Major:6
                                                                                                              OS Version Minor:1
                                                                                                              File Version Major:6
                                                                                                              File Version Minor:1
                                                                                                              Subsystem Version Major:6
                                                                                                              Subsystem Version Minor:1
                                                                                                              Import Hash:40ab50289f7ef5fae60801f88d4541fc

                                                                                                              Authenticode Signature

                                                                                                              Signature Valid:true
                                                                                                              Signature Issuer:CN=SSL.com EV Code Signing Intermediate CA RSA R3, O=SSL Corp, L=Houston, S=Texas, C=US
                                                                                                              Signature Validation Error:The operation completed successfully
                                                                                                              Error Number:0
                                                                                                              Not Before, Not After
                                                                                                              • 15/01/2024 21:45:41 14/01/2025 21:45:41
                                                                                                              Subject Chain
                                                                                                              • OID.1.3.6.1.4.1.311.60.2.1.3=CA, OID.2.5.4.15=Private Organization, CN=Acira Consulting Inc., SERIALNUMBER=987024-5, O=Acira Consulting Inc., L=Mississauga, S=Ontario, C=CA
                                                                                                              Version:3
                                                                                                              Thumbprint MD5:4C9BC68042EB932BDCEC05026258C237
                                                                                                              Thumbprint SHA-1:A70AB688FF0A7C3A22B030FBFFA8B56DC31F650A
                                                                                                              Thumbprint SHA-256:49EB14C9EFDE16BD0546A80F058C7D10871ADACFD3B550A4F7007080377DA3BA
                                                                                                              Serial:748A88467D46DF98B5246AFC4F5EEC64

                                                                                                              Entrypoint Preview

                                                                                                              Instruction
                                                                                                              push ebp
                                                                                                              mov ebp, esp
                                                                                                              add esp, FFFFFFA4h
                                                                                                              push ebx
                                                                                                              push esi
                                                                                                              push edi
                                                                                                              xor eax, eax
                                                                                                              mov dword ptr [ebp-3Ch], eax
                                                                                                              mov dword ptr [ebp-40h], eax
                                                                                                              mov dword ptr [ebp-5Ch], eax
                                                                                                              mov dword ptr [ebp-30h], eax
                                                                                                              mov dword ptr [ebp-38h], eax
                                                                                                              mov dword ptr [ebp-34h], eax
                                                                                                              mov dword ptr [ebp-2Ch], eax
                                                                                                              mov dword ptr [ebp-28h], eax
                                                                                                              mov dword ptr [ebp-14h], eax
                                                                                                              mov eax, 004A2EBCh
                                                                                                              call 00007FE984D43645h
                                                                                                              xor eax, eax
                                                                                                              push ebp
                                                                                                              push 004A8AC1h
                                                                                                              push dword ptr fs:[eax]
                                                                                                              mov dword ptr fs:[eax], esp
                                                                                                              xor edx, edx
                                                                                                              push ebp
                                                                                                              push 004A8A7Bh
                                                                                                              push dword ptr fs:[edx]
                                                                                                              mov dword ptr fs:[edx], esp
                                                                                                              mov eax, dword ptr [004B0634h]
                                                                                                              call 00007FE984DD4FCBh
                                                                                                              call 00007FE984DD4B1Eh
                                                                                                              lea edx, dword ptr [ebp-14h]
                                                                                                              xor eax, eax
                                                                                                              call 00007FE984DCF7F8h
                                                                                                              mov edx, dword ptr [ebp-14h]
                                                                                                              mov eax, 004B41F4h
                                                                                                              call 00007FE984D3D6F3h
                                                                                                              push 00000002h
                                                                                                              push 00000000h
                                                                                                              push 00000001h
                                                                                                              mov ecx, dword ptr [004B41F4h]
                                                                                                              mov dl, 01h
                                                                                                              mov eax, dword ptr [0049CD14h]
                                                                                                              call 00007FE984DD0B23h
                                                                                                              mov dword ptr [004B41F8h], eax
                                                                                                              xor edx, edx
                                                                                                              push ebp
                                                                                                              push 004A8A27h
                                                                                                              push dword ptr fs:[edx]
                                                                                                              mov dword ptr fs:[edx], esp
                                                                                                              call 00007FE984DD5053h
                                                                                                              mov dword ptr [004B4200h], eax
                                                                                                              mov eax, dword ptr [004B4200h]
                                                                                                              cmp dword ptr [eax+0Ch], 01h
                                                                                                              jne 00007FE984DDBD3Ah
                                                                                                              mov eax, dword ptr [004B4200h]
                                                                                                              mov edx, 00000028h
                                                                                                              call 00007FE984DD1418h
                                                                                                              mov edx, dword ptr [004B4200h]

                                                                                                              Data Directories

                                                                                                              NameVirtual AddressVirtual Size Is in Section
                                                                                                              IMAGE_DIRECTORY_ENTRY_EXPORT0xb70000x71.edata
                                                                                                              IMAGE_DIRECTORY_ENTRY_IMPORT0xb50000xfec.idata
                                                                                                              IMAGE_DIRECTORY_ENTRY_RESOURCE0xba0000x7088.rsrc
                                                                                                              IMAGE_DIRECTORY_ENTRY_EXCEPTION0x00x0
                                                                                                              IMAGE_DIRECTORY_ENTRY_SECURITY0x1d44aa80x2650
                                                                                                              IMAGE_DIRECTORY_ENTRY_BASERELOC0x00x0
                                                                                                              IMAGE_DIRECTORY_ENTRY_DEBUG0x00x0
                                                                                                              IMAGE_DIRECTORY_ENTRY_COPYRIGHT0x00x0
                                                                                                              IMAGE_DIRECTORY_ENTRY_GLOBALPTR0x00x0
                                                                                                              IMAGE_DIRECTORY_ENTRY_TLS0xb90000x18.rdata
                                                                                                              IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG0x00x0
                                                                                                              IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT0x00x0
                                                                                                              IMAGE_DIRECTORY_ENTRY_IAT0xb52d40x25c.idata
                                                                                                              IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT0xb60000x1a4.didata
                                                                                                              IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR0x00x0
                                                                                                              IMAGE_DIRECTORY_ENTRY_RESERVED0x00x0

                                                                                                              Sections

                                                                                                              NameVirtual AddressVirtual SizeRaw SizeMD5Xored PEZLIB ComplexityFile TypeEntropyCharacteristics
                                                                                                              .text0x10000xa568c0xa5800b889d302f6fc48a904de33d8d947ae80False0.3620185045317221data6.377190161826806IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
                                                                                                              .itext0xa70000x1b640x1c00588dd0a8ab499300d3701cbd11b017d9False0.548828125data6.109264411030635IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
                                                                                                              .data0xa90000x38380x3a005c0c76e77aef52ebc6702430837ccb6eFalse0.35338092672413796data4.95916338709992IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
                                                                                                              .bss0xad0000x72580x0d41d8cd98f00b204e9800998ecf8427eFalse0empty0.0IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
                                                                                                              .idata0xb50000xfec0x1000627340dff539ef99048969aa4824fb2dFalse0.380615234375data5.020404933181373IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
                                                                                                              .didata0xb60000x1a40x200fd11c1109737963cc6cb7258063abfd6False0.34765625data2.729290535217263IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
                                                                                                              .edata0xb70000x710x2007de8ca0c7a61668a728fd3a88dc0942dFalse0.1796875data1.305578535725827IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                                                                                              .tls0xb80000x180x0d41d8cd98f00b204e9800998ecf8427eFalse0empty0.0IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
                                                                                                              .rdata0xb90000x5d0x200d84006640084dc9f74a07c2ff9c7d656False0.189453125data1.3892750148744617IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                                                                                              .rsrc0xba0000x70880x7200549b47e0a2b698414657cad4df93aaa2False0.2584978070175439data4.423634621918959IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

                                                                                                              Resources

                                                                                                              NameRVASizeTypeLanguageCountryZLIB Complexity
                                                                                                              RT_ICON0xba4980x468Device independent bitmap graphic, 16 x 32 x 32, image size 1088EnglishUnited States0.3980496453900709
                                                                                                              RT_ICON0xba9000x10a8Device independent bitmap graphic, 32 x 64 x 32, image size 4224EnglishUnited States0.274155722326454
                                                                                                              RT_ICON0xbb9a80x25a8Device independent bitmap graphic, 48 x 96 x 32, image size 9600EnglishUnited States0.16514522821576763
                                                                                                              RT_STRING0xbdf500x3f8data0.3198818897637795
                                                                                                              RT_STRING0xbe3480x2dcdata0.36475409836065575
                                                                                                              RT_STRING0xbe6240x430data0.40578358208955223
                                                                                                              RT_STRING0xbea540x44cdata0.38636363636363635
                                                                                                              RT_STRING0xbeea00x2d4data0.39226519337016574
                                                                                                              RT_STRING0xbf1740xb8data0.6467391304347826
                                                                                                              RT_STRING0xbf22c0x9cdata0.6410256410256411
                                                                                                              RT_STRING0xbf2c80x374data0.4230769230769231
                                                                                                              RT_STRING0xbf63c0x398data0.3358695652173913
                                                                                                              RT_STRING0xbf9d40x368data0.3795871559633027
                                                                                                              RT_STRING0xbfd3c0x2a4data0.4275147928994083
                                                                                                              RT_RCDATA0xbffe00x10data1.5
                                                                                                              RT_RCDATA0xbfff00x310data0.6173469387755102
                                                                                                              RT_RCDATA0xc03000x2cdata1.1818181818181819
                                                                                                              RT_GROUP_ICON0xc032c0x30dataEnglishUnited States0.9166666666666666
                                                                                                              RT_VERSION0xc035c0x584dataEnglishUnited States0.25
                                                                                                              RT_MANIFEST0xc08e00x7a8XML 1.0 document, ASCII text, with CRLF line terminatorsEnglishUnited States0.3377551020408163

                                                                                                              Imports

                                                                                                              DLLImport
                                                                                                              kernel32.dllGetACP, GetExitCodeProcess, CloseHandle, LocalFree, SizeofResource, VirtualProtect, QueryPerformanceFrequency, VirtualFree, GetFullPathNameW, GetProcessHeap, ExitProcess, HeapAlloc, GetCPInfoExW, RtlUnwind, GetCPInfo, GetStdHandle, GetModuleHandleW, FreeLibrary, HeapDestroy, ReadFile, CreateProcessW, GetLastError, GetModuleFileNameW, SetLastError, FindResourceW, CreateThread, CompareStringW, LoadLibraryA, ResetEvent, GetVolumeInformationW, GetVersion, GetDriveTypeW, RaiseException, FormatMessageW, SwitchToThread, GetExitCodeThread, GetCurrentThread, LoadLibraryExW, LockResource, GetCurrentThreadId, UnhandledExceptionFilter, VirtualQuery, VirtualQueryEx, Sleep, EnterCriticalSection, SetFilePointer, LoadResource, SuspendThread, GetTickCount, GetFileSize, GetStartupInfoW, GetFileAttributesW, InitializeCriticalSection, GetSystemWindowsDirectoryW, GetThreadPriority, SetThreadPriority, GetCurrentProcess, VirtualAlloc, GetCommandLineW, GetSystemInfo, LeaveCriticalSection, GetProcAddress, ResumeThread, GetVersionExW, VerifyVersionInfoW, HeapCreate, GetWindowsDirectoryW, LCMapStringW, VerSetConditionMask, GetDiskFreeSpaceW, FindFirstFileW, GetUserDefaultUILanguage, lstrlenW, QueryPerformanceCounter, SetEndOfFile, HeapFree, WideCharToMultiByte, FindClose, MultiByteToWideChar, LoadLibraryW, SetEvent, CreateFileW, GetLocaleInfoW, GetSystemDirectoryW, DeleteFileW, GetLocalTime, GetEnvironmentVariableW, WaitForSingleObject, WriteFile, ExitThread, DeleteCriticalSection, TlsGetValue, GetDateFormatW, SetErrorMode, IsValidLocale, TlsSetValue, CreateDirectoryW, GetSystemDefaultUILanguage, EnumCalendarInfoW, LocalAlloc, GetUserDefaultLangID, RemoveDirectoryW, CreateEventW, SetThreadLocale, GetThreadLocale
                                                                                                              comctl32.dllInitCommonControls
                                                                                                              user32.dllCreateWindowExW, TranslateMessage, CharLowerBuffW, CallWindowProcW, CharUpperW, PeekMessageW, GetSystemMetrics, SetWindowLongW, MessageBoxW, DestroyWindow, CharUpperBuffW, CharNextW, MsgWaitForMultipleObjects, LoadStringW, ExitWindowsEx, DispatchMessageW
                                                                                                              oleaut32.dllSysAllocStringLen, SafeArrayPtrOfIndex, VariantCopy, SafeArrayGetLBound, SafeArrayGetUBound, VariantInit, VariantClear, SysFreeString, SysReAllocStringLen, VariantChangeType, SafeArrayCreate
                                                                                                              advapi32.dllConvertStringSecurityDescriptorToSecurityDescriptorW, OpenThreadToken, AdjustTokenPrivileges, LookupPrivilegeValueW, RegOpenKeyExW, OpenProcessToken, FreeSid, AllocateAndInitializeSid, EqualSid, RegQueryValueExW, GetTokenInformation, ConvertSidToStringSidW, RegCloseKey

                                                                                                              Exports

                                                                                                              NameOrdinalAddress
                                                                                                              __dbk_fcall_wrapper20x40fc10
                                                                                                              dbkFCallWrapperAddr10x4b063c

                                                                                                              Possible Origin

                                                                                                              Language of compilation systemCountry where language is spokenMap
                                                                                                              EnglishUnited States

                                                                                                              Network Behavior

                                                                                                              DNS Answers

                                                                                                              TimestampSource IPDest IPTrans IDReply CodeNameCNameAddressTypeClassDNS over HTTPS
                                                                                                              Oct 3, 2024 10:37:44.400207043 CEST1.1.1.1192.168.2.60x11fbNo error (0)fp2e7a.wpc.2be4.phicdn.netfp2e7a.wpc.phicdn.netCNAME (Canonical name)IN (0x0001)false
                                                                                                              Oct 3, 2024 10:37:44.400207043 CEST1.1.1.1192.168.2.60x11fbNo error (0)fp2e7a.wpc.phicdn.net192.229.221.95A (IP address)IN (0x0001)false

                                                                                                              Statistics

                                                                                                              CPU Usage

                                                                                                              Click to jump to process

                                                                                                              Memory Usage

                                                                                                              Click to jump to process

                                                                                                              High Level Behavior Distribution

                                                                                                              Click to dive into process behavior distribution

                                                                                                              Behavior

                                                                                                              Click to jump to process

                                                                                                              System Behavior

                                                                                                              General

                                                                                                              Target ID:0
                                                                                                              Start time:04:36:39
                                                                                                              Start date:03/10/2024
                                                                                                              Path:C:\Users\user\Desktop\OqAVRCkQ3T.exe
                                                                                                              Wow64 process (32bit):true
                                                                                                              Commandline:"C:\Users\user\Desktop\OqAVRCkQ3T.exe"
                                                                                                              Imagebase:0x400000
                                                                                                              File size:30'699'768 bytes
                                                                                                              MD5 hash:6D6A207D5513FA5AC6EAD647F5D66A6A
                                                                                                              Has elevated privileges:true
                                                                                                              Has administrator privileges:true
                                                                                                              Programmed in:Borland Delphi
                                                                                                              Reputation:low
                                                                                                              Has exited:true

                                                                                                              General

                                                                                                              Target ID:2
                                                                                                              Start time:04:36:40
                                                                                                              Start date:03/10/2024
                                                                                                              Path:C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmp
                                                                                                              Wow64 process (32bit):true
                                                                                                              Commandline:"C:\Users\user\AppData\Local\Temp\is-2QEV6.tmp\OqAVRCkQ3T.tmp" /SL5="$203F6,29832184,735744,C:\Users\user\Desktop\OqAVRCkQ3T.exe"
                                                                                                              Imagebase:0x400000
                                                                                                              File size:3'045'888 bytes
                                                                                                              MD5 hash:259E3EE4646FC251C3513EEF2683479F
                                                                                                              Has elevated privileges:true
                                                                                                              Has administrator privileges:true
                                                                                                              Programmed in:Borland Delphi
                                                                                                              Yara matches:
                                                                                                              • Rule: JoeSecurity_UACBypassusingCMSTP, Description: Yara detected UAC Bypass using CMSTP, Source: 00000002.00000003.3069897606.0000000005580000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
                                                                                                              Reputation:low
                                                                                                              Has exited:true

                                                                                                              General

                                                                                                              Target ID:6
                                                                                                              Start time:04:37:21
                                                                                                              Start date:03/10/2024
                                                                                                              Path:C:\Program Files\FastestVPN\Resources\ComDebug.exe
                                                                                                              Wow64 process (32bit):true
                                                                                                              Commandline:"C:\Program Files\FastestVPN\Resources\ComDebug.exe"
                                                                                                              Imagebase:0x400000
                                                                                                              File size:196'157'514 bytes
                                                                                                              MD5 hash:F892887D8532D19F74884CDC48B1AC8B
                                                                                                              Has elevated privileges:true
                                                                                                              Has administrator privileges:true
                                                                                                              Programmed in:Borland Delphi
                                                                                                              Reputation:low
                                                                                                              Has exited:false

                                                                                                              General

                                                                                                              Target ID:7
                                                                                                              Start time:04:37:21
                                                                                                              Start date:03/10/2024
                                                                                                              Path:C:\Windows\System32\cmd.exe
                                                                                                              Wow64 process (32bit):false
                                                                                                              Commandline:"C:\Windows\system32\cmd.exe" /C ""C:\Program Files\FastestVPN\Resources\driver\install_tap.bat""
                                                                                                              Imagebase:0x7ff714290000
                                                                                                              File size:289'792 bytes
                                                                                                              MD5 hash:8A2122E8162DBEF04694B9C3E0B6CDEE
                                                                                                              Has elevated privileges:true
                                                                                                              Has administrator privileges:true
                                                                                                              Programmed in:C, C++ or other language
                                                                                                              Reputation:high
                                                                                                              Has exited:true

                                                                                                              General

                                                                                                              Target ID:8
                                                                                                              Start time:04:37:21
                                                                                                              Start date:03/10/2024
                                                                                                              Path:C:\Windows\System32\conhost.exe
                                                                                                              Wow64 process (32bit):false
                                                                                                              Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                              Imagebase:0x7ff66e660000
                                                                                                              File size:862'208 bytes
                                                                                                              MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                                              Has elevated privileges:true
                                                                                                              Has administrator privileges:true
                                                                                                              Programmed in:C, C++ or other language
                                                                                                              Reputation:high
                                                                                                              Has exited:true

                                                                                                              General

                                                                                                              Target ID:9
                                                                                                              Start time:04:37:22
                                                                                                              Start date:03/10/2024
                                                                                                              Path:C:\Windows\System32\reg.exe
                                                                                                              Wow64 process (32bit):false
                                                                                                              Commandline:reg Query "HKLM\Hardware\Description\System\CentralProcessor\0"
                                                                                                              Imagebase:0x7ff653c90000
                                                                                                              File size:77'312 bytes
                                                                                                              MD5 hash:227F63E1D9008B36BDBCC4B397780BE4
                                                                                                              Has elevated privileges:true
                                                                                                              Has administrator privileges:true
                                                                                                              Programmed in:C, C++ or other language
                                                                                                              Reputation:moderate
                                                                                                              Has exited:true

                                                                                                              General

                                                                                                              Target ID:10
                                                                                                              Start time:04:37:22
                                                                                                              Start date:03/10/2024
                                                                                                              Path:C:\Windows\System32\find.exe
                                                                                                              Wow64 process (32bit):false
                                                                                                              Commandline:find /i "x86"
                                                                                                              Imagebase:0x7ff791090000
                                                                                                              File size:17'920 bytes
                                                                                                              MD5 hash:4BF76A28D31FC73AA9FC970B22D056AF
                                                                                                              Has elevated privileges:true
                                                                                                              Has administrator privileges:true
                                                                                                              Programmed in:C, C++ or other language
                                                                                                              Reputation:moderate
                                                                                                              Has exited:true

                                                                                                              General

                                                                                                              Target ID:11
                                                                                                              Start time:04:37:22
                                                                                                              Start date:03/10/2024
                                                                                                              Path:C:\Windows\System32\cmd.exe
                                                                                                              Wow64 process (32bit):false
                                                                                                              Commandline:C:\Windows\system32\cmd.exe /c ver
                                                                                                              Imagebase:0x7ff714290000
                                                                                                              File size:289'792 bytes
                                                                                                              MD5 hash:8A2122E8162DBEF04694B9C3E0B6CDEE
                                                                                                              Has elevated privileges:true
                                                                                                              Has administrator privileges:true
                                                                                                              Programmed in:C, C++ or other language
                                                                                                              Reputation:high
                                                                                                              Has exited:true

                                                                                                              General

                                                                                                              Target ID:12
                                                                                                              Start time:04:37:22
                                                                                                              Start date:03/10/2024
                                                                                                              Path:C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exe
                                                                                                              Wow64 process (32bit):false
                                                                                                              Commandline:tapinstall.exe remove tap0901
                                                                                                              Imagebase:0x7ff6ec4b0000
                                                                                                              File size:507'728 bytes
                                                                                                              MD5 hash:E313336C82EB265542664CC7A360C5FF
                                                                                                              Has elevated privileges:true
                                                                                                              Has administrator privileges:true
                                                                                                              Programmed in:C, C++ or other language
                                                                                                              Reputation:moderate
                                                                                                              Has exited:true

                                                                                                              General

                                                                                                              Target ID:13
                                                                                                              Start time:04:37:22
                                                                                                              Start date:03/10/2024
                                                                                                              Path:C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exe
                                                                                                              Wow64 process (32bit):false
                                                                                                              Commandline:tapinstall.exe install OemVista.inf tap0901
                                                                                                              Imagebase:0x7ff6ec4b0000
                                                                                                              File size:507'728 bytes
                                                                                                              MD5 hash:E313336C82EB265542664CC7A360C5FF
                                                                                                              Has elevated privileges:true
                                                                                                              Has administrator privileges:true
                                                                                                              Programmed in:C, C++ or other language
                                                                                                              Reputation:moderate
                                                                                                              Has exited:true

                                                                                                              General

                                                                                                              Target ID:16
                                                                                                              Start time:04:37:24
                                                                                                              Start date:03/10/2024
                                                                                                              Path:C:\Windows\SysWOW64\more.com
                                                                                                              Wow64 process (32bit):true
                                                                                                              Commandline:C:\Windows\SysWOW64\more.com
                                                                                                              Imagebase:0xb50000
                                                                                                              File size:24'576 bytes
                                                                                                              MD5 hash:03805AE7E8CBC07840108F5C80CF4973
                                                                                                              Has elevated privileges:true
                                                                                                              Has administrator privileges:true
                                                                                                              Programmed in:C, C++ or other language
                                                                                                              Reputation:moderate
                                                                                                              Has exited:false

                                                                                                              General

                                                                                                              Target ID:17
                                                                                                              Start time:04:37:24
                                                                                                              Start date:03/10/2024
                                                                                                              Path:C:\Windows\System32\conhost.exe
                                                                                                              Wow64 process (32bit):false
                                                                                                              Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                              Imagebase:0x7ff66e660000
                                                                                                              File size:862'208 bytes
                                                                                                              MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                                              Has elevated privileges:true
                                                                                                              Has administrator privileges:true
                                                                                                              Programmed in:C, C++ or other language
                                                                                                              Has exited:false

                                                                                                              General

                                                                                                              Target ID:18
                                                                                                              Start time:04:37:24
                                                                                                              Start date:03/10/2024
                                                                                                              Path:C:\Windows\System32\svchost.exe
                                                                                                              Wow64 process (32bit):false
                                                                                                              Commandline:C:\Windows\system32\svchost.exe -k DcomLaunch -p -s DeviceInstall
                                                                                                              Imagebase:0x7ff7403e0000
                                                                                                              File size:55'320 bytes
                                                                                                              MD5 hash:B7F884C1B74A263F746EE12A5F7C9F6A
                                                                                                              Has elevated privileges:true
                                                                                                              Has administrator privileges:true
                                                                                                              Programmed in:C, C++ or other language
                                                                                                              Has exited:false

                                                                                                              General

                                                                                                              Target ID:19
                                                                                                              Start time:04:37:24
                                                                                                              Start date:03/10/2024
                                                                                                              Path:C:\Windows\System32\drvinst.exe
                                                                                                              Wow64 process (32bit):false
                                                                                                              Commandline:DrvInst.exe "4" "0" "C:\Users\user\AppData\Local\Temp\{4cb0eb0d-a103-7c4c-aedf-5caef9610c0c}\oemvista.inf" "9" "4d14a44ff" "0000000000000154" "WinSta0\Default" "0000000000000168" "208" "c:\program files\fastestvpn\resources\driver\windows10\amd64"
                                                                                                              Imagebase:0x7ff6c3190000
                                                                                                              File size:337'920 bytes
                                                                                                              MD5 hash:294990C88B9D1FE0A54A1FA8BF4324D9
                                                                                                              Has elevated privileges:true
                                                                                                              Has administrator privileges:true
                                                                                                              Programmed in:C, C++ or other language
                                                                                                              Has exited:true

                                                                                                              General

                                                                                                              Target ID:20
                                                                                                              Start time:04:37:26
                                                                                                              Start date:03/10/2024
                                                                                                              Path:C:\Windows\System32\drvinst.exe
                                                                                                              Wow64 process (32bit):false
                                                                                                              Commandline:DrvInst.exe "2" "211" "ROOT\NET\0000" "C:\Windows\INF\oem4.inf" "oem4.inf:3beb73aff103cc24:tap0901.ndi:9.24.2.601:tap0901," "4d14a44ff" "0000000000000154"
                                                                                                              Imagebase:0x7ff6c3190000
                                                                                                              File size:337'920 bytes
                                                                                                              MD5 hash:294990C88B9D1FE0A54A1FA8BF4324D9
                                                                                                              Has elevated privileges:true
                                                                                                              Has administrator privileges:true
                                                                                                              Programmed in:C, C++ or other language
                                                                                                              Has exited:true

                                                                                                              General

                                                                                                              Target ID:21
                                                                                                              Start time:04:37:27
                                                                                                              Start date:03/10/2024
                                                                                                              Path:C:\Windows\System32\svchost.exe
                                                                                                              Wow64 process (32bit):false
                                                                                                              Commandline:C:\Windows\System32\svchost.exe -k netsvcs -p -s NetSetupSvc
                                                                                                              Imagebase:0x7ff7403e0000
                                                                                                              File size:55'320 bytes
                                                                                                              MD5 hash:B7F884C1B74A263F746EE12A5F7C9F6A
                                                                                                              Has elevated privileges:true
                                                                                                              Has administrator privileges:true
                                                                                                              Programmed in:C, C++ or other language
                                                                                                              Has exited:true

                                                                                                              General

                                                                                                              Target ID:22
                                                                                                              Start time:04:37:27
                                                                                                              Start date:03/10/2024
                                                                                                              Path:C:\Program Files\FastestVPN\FastestVPN.exe
                                                                                                              Wow64 process (32bit):true
                                                                                                              Commandline:"C:\Program Files\FastestVPN\FastestVPN.exe" -autorun
                                                                                                              Imagebase:0x3e0000
                                                                                                              File size:2'059'432 bytes
                                                                                                              MD5 hash:01CF6EF766C41BB2C99A2CCCDECC69C1
                                                                                                              Has elevated privileges:false
                                                                                                              Has administrator privileges:false
                                                                                                              Programmed in:C, C++ or other language
                                                                                                              Has exited:false

                                                                                                              General

                                                                                                              Target ID:23
                                                                                                              Start time:04:37:29
                                                                                                              Start date:03/10/2024
                                                                                                              Path:C:\Windows\System32\cmd.exe
                                                                                                              Wow64 process (32bit):false
                                                                                                              Commandline:"C:\Windows\system32\cmd.exe" /C ""C:\Program Files\FastestVPN\Resources\sp\install_sp.bat""
                                                                                                              Imagebase:0x7ff714290000
                                                                                                              File size:289'792 bytes
                                                                                                              MD5 hash:8A2122E8162DBEF04694B9C3E0B6CDEE
                                                                                                              Has elevated privileges:true
                                                                                                              Has administrator privileges:true
                                                                                                              Programmed in:C, C++ or other language
                                                                                                              Has exited:true

                                                                                                              General

                                                                                                              Target ID:24
                                                                                                              Start time:04:37:29
                                                                                                              Start date:03/10/2024
                                                                                                              Path:C:\Windows\System32\conhost.exe
                                                                                                              Wow64 process (32bit):false
                                                                                                              Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                              Imagebase:0x7ff66e660000
                                                                                                              File size:862'208 bytes
                                                                                                              MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                                              Has elevated privileges:true
                                                                                                              Has administrator privileges:true
                                                                                                              Programmed in:C, C++ or other language
                                                                                                              Has exited:true

                                                                                                              General

                                                                                                              Target ID:25
                                                                                                              Start time:04:37:29
                                                                                                              Start date:03/10/2024
                                                                                                              Path:C:\Windows\System32\sc.exe
                                                                                                              Wow64 process (32bit):false
                                                                                                              Commandline:sc stop fastestvpndriver
                                                                                                              Imagebase:0x7ff690840000
                                                                                                              File size:72'192 bytes
                                                                                                              MD5 hash:3FB5CF71F7E7EB49790CB0E663434D80
                                                                                                              Has elevated privileges:true
                                                                                                              Has administrator privileges:true
                                                                                                              Programmed in:C, C++ or other language
                                                                                                              Has exited:true

                                                                                                              General

                                                                                                              Target ID:26
                                                                                                              Start time:04:37:29
                                                                                                              Start date:03/10/2024
                                                                                                              Path:C:\Windows\System32\reg.exe
                                                                                                              Wow64 process (32bit):false
                                                                                                              Commandline:reg Query "HKLM\Hardware\Description\System\CentralProcessor\0"
                                                                                                              Imagebase:0x7ff653c90000
                                                                                                              File size:77'312 bytes
                                                                                                              MD5 hash:227F63E1D9008B36BDBCC4B397780BE4
                                                                                                              Has elevated privileges:true
                                                                                                              Has administrator privileges:true
                                                                                                              Programmed in:C, C++ or other language
                                                                                                              Has exited:true

                                                                                                              General

                                                                                                              Target ID:27
                                                                                                              Start time:04:37:29
                                                                                                              Start date:03/10/2024
                                                                                                              Path:C:\Windows\System32\conhost.exe
                                                                                                              Wow64 process (32bit):false
                                                                                                              Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                              Imagebase:0x7ff66e660000
                                                                                                              File size:862'208 bytes
                                                                                                              MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                                              Has elevated privileges:true
                                                                                                              Has administrator privileges:true
                                                                                                              Programmed in:C, C++ or other language
                                                                                                              Has exited:true

                                                                                                              General

                                                                                                              Target ID:28
                                                                                                              Start time:04:37:29
                                                                                                              Start date:03/10/2024
                                                                                                              Path:C:\Windows\System32\find.exe
                                                                                                              Wow64 process (32bit):false
                                                                                                              Commandline:find /i "x86"
                                                                                                              Imagebase:0x7ff791090000
                                                                                                              File size:17'920 bytes
                                                                                                              MD5 hash:4BF76A28D31FC73AA9FC970B22D056AF
                                                                                                              Has elevated privileges:true
                                                                                                              Has administrator privileges:true
                                                                                                              Programmed in:C, C++ or other language
                                                                                                              Has exited:true

                                                                                                              General

                                                                                                              Target ID:29
                                                                                                              Start time:04:37:29
                                                                                                              Start date:03/10/2024
                                                                                                              Path:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                              Wow64 process (32bit):true
                                                                                                              Commandline:"powershell" -windowstyle hidden get-wmiobject Win32_ComputerSystemProduct | Select-Object -ExpandProperty UUID
                                                                                                              Imagebase:0x680000
                                                                                                              File size:433'152 bytes
                                                                                                              MD5 hash:C32CA4ACFCC635EC1EA6ED8A34DF5FAC
                                                                                                              Has elevated privileges:false
                                                                                                              Has administrator privileges:false
                                                                                                              Programmed in:C, C++ or other language
                                                                                                              Has exited:true

                                                                                                              General

                                                                                                              Target ID:30
                                                                                                              Start time:04:37:29
                                                                                                              Start date:03/10/2024
                                                                                                              Path:C:\Windows\System32\conhost.exe
                                                                                                              Wow64 process (32bit):false
                                                                                                              Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                              Imagebase:0x7ff66e660000
                                                                                                              File size:862'208 bytes
                                                                                                              MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                                              Has elevated privileges:false
                                                                                                              Has administrator privileges:false
                                                                                                              Programmed in:C, C++ or other language
                                                                                                              Has exited:true

                                                                                                              General

                                                                                                              Target ID:31
                                                                                                              Start time:04:37:29
                                                                                                              Start date:03/10/2024
                                                                                                              Path:C:\Windows\System32\svchost.exe
                                                                                                              Wow64 process (32bit):false
                                                                                                              Commandline:C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
                                                                                                              Imagebase:0x7ff7403e0000
                                                                                                              File size:55'320 bytes
                                                                                                              MD5 hash:B7F884C1B74A263F746EE12A5F7C9F6A
                                                                                                              Has elevated privileges:true
                                                                                                              Has administrator privileges:true
                                                                                                              Programmed in:C, C++ or other language
                                                                                                              Has exited:false

                                                                                                              General

                                                                                                              Target ID:32
                                                                                                              Start time:04:37:30
                                                                                                              Start date:03/10/2024
                                                                                                              Path:C:\Windows\System32\reg.exe
                                                                                                              Wow64 process (32bit):false
                                                                                                              Commandline:reg QUERY "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion"
                                                                                                              Imagebase:0x7ff653c90000
                                                                                                              File size:77'312 bytes
                                                                                                              MD5 hash:227F63E1D9008B36BDBCC4B397780BE4
                                                                                                              Has elevated privileges:true
                                                                                                              Has administrator privileges:true
                                                                                                              Programmed in:C, C++ or other language
                                                                                                              Has exited:true

                                                                                                              General

                                                                                                              Target ID:33
                                                                                                              Start time:04:37:30
                                                                                                              Start date:03/10/2024
                                                                                                              Path:C:\Windows\System32\find.exe
                                                                                                              Wow64 process (32bit):false
                                                                                                              Commandline:find /i "Windows 7"
                                                                                                              Imagebase:0x7ff791090000
                                                                                                              File size:17'920 bytes
                                                                                                              MD5 hash:4BF76A28D31FC73AA9FC970B22D056AF
                                                                                                              Has elevated privileges:true
                                                                                                              Has administrator privileges:true
                                                                                                              Programmed in:C, C++ or other language
                                                                                                              Has exited:true

                                                                                                              General

                                                                                                              Target ID:34
                                                                                                              Start time:04:37:31
                                                                                                              Start date:03/10/2024
                                                                                                              Path:C:\Windows\System32\xcopy.exe
                                                                                                              Wow64 process (32bit):false
                                                                                                              Commandline:xcopy /y driver\windows8\amd64\fastestvpndriver.sys C:\Windows\system32\drivers
                                                                                                              Imagebase:0x7ff795650000
                                                                                                              File size:50'688 bytes
                                                                                                              MD5 hash:39FBFD3AF58238C6F9D4D408C9251FF5
                                                                                                              Has elevated privileges:true
                                                                                                              Has administrator privileges:true
                                                                                                              Programmed in:C, C++ or other language
                                                                                                              Has exited:true

                                                                                                              General

                                                                                                              Target ID:35
                                                                                                              Start time:04:37:31
                                                                                                              Start date:03/10/2024
                                                                                                              Path:C:\Program Files\FastestVPN\Resources\sp\release\nfregdrv.exe
                                                                                                              Wow64 process (32bit):true
                                                                                                              Commandline:release\nfregdrv.exe -u fastestvpndriver
                                                                                                              Imagebase:0x400000
                                                                                                              File size:61'064 bytes
                                                                                                              MD5 hash:9333F583E2D32A47276DCEC7C2391FD2
                                                                                                              Has elevated privileges:true
                                                                                                              Has administrator privileges:true
                                                                                                              Programmed in:C, C++ or other language
                                                                                                              Has exited:true

                                                                                                              General

                                                                                                              Target ID:36
                                                                                                              Start time:04:37:32
                                                                                                              Start date:03/10/2024
                                                                                                              Path:C:\Program Files\FastestVPN\Resources\sp\release\nfregdrv.exe
                                                                                                              Wow64 process (32bit):true
                                                                                                              Commandline:release\nfregdrv.exe fastestvpndriver
                                                                                                              Imagebase:0x400000
                                                                                                              File size:61'064 bytes
                                                                                                              MD5 hash:9333F583E2D32A47276DCEC7C2391FD2
                                                                                                              Has elevated privileges:true
                                                                                                              Has administrator privileges:true
                                                                                                              Programmed in:C, C++ or other language
                                                                                                              Has exited:true

                                                                                                              General

                                                                                                              Target ID:37
                                                                                                              Start time:04:37:32
                                                                                                              Start date:03/10/2024
                                                                                                              Path:C:\Windows\System32\sc.exe
                                                                                                              Wow64 process (32bit):false
                                                                                                              Commandline:"C:\Windows\system32\sc.exe" stop FastestVPNService
                                                                                                              Imagebase:0x7ff690840000
                                                                                                              File size:72'192 bytes
                                                                                                              MD5 hash:3FB5CF71F7E7EB49790CB0E663434D80
                                                                                                              Has elevated privileges:true
                                                                                                              Has administrator privileges:true
                                                                                                              Programmed in:C, C++ or other language
                                                                                                              Has exited:true

                                                                                                              General

                                                                                                              Target ID:38
                                                                                                              Start time:04:37:32
                                                                                                              Start date:03/10/2024
                                                                                                              Path:C:\Windows\System32\conhost.exe
                                                                                                              Wow64 process (32bit):false
                                                                                                              Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                              Imagebase:0x7ff66e660000
                                                                                                              File size:862'208 bytes
                                                                                                              MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                                              Has elevated privileges:true
                                                                                                              Has administrator privileges:true
                                                                                                              Programmed in:C, C++ or other language
                                                                                                              Has exited:true

                                                                                                              General

                                                                                                              Target ID:39
                                                                                                              Start time:04:37:32
                                                                                                              Start date:03/10/2024
                                                                                                              Path:C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe
                                                                                                              Wow64 process (32bit):true
                                                                                                              Commandline:"C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe" --uninstall
                                                                                                              Imagebase:0x470000
                                                                                                              File size:25'768 bytes
                                                                                                              MD5 hash:22D4E4267DFE093E5E23C2F3D7741AA4
                                                                                                              Has elevated privileges:true
                                                                                                              Has administrator privileges:true
                                                                                                              Programmed in:C, C++ or other language
                                                                                                              Has exited:true

                                                                                                              General

                                                                                                              Target ID:40
                                                                                                              Start time:04:37:33
                                                                                                              Start date:03/10/2024
                                                                                                              Path:C:\Windows\System32\svchost.exe
                                                                                                              Wow64 process (32bit):false
                                                                                                              Commandline:C:\Windows\System32\svchost.exe -k WerSvcGroup
                                                                                                              Imagebase:0x7ff7403e0000
                                                                                                              File size:55'320 bytes
                                                                                                              MD5 hash:B7F884C1B74A263F746EE12A5F7C9F6A
                                                                                                              Has elevated privileges:true
                                                                                                              Has administrator privileges:true
                                                                                                              Programmed in:C, C++ or other language
                                                                                                              Has exited:true

                                                                                                              General

                                                                                                              Target ID:41
                                                                                                              Start time:04:37:33
                                                                                                              Start date:03/10/2024
                                                                                                              Path:C:\Windows\SysWOW64\WerFault.exe
                                                                                                              Wow64 process (32bit):true
                                                                                                              Commandline:C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 2540 -ip 2540
                                                                                                              Imagebase:0x560000
                                                                                                              File size:483'680 bytes
                                                                                                              MD5 hash:C31336C1EFC2CCB44B4326EA793040F2
                                                                                                              Has elevated privileges:true
                                                                                                              Has administrator privileges:true
                                                                                                              Programmed in:C, C++ or other language
                                                                                                              Has exited:true

                                                                                                              General

                                                                                                              Target ID:42
                                                                                                              Start time:04:37:33
                                                                                                              Start date:03/10/2024
                                                                                                              Path:C:\Windows\SysWOW64\WerFault.exe
                                                                                                              Wow64 process (32bit):true
                                                                                                              Commandline:C:\Windows\SysWOW64\WerFault.exe -u -p 2540 -s 1076
                                                                                                              Imagebase:0x560000
                                                                                                              File size:483'680 bytes
                                                                                                              MD5 hash:C31336C1EFC2CCB44B4326EA793040F2
                                                                                                              Has elevated privileges:true
                                                                                                              Has administrator privileges:true
                                                                                                              Programmed in:C, C++ or other language
                                                                                                              Has exited:true

                                                                                                              General

                                                                                                              Target ID:43
                                                                                                              Start time:04:38:07
                                                                                                              Start date:03/10/2024
                                                                                                              Path:C:\Windows\System32\sc.exe
                                                                                                              Wow64 process (32bit):false
                                                                                                              Commandline:"C:\Windows\system32\sc.exe" delete FastestVPNService
                                                                                                              Imagebase:0x7ff690840000
                                                                                                              File size:72'192 bytes
                                                                                                              MD5 hash:3FB5CF71F7E7EB49790CB0E663434D80
                                                                                                              Has elevated privileges:true
                                                                                                              Has administrator privileges:true
                                                                                                              Programmed in:C, C++ or other language
                                                                                                              Has exited:true

                                                                                                              General

                                                                                                              Target ID:44
                                                                                                              Start time:04:38:07
                                                                                                              Start date:03/10/2024
                                                                                                              Path:C:\Windows\System32\conhost.exe
                                                                                                              Wow64 process (32bit):false
                                                                                                              Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                              Imagebase:0x7ff66e660000
                                                                                                              File size:862'208 bytes
                                                                                                              MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                                              Has elevated privileges:true
                                                                                                              Has administrator privileges:true
                                                                                                              Programmed in:C, C++ or other language
                                                                                                              Has exited:true

                                                                                                              General

                                                                                                              Target ID:45
                                                                                                              Start time:04:38:08
                                                                                                              Start date:03/10/2024
                                                                                                              Path:C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe
                                                                                                              Wow64 process (32bit):true
                                                                                                              Commandline:"C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe" --install
                                                                                                              Imagebase:0xc00000
                                                                                                              File size:25'768 bytes
                                                                                                              MD5 hash:22D4E4267DFE093E5E23C2F3D7741AA4
                                                                                                              Has elevated privileges:true
                                                                                                              Has administrator privileges:true
                                                                                                              Programmed in:C, C++ or other language
                                                                                                              Has exited:true

                                                                                                              General

                                                                                                              Target ID:46
                                                                                                              Start time:04:38:09
                                                                                                              Start date:03/10/2024
                                                                                                              Path:C:\Program Files\FastestVPN\subinacl.exe
                                                                                                              Wow64 process (32bit):true
                                                                                                              Commandline:"C:\Program Files\FastestVPN\subinacl.exe" /service FastestVPNService /GRANT=everyone=TO
                                                                                                              Imagebase:0x1000000
                                                                                                              File size:301'224 bytes
                                                                                                              MD5 hash:4798226EE22C513302EE57D3AA94398B
                                                                                                              Has elevated privileges:true
                                                                                                              Has administrator privileges:true
                                                                                                              Programmed in:C, C++ or other language
                                                                                                              Has exited:true

                                                                                                              General

                                                                                                              Target ID:47
                                                                                                              Start time:04:38:09
                                                                                                              Start date:03/10/2024
                                                                                                              Path:C:\Windows\System32\conhost.exe
                                                                                                              Wow64 process (32bit):false
                                                                                                              Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                              Imagebase:0x7ff66e660000
                                                                                                              File size:862'208 bytes
                                                                                                              MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                                              Has elevated privileges:true
                                                                                                              Has administrator privileges:true
                                                                                                              Programmed in:C, C++ or other language
                                                                                                              Has exited:true

                                                                                                              General

                                                                                                              Target ID:48
                                                                                                              Start time:04:38:10
                                                                                                              Start date:03/10/2024
                                                                                                              Path:C:\Windows\System32\sc.exe
                                                                                                              Wow64 process (32bit):false
                                                                                                              Commandline:"C:\Windows\system32\sc.exe" start FastestVPNService
                                                                                                              Imagebase:0x7ff690840000
                                                                                                              File size:72'192 bytes
                                                                                                              MD5 hash:3FB5CF71F7E7EB49790CB0E663434D80
                                                                                                              Has elevated privileges:true
                                                                                                              Has administrator privileges:true
                                                                                                              Programmed in:C, C++ or other language
                                                                                                              Has exited:true

                                                                                                              General

                                                                                                              Target ID:49
                                                                                                              Start time:04:38:10
                                                                                                              Start date:03/10/2024
                                                                                                              Path:C:\Windows\System32\conhost.exe
                                                                                                              Wow64 process (32bit):false
                                                                                                              Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                              Imagebase:0x7ff66e660000
                                                                                                              File size:862'208 bytes
                                                                                                              MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                                              Has elevated privileges:true
                                                                                                              Has administrator privileges:true
                                                                                                              Programmed in:C, C++ or other language
                                                                                                              Has exited:true

                                                                                                              General

                                                                                                              Target ID:50
                                                                                                              Start time:04:38:10
                                                                                                              Start date:03/10/2024
                                                                                                              Path:C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe
                                                                                                              Wow64 process (32bit):true
                                                                                                              Commandline:"C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe"
                                                                                                              Imagebase:0x6d0000
                                                                                                              File size:25'768 bytes
                                                                                                              MD5 hash:22D4E4267DFE093E5E23C2F3D7741AA4
                                                                                                              Has elevated privileges:true
                                                                                                              Has administrator privileges:true
                                                                                                              Programmed in:C, C++ or other language
                                                                                                              Has exited:false

                                                                                                              General

                                                                                                              Target ID:52
                                                                                                              Start time:04:38:12
                                                                                                              Start date:03/10/2024
                                                                                                              Path:C:\Program Files\FastestVPN\FastestVPN.exe
                                                                                                              Wow64 process (32bit):true
                                                                                                              Commandline:"C:\Program Files\FastestVPN\FastestVPN.exe"
                                                                                                              Imagebase:0x560000
                                                                                                              File size:2'059'432 bytes
                                                                                                              MD5 hash:01CF6EF766C41BB2C99A2CCCDECC69C1
                                                                                                              Has elevated privileges:true
                                                                                                              Has administrator privileges:true
                                                                                                              Programmed in:C, C++ or other language
                                                                                                              Has exited:true

                                                                                                              Disassembly

                                                                                                              Reset < >

                                                                                                                Execution Graph

                                                                                                                Execution Coverage:34.8%
                                                                                                                Dynamic/Decrypted Code Coverage:0%
                                                                                                                Signature Coverage:8.1%
                                                                                                                Total number of Nodes:149
                                                                                                                Total number of Limit Nodes:7
                                                                                                                execution_graph 1387 7a612c 1394 7a607c 1387->1394 1388 7a6126 1389 7a61b7 1388->1389 1391 7a39e6 GlobalAlloc 1388->1391 1392 7a3be6 GlobalAlloc 1389->1392 1393 7a6210 1389->1393 1405 7a61c1 1389->1405 1390 7a3d36 GlobalAlloc 1390->1394 1391->1389 1392->1393 1396 7a5016 GlobalAlloc 1393->1396 1393->1405 1394->1388 1394->1390 1395 7a5556 4 API calls 1394->1395 1395->1394 1397 7a62bd 1396->1397 1398 7a4586 2 API calls 1397->1398 1399 7a62f4 1398->1399 1400 7a5016 GlobalAlloc 1399->1400 1401 7a6331 1400->1401 1402 7a634e VirtualProtect 1401->1402 1403 7a4906 1402->1403 1404 7a638b VirtualProtect 1403->1404 1404->1405 1414 7a3000 1415 7a3010 1414->1415 1416 7a3a10 1415->1416 1417 7a5016 GlobalAlloc 1415->1417 1417->1415 1243 7a63f6 1246 7a5796 1243->1246 1247 7a57ff 1246->1247 1305 7a4746 1247->1305 1249 7a5834 1250 7a4746 GetPEB 1249->1250 1251 7a584b 1250->1251 1252 7a5868 GlobalAlloc 1251->1252 1253 7a58a0 1252->1253 1308 7a5016 1253->1308 1255 7a5ac3 1311 7a4266 1255->1311 1257 7a5ae0 1314 7a4586 1257->1314 1259 7a5afd 1260 7a5016 GlobalAlloc 1259->1260 1261 7a5c05 1260->1261 1318 7a41f6 1261->1318 1263 7a5c22 1264 7a4586 2 API calls 1263->1264 1265 7a5c35 1264->1265 1321 7a5076 1265->1321 1267 7a5cad 1328 7a42e6 1267->1328 1269 7a5d89 1331 7a4956 CreateFileW 1269->1331 1271 7a5dab 1337 7a5276 1271->1337 1273 7a5deb 1274 7a5ef9 1273->1274 1275 7a5ea5 1273->1275 1277 7a5f31 1274->1277 1278 7a5f01 1274->1278 1341 7a5426 1275->1341 1281 7a5016 GlobalAlloc 1277->1281 1347 7a43f6 1278->1347 1279 7a5ef1 1284 7a61c1 1279->1284 1286 7a6210 1279->1286 1370 7a3be6 1279->1370 1283 7a5f3e 1281->1283 1285 7a5016 GlobalAlloc 1283->1285 1287 7a5fbc 1285->1287 1286->1284 1288 7a5016 GlobalAlloc 1286->1288 1351 7a4336 1287->1351 1290 7a62bd 1288->1290 1292 7a4586 2 API calls 1290->1292 1291 7a600e 1294 7a5016 GlobalAlloc 1291->1294 1298 7a6126 1291->1298 1293 7a62f4 1292->1293 1296 7a5016 GlobalAlloc 1293->1296 1303 7a6069 1294->1303 1297 7a6331 1296->1297 1299 7a634e VirtualProtect 1297->1299 1298->1279 1366 7a39e6 1298->1366 1345 7a4906 1299->1345 1303->1298 1356 7a3d36 1303->1356 1359 7a5556 1303->1359 1373 7a5746 GetPEB 1305->1373 1307 7a4766 1307->1249 1309 7a5032 GlobalAlloc 1308->1309 1310 7a5026 1308->1310 1309->1255 1310->1309 1312 7a5016 GlobalAlloc 1311->1312 1313 7a4275 1312->1313 1313->1257 1315 7a5016 GlobalAlloc 1314->1315 1316 7a4597 1315->1316 1317 7a45aa LoadLibraryW 1316->1317 1317->1259 1319 7a5016 GlobalAlloc 1318->1319 1320 7a4205 1319->1320 1320->1263 1323 7a508b 1321->1323 1322 7a5016 GlobalAlloc 1322->1323 1323->1322 1324 7a50c3 NtQuerySystemInformation 1323->1324 1327 7a50b1 1323->1327 1324->1323 1325 7a50ef 1324->1325 1326 7a5016 GlobalAlloc 1325->1326 1326->1327 1327->1267 1329 7a5016 GlobalAlloc 1328->1329 1330 7a42f4 1329->1330 1330->1269 1332 7a498a 1331->1332 1333 7a4983 1331->1333 1332->1333 1334 7a5016 GlobalAlloc 1332->1334 1333->1271 1335 7a49c6 ReadFile 1334->1335 1335->1333 1336 7a4a01 CloseHandle 1335->1336 1336->1333 1338 7a5287 1337->1338 1339 7a4586 2 API calls 1338->1339 1340 7a535c 1339->1340 1340->1273 1343 7a5449 1341->1343 1342 7a54de 1342->1279 1343->1342 1344 7a5556 4 API calls 1343->1344 1344->1343 1346 7a4912 VirtualProtect 1345->1346 1346->1284 1348 7a4419 1347->1348 1349 7a4467 1348->1349 1350 7a39e6 GlobalAlloc 1348->1350 1349->1279 1350->1348 1352 7a5016 GlobalAlloc 1351->1352 1353 7a4347 1352->1353 1354 7a5016 GlobalAlloc 1353->1354 1355 7a4369 1354->1355 1355->1291 1374 7a3f86 1356->1374 1358 7a3d7b 1358->1303 1360 7a4336 GlobalAlloc 1359->1360 1361 7a5565 1360->1361 1380 7a4f46 CreateFileW 1361->1380 1365 7a558a 1365->1303 1367 7a3a17 1366->1367 1369 7a3a10 1366->1369 1368 7a5016 GlobalAlloc 1367->1368 1367->1369 1368->1367 1369->1279 1371 7a5016 GlobalAlloc 1370->1371 1372 7a3bf9 1371->1372 1372->1286 1373->1307 1376 7a3f95 1374->1376 1375 7a3fa1 1375->1358 1376->1375 1377 7a5016 GlobalAlloc 1376->1377 1378 7a408c 1377->1378 1379 7a5016 GlobalAlloc 1378->1379 1379->1375 1381 7a4f77 WriteFile 1380->1381 1382 7a4f73 1380->1382 1381->1382 1382->1365 1383 7a65a6 1382->1383 1384 7a65b7 1383->1384 1385 7a664a malloc 1384->1385 1386 7a65f6 1384->1386 1385->1386 1386->1365 1406 7a44a6 1411 7a3cf6 1406->1411 1408 7a44be 1409 7a4956 4 API calls 1408->1409 1410 7a44e6 1409->1410 1412 7a5016 GlobalAlloc 1411->1412 1413 7a3d04 1412->1413 1413->1408

                                                                                                                Callgraph

                                                                                                                • Executed
                                                                                                                • Not Executed
                                                                                                                • Opacity -> Relevance
                                                                                                                • Disassembly available
                                                                                                                callgraph 0 Function_007A5276 46 Function_007A4606 0->46 94 Function_007A4586 0->94 96 Function_007A4A86 0->96 1 Function_007A5676 67 Function_007A64D6 1->67 2 Function_007A5076 22 Function_007A4E46 2->22 36 Function_007A5016 2->36 77 Function_007A46C6 2->77 2->96 3 Function_007A6476 4 Function_007A5766 5 Function_007A6C66 6 Function_007A4266 33 Function_007A4A26 6->33 6->36 43 Function_007A4906 6->43 44 Function_007A4B06 6->44 7 Function_007A5651 8 Function_007A5056 9 Function_007A4956 9->36 10 Function_007A5556 10->8 19 Function_007A4F46 10->19 31 Function_007A4336 10->31 84 Function_007A65A6 10->84 11 Function_007A7256 12 Function_007A4A56 85 Function_007A4EA6 12->85 88 Function_007A48A6 12->88 13 Function_007A3C56 14 Function_007A6856 29 Function_007A6836 14->29 14->88 15 Function_007A4B56 71 Function_007A48D6 15->71 16 Function_007A4856 57 Function_007A4BE6 16->57 17 Function_007A6D4C 18 Function_007A6D42 20 Function_007A5746 21 Function_007A4746 21->20 50 Function_007A47F6 21->50 22->71 86 Function_007A4BA6 22->86 23 Function_007A6D3A 24 Function_007A6B3E 25 Function_007A5236 26 Function_007A4736 27 Function_007A6536 28 Function_007A6936 30 Function_007A3D36 30->44 95 Function_007A3F86 30->95 31->36 39 Function_007A4C16 31->39 79 Function_007A3CC6 31->79 32 Function_007A612C 32->4 32->10 32->30 32->36 40 Function_007A4116 32->40 32->43 32->44 45 Function_007A4106 32->45 48 Function_007A44F6 32->48 49 Function_007A4EF6 32->49 61 Function_007A39E6 32->61 62 Function_007A3BE6 32->62 70 Function_007A4DD6 32->70 78 Function_007A45C6 32->78 32->88 32->94 74 Function_007A4AC6 33->74 33->88 34 Function_007A4D26 35 Function_007A5426 35->10 35->25 35->43 75 Function_007A55C6 35->75 35->96 37 Function_007A6416 38 Function_007A4E16 38->15 38->71 40->71 41 Function_007A6D0E 42 Function_007A3000 42->13 42->36 42->43 42->75 76 Function_007A68C6 42->76 44->88 46->4 46->14 47 Function_007A6DF9 48->14 50->86 51 Function_007A63F6 91 Function_007A5796 51->91 52 Function_007A43F6 52->43 52->61 52->75 53 Function_007A41F6 53->33 53->36 53->43 53->44 54 Function_007A3CF6 54->36 69 Function_007A4CD6 54->69 55 Function_007A40F6 56 Function_007A43E6 58 Function_007A42E6 58->36 58->49 59 Function_007A67E6 59->59 60 Function_007A51E6 60->59 61->13 61->36 61->43 61->75 61->76 62->36 68 Function_007A6AD6 62->68 63 Function_007A40E6 64 Function_007A3EE4 65 Function_007A6CD8 66 Function_007A51DC 67->3 68->28 68->43 68->96 70->96 72 Function_007A42D6 73 Function_007A4FC6 73->71 77->29 77->71 79->96 80 Function_007A6DC5 81 Function_007A6DBA 82 Function_007A6BBE 83 Function_007A6CBC 84->1 84->37 84->96 85->88 87 Function_007A44A6 87->9 87->39 87->54 89 Function_007A8FA5 90 Function_007A6B93 91->0 91->2 91->4 91->6 91->9 91->10 91->21 91->30 91->31 91->35 91->36 91->40 91->43 91->44 91->45 91->46 91->48 91->49 91->52 91->53 91->55 91->58 91->60 91->61 91->62 91->70 91->77 91->78 91->88 91->94 92 Function_007A6D95 93 Function_007A8482 94->15 94->36 95->36 95->43 95->71 97 Function_007A5786

                                                                                                                Executed Functions

                                                                                                                Function 007A5076 Relevance: 1.6, APIs: 1, Instructions: 123nativeCOMMON
                                                                                                                Download Yara Rule

                                                                                                                Control-flow Graph

                                                                                                                • Executed
                                                                                                                • Not Executed
                                                                                                                control_flow_graph 216 7a5076-7a5084 217 7a508b-7a5092 216->217 218 7a5098-7a50af call 7a5016 217->218 219 7a51dd-7a51e1 217->219 222 7a50b1 218->222 223 7a50b6-7a50e3 call 7a4a86 NtQuerySystemInformation 218->223 222->219 226 7a50ef-7a510c call 7a5016 223->226 227 7a50e5-7a50ed 223->227 230 7a510f-7a5115 226->230 227->217 231 7a511b-7a5122 230->231 232 7a51d6 230->232 233 7a5128-7a5148 call 7a4a86 231->233 234 7a51c6-7a51d1 231->234 232->219 237 7a5153-7a5159 233->237 234->230 238 7a515b-7a5167 237->238 239 7a517f-7a51ab call 7a4e46 call 7a46c6 237->239 238->239 240 7a5169-7a517d 238->240 246 7a51ad-7a51b3 239->246 247 7a51b5-7a51be 239->247 240->237 246->234 247->234 248 7a51c0-7a51c3 247->248 248->234
                                                                                                                APIs
                                                                                                                  • Part of subcall function 007A5016: GlobalAlloc.KERNELBASE(00000000,00000000,00000000), ref: 007A5046
                                                                                                                • NtQuerySystemInformation.NTDLL(00000005,00000000,00040000,00040000), ref: 007A50DA
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000006.00000002.4013196722.00000000007A3000.00000020.00000001.01000000.00000008.sdmp, Offset: 007A3000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_6_2_7a3000_ComDebug.jbxd
                                                                                                                Similarity
                                                                                                                • API ID: AllocGlobalInformationQuerySystem
                                                                                                                • String ID:
                                                                                                                • API String ID: 3737350999-0
                                                                                                                • Opcode ID: af0b5cb85ebff21ad004f17c148dcb155806cd6198d72419ed993a28eb2c6b99
                                                                                                                • Instruction ID: ecec4ac57bf6939f374556d3d40ae5e0ecfc7c4599a5ab985cb055a812a83a37
                                                                                                                • Opcode Fuzzy Hash: af0b5cb85ebff21ad004f17c148dcb155806cd6198d72419ed993a28eb2c6b99
                                                                                                                • Instruction Fuzzy Hash: 5B51CA75D00609EFCB04DF98C881AEEB7B5BF89300F608659E915A7340E779AE41CBA1
                                                                                                                Function 007A5796 Relevance: 5.5, APIs: 3, Instructions: 995memoryCOMMON
                                                                                                                Download Yara Rule

                                                                                                                Control-flow Graph

                                                                                                                • Executed
                                                                                                                • Not Executed
                                                                                                                control_flow_graph 0 7a5796-7a5cb6 call 7a51e6 call 7a4746 * 2 call 7a4606 GlobalAlloc call 7a4606 * 17 call 7a5016 call 7a4266 call 7a4586 call 7a4606 * 8 call 7a5016 call 7a41f6 call 7a4586 call 7a4606 * 3 call 7a5076 79 7a5cb8-7a5cbf 0->79 80 7a5ce6-7a5e2c call 7a4606 * 3 call 7a42e6 call 7a4956 call 7a4606 call 7a5276 0->80 81 7a5cca-7a5cce 79->81 101 7a5e2e-7a5e32 80->101 102 7a5e34-7a5e3f 80->102 81->80 82 7a5cd0-7a5ce4 call 7a4dd6 81->82 82->81 104 7a5e45-7a5ea3 101->104 103 7a5e41 102->103 102->104 103->104 105 7a5ef9-7a5eff 104->105 106 7a5ea5-7a5eec call 7a5426 104->106 108 7a5f31-7a5f6c call 7a5016 call 7a4906 105->108 109 7a5f01-7a5f2c call 7a43f6 105->109 110 7a5ef1-7a5ef4 106->110 124 7a5f76-7a5f7c 108->124 113 7a61c6-7a61da 109->113 110->113 116 7a61dc-7a6218 call 7a3be6 113->116 117 7a6221-7a622d 113->117 126 7a621a 116->126 127 7a621f 116->127 119 7a6230-7a6253 call 7a48a6 117->119 132 7a6264-7a63e0 call 7a44f6 call 7a5016 call 7a4b06 call 7a4ef6 call 7a4586 call 7a5766 call 7a5016 call 7a4906 VirtualProtect call 7a4906 VirtualProtect 119->132 133 7a6255-7a625e 119->133 128 7a5fab-7a5fc2 call 7a5016 124->128 129 7a5f7e-7a5fa9 124->129 130 7a63ea-7a63ed 126->130 127->119 136 7a5fc9-7a5fd4 128->136 129->124 185 7a63e7 132->185 133->132 138 7a5fd6-7a5ff3 136->138 139 7a5ff5-7a6058 call 7a4336 call 7a46c6 call 7a40f6 136->139 138->136 154 7a605e-7a6072 call 7a5016 139->154 155 7a6196-7a619c 139->155 164 7a607c-7a6083 154->164 155->113 157 7a619e-7a61bf call 7a39e6 155->157 157->113 168 7a61c1 157->168 166 7a6089-7a60b0 call 7a4116 164->166 167 7a6170-7a6193 call 7a4106 164->167 176 7a60d2-7a60f7 call 7a3d36 166->176 177 7a60b2-7a60d0 call 7a4dd6 166->177 167->155 168->130 183 7a60fb-7a6106 176->183 184 7a60f9 176->184 177->164 186 7a616b 183->186 187 7a6108-7a6124 call 7a45c6 183->187 184->164 185->130 186->164 190 7a612e-7a6167 call 7a5556 187->190 191 7a6126-7a612a 187->191 190->186 194 7a6169 190->194 191->167 194->167 194->186
                                                                                                                APIs
                                                                                                                • GlobalAlloc.KERNELBASE(?,00000A46), ref: 007A587A
                                                                                                                  • Part of subcall function 007A5016: GlobalAlloc.KERNELBASE(00000000,00000000,00000000), ref: 007A5046
                                                                                                                  • Part of subcall function 007A4586: LoadLibraryW.KERNELBASE(?), ref: 007A45B7
                                                                                                                • VirtualProtect.KERNELBASE(?,00000000,?,00000000), ref: 007A636B
                                                                                                                • VirtualProtect.KERNELBASE(?,00000000,00000000,00000000), ref: 007A639E
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000006.00000002.4013196722.00000000007A3000.00000020.00000001.01000000.00000008.sdmp, Offset: 007A3000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_6_2_7a3000_ComDebug.jbxd
                                                                                                                Similarity
                                                                                                                • API ID: AllocGlobalProtectVirtual$LibraryLoad
                                                                                                                • String ID:
                                                                                                                • API String ID: 1966084984-0
                                                                                                                • Opcode ID: 12cd21608a8ffc2380a32fe6fd1c4dfdad82edcd5fa0718e4e7579e87a8b5082
                                                                                                                • Instruction ID: 3096e990fbc51fd64195844693f64d8de93f73d6e5d797c51f139c1c42e76b70
                                                                                                                • Opcode Fuzzy Hash: 12cd21608a8ffc2380a32fe6fd1c4dfdad82edcd5fa0718e4e7579e87a8b5082
                                                                                                                • Instruction Fuzzy Hash: 2892D9B6E00208EFCB14DF98C995EEEB7B5BF89300F1482A8E509A7341D635AE41DF51
                                                                                                                Function 007A4956 Relevance: 4.6, APIs: 3, Instructions: 79fileCOMMON
                                                                                                                Download Yara Rule

                                                                                                                Control-flow Graph

                                                                                                                • Executed
                                                                                                                • Not Executed
                                                                                                                control_flow_graph 195 7a4956-7a4981 CreateFileW 196 7a498a-7a49a7 195->196 197 7a4983-7a4985 195->197 200 7a49b9-7a49ef call 7a5016 ReadFile 196->200 201 7a49a9-7a49b7 196->201 198 7a4a17-7a4a1a 197->198 205 7a4a01-7a4a15 CloseHandle 200->205 206 7a49f1-7a49ff 200->206 201->198 205->198 206->198
                                                                                                                APIs
                                                                                                                • CreateFileW.KERNELBASE(?,80000000,00000001,00000000,00000003,00000080,00000000,00000000,?,?,?), ref: 007A4978
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000006.00000002.4013196722.00000000007A3000.00000020.00000001.01000000.00000008.sdmp, Offset: 007A3000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_6_2_7a3000_ComDebug.jbxd
                                                                                                                Similarity
                                                                                                                • API ID: CreateFile
                                                                                                                • String ID:
                                                                                                                • API String ID: 823142352-0
                                                                                                                • Opcode ID: f2ed564a57136dcdfd9afc14d4280a279a6561515fd8f8e06747ede3fd6620df
                                                                                                                • Instruction ID: 58118b3da7fea3451b422f2ccd57aaeeb0ace35ac84946a200364d98139f1e44
                                                                                                                • Opcode Fuzzy Hash: f2ed564a57136dcdfd9afc14d4280a279a6561515fd8f8e06747ede3fd6620df
                                                                                                                • Instruction Fuzzy Hash: 7731CE75A00108FFCB04DF98C881F9EB7B9EF89310F20C298E918AB391D675AE41DB54
                                                                                                                Function 007A4F46 Relevance: 3.0, APIs: 2, Instructions: 50fileCOMMON
                                                                                                                Download Yara Rule

                                                                                                                Control-flow Graph

                                                                                                                • Executed
                                                                                                                • Not Executed
                                                                                                                control_flow_graph 208 7a4f46-7a4f71 CreateFileW 209 7a4f73-7a4f75 208->209 210 7a4f77-7a4f9a WriteFile 208->210 211 7a4fba-7a4fbd 209->211 212 7a4fac-7a4fb8 210->212 213 7a4f9c-7a4faa 210->213 212->211 213->211
                                                                                                                APIs
                                                                                                                • CreateFileW.KERNELBASE(?,40000000,00000002,00000000,00000002,00000080,00000000), ref: 007A4F68
                                                                                                                • WriteFile.KERNELBASE(000000FF,00000000,?,00000000,00000000), ref: 007A4F96
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000006.00000002.4013196722.00000000007A3000.00000020.00000001.01000000.00000008.sdmp, Offset: 007A3000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_6_2_7a3000_ComDebug.jbxd
                                                                                                                Similarity
                                                                                                                • API ID: File$CreateWrite
                                                                                                                • String ID:
                                                                                                                • API String ID: 2263783195-0
                                                                                                                • Opcode ID: 25e051ee84f5a1836dda3222278f4334694447e0a98cf775cf13d888adafe703
                                                                                                                • Instruction ID: 91b13f61e0711d32a8d6f1a9f0c68990d0198dbfd7cbf3d9cc4a0db334215ca1
                                                                                                                • Opcode Fuzzy Hash: 25e051ee84f5a1836dda3222278f4334694447e0a98cf775cf13d888adafe703
                                                                                                                • Instruction Fuzzy Hash: DE01ED75640108FFDB10DE98CD51F9EB3B9AF89314F20C255FA189B291D671EE02DB90
                                                                                                                Function 007A4586 Relevance: 1.5, APIs: 1, Instructions: 25libraryCOMMON
                                                                                                                Download Yara Rule

                                                                                                                Control-flow Graph

                                                                                                                • Executed
                                                                                                                • Not Executed
                                                                                                                control_flow_graph 249 7a4586-7a45c2 call 7a5016 call 7a4b56 LoadLibraryW
                                                                                                                APIs
                                                                                                                  • Part of subcall function 007A5016: GlobalAlloc.KERNELBASE(00000000,00000000,00000000), ref: 007A5046
                                                                                                                • LoadLibraryW.KERNELBASE(?), ref: 007A45B7
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000006.00000002.4013196722.00000000007A3000.00000020.00000001.01000000.00000008.sdmp, Offset: 007A3000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_6_2_7a3000_ComDebug.jbxd
                                                                                                                Similarity
                                                                                                                • API ID: AllocGlobalLibraryLoad
                                                                                                                • String ID:
                                                                                                                • API String ID: 3361179946-0
                                                                                                                • Opcode ID: f0635a325a859858965f79386bc2292b2c6fb1dc49c835a5e9fb86d575d4b663
                                                                                                                • Instruction ID: 7525c6b059c7ab7a83cd6e04e47a4f40b3332f4344eb90b26d38d25042b5bf01
                                                                                                                • Opcode Fuzzy Hash: f0635a325a859858965f79386bc2292b2c6fb1dc49c835a5e9fb86d575d4b663
                                                                                                                • Instruction Fuzzy Hash: B3E0E575E00108FBCB40DFA8DD4195D7BB8AF89311F108154F90C97340E531EE1197D1
                                                                                                                Function 007A65A6 Relevance: 1.5, APIs: 1, Instructions: 204COMMON
                                                                                                                Download Yara Rule

                                                                                                                Control-flow Graph

                                                                                                                • Executed
                                                                                                                • Not Executed
                                                                                                                control_flow_graph 254 7a65a6-7a65f4 call 7a4a86 259 7a65fd-7a6635 254->259 260 7a65f6-7a65f8 254->260 264 7a664a-7a6676 malloc 259->264 265 7a6637-7a6645 259->265 261 7a67d9-7a67dc 260->261 266 7a6681-7a6687 264->266 265->261 267 7a6689-7a6690 266->267 268 7a6707-7a670b 266->268 270 7a669b-7a66a1 267->270 271 7a672f-7a6746 call 7a5676 268->271 272 7a670d-7a672a 268->272 274 7a6702 270->274 275 7a66a3-7a66bd 270->275 279 7a6748-7a6765 271->279 280 7a6767-7a6793 271->280 272->261 274->266 281 7a66c2-7a6700 call 7a6416 275->281 279->261 283 7a679e-7a67a6 280->283 281->270 287 7a67cb-7a67d2 283->287 288 7a67a8-7a67c9 283->288 292 7a67d7 287->292 288->283 292->261
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000006.00000002.4013196722.00000000007A3000.00000020.00000001.01000000.00000008.sdmp, Offset: 007A3000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_6_2_7a3000_ComDebug.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: dbb50fb56afd143785edb8b3f824610f8feaaf99d530fe6b5dcc6f423fa21a8f
                                                                                                                • Instruction ID: a85574cd5c8ba9c595d30cbb44e8738396a7fd6de8e8bbab08dc7b6a4a1af662
                                                                                                                • Opcode Fuzzy Hash: dbb50fb56afd143785edb8b3f824610f8feaaf99d530fe6b5dcc6f423fa21a8f
                                                                                                                • Instruction Fuzzy Hash: 0191F7B5D10209EFCF08CF98D890AEEBBB5BF89304F148659E515AB351D734AA41CFA0
                                                                                                                Function 007A5016 Relevance: 1.3, APIs: 1, Instructions: 23memoryCOMMON
                                                                                                                Download Yara Rule

                                                                                                                Control-flow Graph

                                                                                                                • Executed
                                                                                                                • Not Executed
                                                                                                                control_flow_graph 316 7a5016-7a5024 317 7a5032-7a504b GlobalAlloc 316->317 318 7a5026-7a502f 316->318 318->317
                                                                                                                APIs
                                                                                                                • GlobalAlloc.KERNELBASE(00000000,00000000,00000000), ref: 007A5046
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000006.00000002.4013196722.00000000007A3000.00000020.00000001.01000000.00000008.sdmp, Offset: 007A3000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_6_2_7a3000_ComDebug.jbxd
                                                                                                                Similarity
                                                                                                                • API ID: AllocGlobal
                                                                                                                • String ID:
                                                                                                                • API String ID: 3761449716-0
                                                                                                                • Opcode ID: 9e5e02ec3ae36198606aa10b822d832cfef97aae54456fdc6b76e3fc24730506
                                                                                                                • Instruction ID: 6820dd22f81b42863c6f4fbae50cc68872d830e8d0dd4b689b7411f7eb512b86
                                                                                                                • Opcode Fuzzy Hash: 9e5e02ec3ae36198606aa10b822d832cfef97aae54456fdc6b76e3fc24730506
                                                                                                                • Instruction Fuzzy Hash: 4DF02278614209EFCB48DF58D580959B7A5FB89360F10C299BC598B341D631EE81DB94

                                                                                                                Non-executed Functions

                                                                                                                Function 007A3000 Relevance: 36.9, Strings: 29, Instructions: 626COMMON
                                                                                                                Download Yara Rule

                                                                                                                Control-flow Graph

                                                                                                                • Executed
                                                                                                                • Not Executed
                                                                                                                control_flow_graph 353 7a3000-7a36c0 455 7a36c2-7a36d5 353->455 456 7a36d7 353->456 457 7a36d9-7a36db 455->457 456->457 459 7a36dd-7a3725 457->459 460 7a3727-7a376a 457->460 467 7a376f-7a3a0e 459->467 460->467 503 7a3a10-7a3a12 467->503 504 7a3a17-7a3a69 call 7a4906 * 2 467->504 506 7a3bdf-7a3be2 503->506 510 7a3a70-7a3a77 504->510 511 7a3b8d-7a3b91 510->511 512 7a3a7d-7a3aae call 7a55c6 510->512 513 7a3b93-7a3b95 511->513 514 7a3b97-7a3bca call 7a3c56 511->514 518 7a3ab0 512->518 519 7a3ab5-7a3ae9 call 7a68c6 512->519 513->506 522 7a3bcc-7a3bd3 514->522 523 7a3bd5 514->523 518->511 526 7a3aeb-7a3aef 519->526 527 7a3b35-7a3b39 519->527 525 7a3bdc 522->525 523->525 525->506 526->527 528 7a3af1-7a3b33 call 7a5016 call 7a4906 526->528 529 7a3b3b-7a3b44 527->529 530 7a3b88 527->530 528->530 532 7a3b68-7a3b85 call 7a4906 529->532 533 7a3b46-7a3b66 call 7a4906 529->533 530->510 532->530 533->511
                                                                                                                Strings
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000006.00000002.4013196722.00000000007A3000.00000020.00000001.01000000.00000008.sdmp, Offset: 007A3000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_6_2_7a3000_ComDebug.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID: ASN1_INTEGER_get$ASN1_INTEGER_set$EVP_PKEY_CTX_get_cb$EVP_PKEY_CTX_get_keygen_info$EVP_PKEY_CTX_set_cb$EVP_PKEY_keygen$EVP_PKEY_meth_set_cleanup$EVP_PKEY_meth_set_copy$EVP_PKEY_meth_set_ctrl$EVP_PKEY_meth_set_decrypt$EVP_PKEY_meth_set_derive$EVP_PKEY_meth_set_encrypt$EVP_PKEY_meth_set_init$EVP_PKEY_meth_set_keygen$EVP_PKEY_meth_set_paramgen$EVP_PKEY_meth_set_sign$EVP_PKEY_meth_set_signctx$EVP_PKEY_meth_set_verify$EVP_PKEY_meth_set_verify_recover$EVP_PKEY_meth_set_verifyctx$HMAC_CTX_cleanup$HMAC_CTX_init$HMAC_Final$HMAC_Init_ex$HMAC_Update$OBJ_nid2ln$OBJ_nid2obj$OBJ_nid2sn$OBJ_obj2nid
                                                                                                                • API String ID: 0-1034374683
                                                                                                                • Opcode ID: e357e797567c68f25c9f1189d0f6fa6853fb02746ce1290f92d42bc8afe56433
                                                                                                                • Instruction ID: 6ab945b67adb415c165fe7bb9e968181f211d730bd10a25d94f13f010a260aef
                                                                                                                • Opcode Fuzzy Hash: e357e797567c68f25c9f1189d0f6fa6853fb02746ce1290f92d42bc8afe56433
                                                                                                                • Instruction Fuzzy Hash: 84325271A14550DB6355EFBE988504B76E3EBC7300BC5C73BE014DB325EA3E489AAB12
                                                                                                                Function 007A5746 Relevance: 1.3, Strings: 1, Instructions: 9COMMON
                                                                                                                Download Yara Rule
                                                                                                                Strings
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000006.00000002.4013196722.00000000007A3000.00000020.00000001.01000000.00000008.sdmp, Offset: 007A3000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_6_2_7a3000_ComDebug.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID: fGz
                                                                                                                • API String ID: 0-3170053984
                                                                                                                • Opcode ID: 3585cc5e86e4b4f2c0b231822883ac188ad7ac996d5f3a190238e1ab2981f7b1
                                                                                                                • Instruction ID: 3aed54436f5767a83b01f55326dea564c088d466d319321e9a1229c6b183aa19
                                                                                                                • Opcode Fuzzy Hash: 3585cc5e86e4b4f2c0b231822883ac188ad7ac996d5f3a190238e1ab2981f7b1
                                                                                                                • Instruction Fuzzy Hash: DCC04C7595664CEBC711CB89D541A59B7FCE709650F100195EC0893700D5356E109595

                                                                                                                Execution Graph

                                                                                                                Execution Coverage:1.6%
                                                                                                                Dynamic/Decrypted Code Coverage:0%
                                                                                                                Signature Coverage:12.6%
                                                                                                                Total number of Nodes:223
                                                                                                                Total number of Limit Nodes:4
                                                                                                                execution_graph 33491 7ff6ec4e154c 33492 7ff6ec4e15b3 33491->33492 33493 7ff6ec4e1569 GetModuleHandleW 33491->33493 33501 7ff6ec4e1340 33492->33501 33493->33492 33498 7ff6ec4e1576 33493->33498 33496 7ff6ec4e15f5 33498->33492 33515 7ff6ec4e16e4 GetModuleHandleExW 33498->33515 33499 7ff6ec4e1607 33521 7ff6ec4f1c48 EnterCriticalSection 33501->33521 33503 7ff6ec4e135c 33504 7ff6ec4e1434 14 API calls 33503->33504 33505 7ff6ec4e1365 33504->33505 33506 7ff6ec4f1ca8 Concurrency::details::SchedulerProxy::DeleteThis LeaveCriticalSection 33505->33506 33507 7ff6ec4e136d 33506->33507 33507->33496 33508 7ff6ec4e1608 33507->33508 33522 7ff6ec4f1f40 33508->33522 33511 7ff6ec4e1642 33513 7ff6ec4e16e4 3 API calls 33511->33513 33512 7ff6ec4e1631 GetCurrentProcess TerminateProcess 33512->33511 33514 7ff6ec4e1649 ExitProcess 33513->33514 33516 7ff6ec4e170a GetProcAddress 33515->33516 33517 7ff6ec4e1729 33515->33517 33516->33517 33518 7ff6ec4e1721 33516->33518 33519 7ff6ec4e1733 FreeLibrary 33517->33519 33520 7ff6ec4e1739 33517->33520 33518->33517 33519->33520 33520->33492 33523 7ff6ec4f1f5e 33522->33523 33524 7ff6ec4e1615 33522->33524 33526 7ff6ec4e8634 33523->33526 33524->33511 33524->33512 33529 7ff6ec4e81a8 33526->33529 33530 7ff6ec4e8204 try_get_first_available_module 33529->33530 33531 7ff6ec4e8209 33529->33531 33530->33531 33532 7ff6ec4e8238 LoadLibraryExW 33530->33532 33536 7ff6ec4e82ec 33530->33536 33537 7ff6ec4e82d1 FreeLibrary 33530->33537 33538 7ff6ec4e8293 LoadLibraryExW 33530->33538 33531->33524 33532->33530 33533 7ff6ec4e8259 GetLastError 33532->33533 33533->33530 33534 7ff6ec4e82fa GetProcAddress 33535 7ff6ec4e830b 33534->33535 33535->33531 33536->33531 33536->33534 33537->33530 33538->33530 33539 7ff6ec4b789c 33562 7ff6ec4b8414 33539->33562 33544 7ff6ec4b78d1 __scrt_acquire_startup_lock 33547 7ff6ec4b7a11 33544->33547 33550 7ff6ec4b78ef __scrt_release_startup_lock 33544->33550 33545 7ff6ec4b7a07 33611 7ff6ec4b8550 7 API calls 2 library calls 33545->33611 33612 7ff6ec4b8550 7 API calls 2 library calls 33547->33612 33549 7ff6ec4b7914 33550->33549 33552 7ff6ec4b799a 33550->33552 33608 7ff6ec4e1788 37 API calls __InternalCxxFrameHandler 33550->33608 33551 7ff6ec4b7a1c _purecall 33573 7ff6ec4e1234 33552->33573 33555 7ff6ec4b799f 33579 7ff6ec4b52e0 33555->33579 33559 7ff6ec4b79c3 33559->33551 33610 7ff6ec4b82dc 8 API calls __vcrt_uninitialize 33559->33610 33561 7ff6ec4b79da 33561->33549 33563 7ff6ec4b8437 GetSystemTimeAsFileTime GetCurrentThreadId GetCurrentProcessId QueryPerformanceCounter 33562->33563 33564 7ff6ec4b78a5 33562->33564 33563->33564 33565 7ff6ec4b8124 33564->33565 33566 7ff6ec4b8146 33565->33566 33613 7ff6ec4b9184 33566->33613 33569 7ff6ec4b78c9 33569->33544 33569->33545 33574 7ff6ec4e1244 33573->33574 33578 7ff6ec4e1259 33573->33578 33574->33578 33674 7ff6ec4e0930 34 API calls Concurrency::details::_Concurrent_queue_iterator_base_v4::~_Concurrent_queue_iterator_base_v4 33574->33674 33576 7ff6ec4e1262 33576->33578 33675 7ff6ec4e0d90 15 API calls 3 library calls 33576->33675 33578->33555 33580 7ff6ec4b532b 33579->33580 33581 7ff6ec4b5336 CharNextW 33580->33581 33606 7ff6ec4b5330 33580->33606 33581->33606 33582 7ff6ec4b5442 33583 7ff6ec4b547f CharNextW 33582->33583 33584 7ff6ec4b5455 33582->33584 33587 7ff6ec4b548b 33582->33587 33583->33587 33711 7ff6ec4b4770 FormatMessageW 33584->33711 33587->33584 33590 7ff6ec4b551c 33587->33590 33676 7ff6ec4c676c 33587->33676 33588 7ff6ec4b54e9 33717 7ff6ec4b76e0 33588->33717 33693 7ff6ec4b28b0 33590->33693 33593 7ff6ec4b55c2 33593->33588 33596 7ff6ec4b55cd GetCurrentProcess OpenProcessToken 33593->33596 33594 7ff6ec4b5577 33597 7ff6ec4b5584 33594->33597 33598 7ff6ec4b55a3 33594->33598 33595 7ff6ec4df4f0 33 API calls 33595->33606 33599 7ff6ec4b5648 InitiateSystemShutdownExW 33596->33599 33600 7ff6ec4b55ea LookupPrivilegeValueW 33596->33600 33605 7ff6ec4b4770 68 API calls 33597->33605 33603 7ff6ec4b4770 68 API calls 33598->33603 33599->33588 33601 7ff6ec4b5642 CloseHandle 33600->33601 33602 7ff6ec4b5607 AdjustTokenPrivileges 33600->33602 33601->33599 33602->33601 33603->33588 33604 7ff6ec4df44c 31 API calls 33604->33606 33605->33588 33606->33582 33606->33595 33606->33604 33608->33552 33609 7ff6ec4b86e4 GetModuleHandleW 33609->33559 33610->33561 33611->33547 33612->33551 33614 7ff6ec4b918d __vcrt_initialize_winapi_thunks __vcrt_initialize 33613->33614 33627 7ff6ec4b9d08 33614->33627 33618 7ff6ec4b91a4 33619 7ff6ec4b814b 33618->33619 33634 7ff6ec4b9d6c DeleteCriticalSection 33618->33634 33619->33569 33621 7ff6ec4e4568 33619->33621 33622 7ff6ec4f5814 33621->33622 33623 7ff6ec4b8158 33622->33623 33651 7ff6ec4e9fb0 33622->33651 33662 7ff6ec4e7830 33622->33662 33623->33569 33626 7ff6ec4b91e0 8 API calls 3 library calls 33623->33626 33626->33569 33628 7ff6ec4b9d10 33627->33628 33630 7ff6ec4b9d41 33628->33630 33631 7ff6ec4b9197 33628->33631 33635 7ff6ec4ba598 33628->33635 33640 7ff6ec4b9d6c DeleteCriticalSection 33630->33640 33631->33619 33633 7ff6ec4b9c9c 8 API calls 3 library calls 33631->33633 33633->33618 33634->33619 33641 7ff6ec4b9fe8 33635->33641 33638 7ff6ec4ba5e3 InitializeCriticalSectionAndSpinCount 33639 7ff6ec4ba5d8 33638->33639 33639->33628 33640->33631 33642 7ff6ec4ba049 33641->33642 33649 7ff6ec4ba044 try_get_first_available_module 33641->33649 33642->33638 33642->33639 33643 7ff6ec4ba12c 33643->33642 33646 7ff6ec4ba13a GetProcAddress 33643->33646 33644 7ff6ec4ba078 LoadLibraryExW 33645 7ff6ec4ba099 GetLastError 33644->33645 33644->33649 33645->33649 33647 7ff6ec4ba14b 33646->33647 33647->33642 33648 7ff6ec4ba111 FreeLibrary 33648->33649 33649->33642 33649->33643 33649->33644 33649->33648 33650 7ff6ec4ba0d3 LoadLibraryExW 33649->33650 33650->33649 33669 7ff6ec4f1c48 EnterCriticalSection 33651->33669 33653 7ff6ec4e9fc0 33654 7ff6ec4ece60 32 API calls 33653->33654 33655 7ff6ec4e9fc9 33654->33655 33656 7ff6ec4e9fd7 33655->33656 33657 7ff6ec4e9db4 34 API calls 33655->33657 33658 7ff6ec4f1ca8 Concurrency::details::SchedulerProxy::DeleteThis LeaveCriticalSection 33656->33658 33659 7ff6ec4e9fd2 33657->33659 33660 7ff6ec4e9fe3 33658->33660 33661 7ff6ec4e9ea4 GetStdHandle GetFileType 33659->33661 33660->33622 33661->33656 33670 7ff6ec4e8924 33662->33670 33664 7ff6ec4e7840 33665 7ff6ec4e7764 _set_errno_from_matherr 14 API calls 33664->33665 33668 7ff6ec4e784b 33664->33668 33666 7ff6ec4e7854 33665->33666 33667 7ff6ec4e7870 __vcrt_uninitialize_ptd 6 API calls 33666->33667 33666->33668 33667->33668 33668->33622 33671 7ff6ec4e81a8 try_get_function 5 API calls 33670->33671 33672 7ff6ec4e894c TlsAlloc 33671->33672 33674->33576 33675->33578 33677 7ff6ec4c6779 33676->33677 33678 7ff6ec4c679d 33676->33678 33677->33678 33679 7ff6ec4c677e 33677->33679 33680 7ff6ec4c67d7 33678->33680 33683 7ff6ec4c67f6 33678->33683 33726 7ff6ec4e6b7c 14 API calls _set_errno_from_matherr 33679->33726 33728 7ff6ec4e6b7c 14 API calls _set_errno_from_matherr 33680->33728 33730 7ff6ec4c65d8 37 API calls 2 library calls 33683->33730 33684 7ff6ec4c6783 33727 7ff6ec4e69d0 31 API calls _invalid_parameter_noinfo_noreturn 33684->33727 33685 7ff6ec4c67dc 33729 7ff6ec4e69d0 31 API calls _invalid_parameter_noinfo_noreturn 33685->33729 33688 7ff6ec4c678e 33688->33587 33690 7ff6ec4c67e7 TranslateName 33690->33587 33691 7ff6ec4df19c 38 API calls TranslateName 33692 7ff6ec4c6803 33691->33692 33692->33690 33692->33691 33694 7ff6ec4b28e4 33693->33694 33695 7ff6ec4b29cc 33693->33695 33694->33695 33696 7ff6ec4b28ed LoadStringW 33694->33696 33697 7ff6ec4b76e0 DName::DName 8 API calls 33695->33697 33696->33695 33698 7ff6ec4b290e LoadStringW 33696->33698 33699 7ff6ec4b2a2e 33697->33699 33698->33695 33700 7ff6ec4b292e LoadStringW 33698->33700 33699->33588 33699->33593 33699->33594 33700->33695 33701 7ff6ec4b2951 33700->33701 33731 7ff6ec4b41d0 33701->33731 33704 7ff6ec4b29d0 33706 7ff6ec4b29f2 33704->33706 33707 7ff6ec4b29d7 33704->33707 33705 7ff6ec4b29ba 33708 7ff6ec4b4770 68 API calls 33705->33708 33710 7ff6ec4b4770 68 API calls 33706->33710 33709 7ff6ec4b4770 68 API calls 33707->33709 33708->33695 33709->33695 33710->33695 33712 7ff6ec4b4811 33711->33712 33714 7ff6ec4b47c7 33711->33714 33712->33588 33713 7ff6ec4b480b LocalFree 33713->33712 33714->33713 33758 7ff6ec4c6c8c 33714->33758 33718 7ff6ec4b76ea 33717->33718 33719 7ff6ec4b550b 33718->33719 33720 7ff6ec4b7b50 IsProcessorFeaturePresent 33718->33720 33719->33609 33721 7ff6ec4b7b67 33720->33721 33777 7ff6ec4b7e54 RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind 33721->33777 33723 7ff6ec4b7b7a 33778 7ff6ec4b7b18 SetUnhandledExceptionFilter UnhandledExceptionFilter GetCurrentProcess TerminateProcess 33723->33778 33726->33684 33727->33688 33728->33685 33729->33690 33730->33692 33732 7ff6ec4b4254 33731->33732 33735 7ff6ec4b425c 33731->33735 33733 7ff6ec4b76e0 DName::DName 8 API calls 33732->33733 33734 7ff6ec4b29ab 33733->33734 33734->33695 33734->33704 33734->33705 33735->33732 33736 7ff6ec4b42ac SetupDiClassGuidsFromNameExW 33735->33736 33745 7ff6ec4b42dd 33735->33745 33738 7ff6ec4b42d2 GetLastError 33736->33738 33736->33745 33737 7ff6ec4b4425 33739 7ff6ec4b4464 SetupDiGetClassDevsExW 33737->33739 33740 7ff6ec4b443e SetupDiCreateDeviceInfoListExW 33737->33740 33743 7ff6ec4b42e4 33738->33743 33738->33745 33747 7ff6ec4b44a9 33739->33747 33740->33747 33741 7ff6ec4b43b8 CharNextW 33741->33745 33742 7ff6ec4b43d6 CharNextW 33742->33745 33743->33732 33746 7ff6ec4b42fd SetupDiDestroyDeviceInfoList 33743->33746 33744 7ff6ec4b4516 SetupDiGetDeviceInfoListDetailW 33744->33743 33748 7ff6ec4b4532 SetupDiEnumDeviceInfo 33744->33748 33745->33737 33745->33741 33745->33742 33745->33743 33746->33732 33747->33743 33747->33744 33749 7ff6ec4b44e8 SetupDiOpenDeviceInfoW 33747->33749 33750 7ff6ec4b4509 33747->33750 33748->33743 33756 7ff6ec4b456a 33748->33756 33749->33747 33750->33744 33751 7ff6ec4b46ec SetupDiEnumDeviceInfo 33751->33743 33751->33756 33752 7ff6ec4b45a9 CM_Get_Device_ID_ExW 33752->33756 33754 7ff6ec4b4820 SetupDiGetDeviceRegistryPropertyW GetLastError SetupDiGetDeviceRegistryPropertyW 33754->33756 33755 7ff6ec4b50e0 41 API calls 33755->33756 33756->33743 33756->33751 33756->33752 33756->33754 33756->33755 33757 7ff6ec4b4f10 41 API calls TranslateName 33756->33757 33757->33756 33759 7ff6ec4c6ca3 33758->33759 33760 7ff6ec4c6cb8 33758->33760 33774 7ff6ec4e6b7c 14 API calls _set_errno_from_matherr 33759->33774 33760->33759 33762 7ff6ec4c6cbd 33760->33762 33767 7ff6ec4c6b3c 33762->33767 33763 7ff6ec4c6ca8 33775 7ff6ec4e69d0 31 API calls _invalid_parameter_noinfo_noreturn 33763->33775 33766 7ff6ec4b4806 33766->33713 33776 7ff6ec4c6b24 EnterCriticalSection 33767->33776 33769 7ff6ec4c6b59 33770 7ff6ec4c6bfc 64 API calls 33769->33770 33771 7ff6ec4c6b62 33770->33771 33772 7ff6ec4c6b30 LeaveCriticalSection 33771->33772 33773 7ff6ec4c6b6c 33772->33773 33773->33766 33774->33763 33775->33766 33777->33723

                                                                                                                Executed Functions

                                                                                                                Function 00007FF6EC4B41D0 Relevance: 18.3, APIs: 12, Instructions: 338COMMON
                                                                                                                Download Yara Rule

                                                                                                                Control-flow Graph

                                                                                                                • Executed
                                                                                                                • Not Executed
                                                                                                                control_flow_graph 0 7ff6ec4b41d0-7ff6ec4b4252 1 7ff6ec4b4254-7ff6ec4b4257 0->1 2 7ff6ec4b425c-7ff6ec4b4280 call 7ff6ec4b7638 0->2 3 7ff6ec4b430a-7ff6ec4b4333 call 7ff6ec4b76e0 1->3 8 7ff6ec4b4306 2->8 9 7ff6ec4b4286-7ff6ec4b4288 2->9 8->3 10 7ff6ec4b428e-7ff6ec4b4298 9->10 11 7ff6ec4b436f 9->11 13 7ff6ec4b429e-7ff6ec4b42a6 10->13 14 7ff6ec4b4346 10->14 12 7ff6ec4b4372 11->12 15 7ff6ec4b4378-7ff6ec4b4383 12->15 13->14 16 7ff6ec4b42ac-7ff6ec4b42d0 SetupDiClassGuidsFromNameExW 13->16 17 7ff6ec4b4349-7ff6ec4b434c 14->17 18 7ff6ec4b4434-7ff6ec4b4437 15->18 19 7ff6ec4b4389-7ff6ec4b439f 15->19 20 7ff6ec4b42d2-7ff6ec4b42db GetLastError 16->20 21 7ff6ec4b42dd-7ff6ec4b42e2 16->21 17->12 22 7ff6ec4b434e-7ff6ec4b435c 17->22 23 7ff6ec4b4464-7ff6ec4b44a3 SetupDiGetClassDevsExW 18->23 24 7ff6ec4b4439-7ff6ec4b443c 18->24 25 7ff6ec4b43a0-7ff6ec4b43b6 19->25 20->21 26 7ff6ec4b42ea 20->26 28 7ff6ec4b4334-7ff6ec4b4344 21->28 29 7ff6ec4b42e4 21->29 22->15 27 7ff6ec4b435e-7ff6ec4b4363 22->27 32 7ff6ec4b44a9-7ff6ec4b44b5 23->32 24->23 30 7ff6ec4b443e-7ff6ec4b4462 SetupDiCreateDeviceInfoListExW 24->30 33 7ff6ec4b43b8-7ff6ec4b43c8 CharNextW 25->33 34 7ff6ec4b43cd-7ff6ec4b43d4 25->34 31 7ff6ec4b42ef-7ff6ec4b42fb call 7ff6ec4b7640 26->31 27->15 35 7ff6ec4b4365-7ff6ec4b436d 27->35 28->17 36 7ff6ec4b42e6 29->36 30->32 31->8 46 7ff6ec4b42fd-7ff6ec4b4300 SetupDiDestroyDeviceInfoList 31->46 32->26 38 7ff6ec4b44bb-7ff6ec4b44c8 32->38 33->34 39 7ff6ec4b43e3-7ff6ec4b43ed call 7ff6ec4b8e50 34->39 40 7ff6ec4b43d6-7ff6ec4b43e1 CharNextW 34->40 35->12 36->26 42 7ff6ec4b4516-7ff6ec4b452c SetupDiGetDeviceInfoListDetailW 38->42 43 7ff6ec4b44ca-7ff6ec4b44dd 38->43 44 7ff6ec4b43f2-7ff6ec4b4408 39->44 40->44 42->31 49 7ff6ec4b4532-7ff6ec4b4564 SetupDiEnumDeviceInfo 42->49 47 7ff6ec4b44e2-7ff6ec4b44e6 43->47 50 7ff6ec4b440f 44->50 51 7ff6ec4b440a-7ff6ec4b440d 44->51 46->8 52 7ff6ec4b44ff-7ff6ec4b4507 47->52 53 7ff6ec4b44e8-7ff6ec4b44f9 SetupDiOpenDeviceInfoW 47->53 54 7ff6ec4b4720-7ff6ec4b4725 49->54 55 7ff6ec4b456a 49->55 56 7ff6ec4b4415-7ff6ec4b441f 50->56 51->50 51->56 52->47 57 7ff6ec4b4509-7ff6ec4b4511 52->57 53->52 54->31 58 7ff6ec4b4570-7ff6ec4b4573 55->58 56->25 59 7ff6ec4b4425-7ff6ec4b442f 56->59 57->42 60 7ff6ec4b46c2-7ff6ec4b46e1 58->60 61 7ff6ec4b4579-7ff6ec4b4584 58->61 59->18 60->36 68 7ff6ec4b46e7 60->68 62 7ff6ec4b46ec-7ff6ec4b4715 SetupDiEnumDeviceInfo 61->62 63 7ff6ec4b458a-7ff6ec4b459f 61->63 62->58 66 7ff6ec4b471b 62->66 64 7ff6ec4b45a0-7ff6ec4b45a3 63->64 64->60 67 7ff6ec4b45a9-7ff6ec4b45d0 CM_Get_Device_ID_ExW 64->67 66->54 69 7ff6ec4b45d2-7ff6ec4b45d4 67->69 70 7ff6ec4b45db-7ff6ec4b45eb 67->70 68->62 69->70 71 7ff6ec4b460f-7ff6ec4b4637 call 7ff6ec4b4820 * 2 70->71 72 7ff6ec4b45ed-7ff6ec4b45fe call 7ff6ec4b4f10 70->72 81 7ff6ec4b463c-7ff6ec4b464c call 7ff6ec4b50e0 71->81 77 7ff6ec4b4604-7ff6ec4b460a 72->77 78 7ff6ec4b46a5-7ff6ec4b46b7 72->78 77->78 78->64 80 7ff6ec4b46bd-7ff6ec4b46c0 78->80 80->60 80->68 84 7ff6ec4b464e-7ff6ec4b465b call 7ff6ec4b50e0 81->84 85 7ff6ec4b465d 81->85 84->85 87 7ff6ec4b4663-7ff6ec4b4666 84->87 85->87 89 7ff6ec4b467f-7ff6ec4b4682 87->89 90 7ff6ec4b4668-7ff6ec4b466f 87->90 93 7ff6ec4b4684-7ff6ec4b468b 89->93 94 7ff6ec4b469b-7ff6ec4b46a0 89->94 91 7ff6ec4b4671 call 7ff6ec4b7640 90->91 92 7ff6ec4b4676-7ff6ec4b467a call 7ff6ec4b7640 90->92 91->92 92->89 97 7ff6ec4b4692-7ff6ec4b4696 call 7ff6ec4b7640 93->97 98 7ff6ec4b468d call 7ff6ec4b7640 93->98 94->78 97->94 98->97
                                                                                                                APIs
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 0000000C.00000002.2574093388.00007FF6EC4B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF6EC4B0000, based on PE: true
                                                                                                                • Associated: 0000000C.00000002.2574070380.00007FF6EC4B0000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                • Associated: 0000000C.00000002.2574132408.00007FF6EC504000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                • Associated: 0000000C.00000002.2574154940.00007FF6EC517000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                • Associated: 0000000C.00000002.2574176551.00007FF6EC51A000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_12_2_7ff6ec4b0000_tapinstall.jbxd
                                                                                                                Similarity
                                                                                                                • API ID: Setup$Device$Info$CharListNext$ClassEnumErrorLastPropertyRegistry$CreateDestroyDetailDevice_DevsFromGet_GuidsNameOpen
                                                                                                                • String ID:
                                                                                                                • API String ID: 1969824741-0
                                                                                                                • Opcode ID: 13dcc399ef928ee62f8ede801381d0fdfc620e090082716fb5c5ccbb41840535
                                                                                                                • Instruction ID: 2b420993759a18c96f62eda22e030b5341a94ddff75ca2dfb6504d30aeadf1b1
                                                                                                                • Opcode Fuzzy Hash: 13dcc399ef928ee62f8ede801381d0fdfc620e090082716fb5c5ccbb41840535
                                                                                                                • Instruction Fuzzy Hash: 2FE19B33B08A8686EB209F25E5403AE67A0FB44B9CF046135DE4D87B98DF3EE559C705
                                                                                                                Function 00007FF6EC4B52E0 Relevance: 16.0, APIs: 8, Strings: 1, Instructions: 230shutdownCOMMON
                                                                                                                Download Yara Rule

                                                                                                                Control-flow Graph

                                                                                                                • Executed
                                                                                                                • Not Executed
                                                                                                                control_flow_graph 101 7ff6ec4b52e0-7ff6ec4b532e call 7ff6ec4b8ecc 104 7ff6ec4b5330-7ff6ec4b5334 101->104 105 7ff6ec4b5336-7ff6ec4b533f CharNextW 101->105 106 7ff6ec4b5342-7ff6ec4b5362 104->106 105->106 107 7ff6ec4b5368-7ff6ec4b536f 106->107 108 7ff6ec4b544c-7ff6ec4b5453 106->108 109 7ff6ec4b5371-7ff6ec4b5380 107->109 110 7ff6ec4b5455-7ff6ec4b5462 call 7ff6ec4c6a60 108->110 111 7ff6ec4b5467-7ff6ec4b547d 108->111 112 7ff6ec4b5442-7ff6ec4b5447 109->112 113 7ff6ec4b5386-7ff6ec4b5391 109->113 122 7ff6ec4b54dc-7ff6ec4b54e9 call 7ff6ec4b4770 110->122 114 7ff6ec4b547f-7ff6ec4b5488 CharNextW 111->114 115 7ff6ec4b548b-7ff6ec4b5499 111->115 112->108 118 7ff6ec4b541e-7ff6ec4b5423 113->118 119 7ff6ec4b5397-7ff6ec4b539e 113->119 114->115 120 7ff6ec4b54cd-7ff6ec4b54d7 call 7ff6ec4c6a60 115->120 121 7ff6ec4b549b-7ff6ec4b549e 115->121 118->112 126 7ff6ec4b5425-7ff6ec4b542d 118->126 123 7ff6ec4b53a0-7ff6ec4b53a7 119->123 124 7ff6ec4b540d-7ff6ec4b5412 119->124 120->122 125 7ff6ec4b54a0-7ff6ec4b54ad call 7ff6ec4c676c 121->125 140 7ff6ec4b54ee-7ff6ec4b551b call 7ff6ec4b76e0 122->140 128 7ff6ec4b5400-7ff6ec4b5405 123->128 129 7ff6ec4b53a9-7ff6ec4b53b1 123->129 124->112 131 7ff6ec4b5414-7ff6ec4b541c 124->131 142 7ff6ec4b54af-7ff6ec4b54b2 125->142 143 7ff6ec4b54b4-7ff6ec4b54cb 125->143 126->112 132 7ff6ec4b542f 126->132 128->112 135 7ff6ec4b5407-7ff6ec4b540b 128->135 129->112 136 7ff6ec4b53b7-7ff6ec4b53bc 129->136 138 7ff6ec4b5434-7ff6ec4b543c 131->138 132->138 135->138 136->112 141 7ff6ec4b53c2-7ff6ec4b53fe call 7ff6ec4c6a60 call 7ff6ec4df44c call 7ff6ec4df4f0 call 7ff6ec4c6a60 call 7ff6ec4df44c call 7ff6ec4df4f0 136->141 138->109 138->112 141->138 142->143 146 7ff6ec4b551c-7ff6ec4b5560 call 7ff6ec4b28b0 142->146 143->120 143->125 149 7ff6ec4b5566-7ff6ec4b556c 146->149 151 7ff6ec4b5572-7ff6ec4b5575 149->151 152 7ff6ec4b5668-7ff6ec4b566a 149->152 154 7ff6ec4b55c2-7ff6ec4b55c7 151->154 155 7ff6ec4b5577-7ff6ec4b5582 151->155 152->140 154->152 157 7ff6ec4b55cd-7ff6ec4b55e8 GetCurrentProcess OpenProcessToken 154->157 158 7ff6ec4b5584-7ff6ec4b559e call 7ff6ec4c6a60 call 7ff6ec4b4770 155->158 159 7ff6ec4b55a3-7ff6ec4b55bd call 7ff6ec4c6a60 call 7ff6ec4b4770 155->159 161 7ff6ec4b5648-7ff6ec4b5662 InitiateSystemShutdownExW 157->161 162 7ff6ec4b55ea-7ff6ec4b5605 LookupPrivilegeValueW 157->162 158->140 159->140 161->152 166 7ff6ec4b5642 CloseHandle 162->166 167 7ff6ec4b5607-7ff6ec4b563d AdjustTokenPrivileges 162->167 166->161 167->166
                                                                                                                APIs
                                                                                                                Strings
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 0000000C.00000002.2574093388.00007FF6EC4B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF6EC4B0000, based on PE: true
                                                                                                                • Associated: 0000000C.00000002.2574070380.00007FF6EC4B0000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                • Associated: 0000000C.00000002.2574132408.00007FF6EC504000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                • Associated: 0000000C.00000002.2574154940.00007FF6EC517000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                • Associated: 0000000C.00000002.2574176551.00007FF6EC51A000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_12_2_7ff6ec4b0000_tapinstall.jbxd
                                                                                                                Similarity
                                                                                                                • API ID: CharNextProcessToken$AdjustCloseCurrentHandleInitiateLookupOpenPrivilegePrivilegesShutdownSystemValue
                                                                                                                • String ID: SeShutdownPrivilege
                                                                                                                • API String ID: 155161866-3733053543
                                                                                                                • Opcode ID: 690a37cff1ebd05a7ace56d9b70eff1ddf708b3d2d7106c5651630866a9856b2
                                                                                                                • Instruction ID: 08ee9eb081b4b71aae45e6fb54e960ad518a3eaf83b250d80d20a802e8f51f11
                                                                                                                • Opcode Fuzzy Hash: 690a37cff1ebd05a7ace56d9b70eff1ddf708b3d2d7106c5651630866a9856b2
                                                                                                                • Instruction Fuzzy Hash: D291A223A0964681FB649B19E4143BEA690FF84B8DF144035DE4EC7799DF3EE449C70A
                                                                                                                Function 00007FF6EC4B4820 Relevance: 4.6, APIs: 3, Instructions: 78COMMON
                                                                                                                Download Yara Rule

                                                                                                                Control-flow Graph

                                                                                                                APIs
                                                                                                                • SetupDiGetDeviceRegistryPropertyW.SETUPAPI(?,?,?,?,?,?,00007FF6EC4B4624), ref: 00007FF6EC4B487F
                                                                                                                • GetLastError.KERNEL32(?,?,?,?,?,?,00007FF6EC4B4624), ref: 00007FF6EC4B4894
                                                                                                                • SetupDiGetDeviceRegistryPropertyW.SETUPAPI(?,?,?,?,?,?,?,?,?,00007FF6EC4B4624), ref: 00007FF6EC4B4906
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 0000000C.00000002.2574093388.00007FF6EC4B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF6EC4B0000, based on PE: true
                                                                                                                • Associated: 0000000C.00000002.2574070380.00007FF6EC4B0000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                • Associated: 0000000C.00000002.2574132408.00007FF6EC504000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                • Associated: 0000000C.00000002.2574154940.00007FF6EC517000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                • Associated: 0000000C.00000002.2574176551.00007FF6EC51A000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_12_2_7ff6ec4b0000_tapinstall.jbxd
                                                                                                                Similarity
                                                                                                                • API ID: DevicePropertyRegistrySetup$ErrorLast
                                                                                                                • String ID:
                                                                                                                • API String ID: 2536536880-0
                                                                                                                • Opcode ID: b08a90b2f0a11205ef17a48f86861e3f30d8e072d4f5542cce9f06ad5cb14e1f
                                                                                                                • Instruction ID: 243431fa39989f387397a7aa24ccabedf44d6f9c54813352fcd3d4100a6acaa4
                                                                                                                • Opcode Fuzzy Hash: b08a90b2f0a11205ef17a48f86861e3f30d8e072d4f5542cce9f06ad5cb14e1f
                                                                                                                • Instruction Fuzzy Hash: 3E31B522A08742C2EA24CF25B45036E62A0FF85B94F445235EE9D87BD9EF3DD449C748
                                                                                                                Function 00007FF6EC4B789C Relevance: 9.1, APIs: 6, Instructions: 103COMMON
                                                                                                                Download Yara Rule

                                                                                                                Control-flow Graph

                                                                                                                APIs
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 0000000C.00000002.2574093388.00007FF6EC4B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF6EC4B0000, based on PE: true
                                                                                                                • Associated: 0000000C.00000002.2574070380.00007FF6EC4B0000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                • Associated: 0000000C.00000002.2574132408.00007FF6EC504000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                • Associated: 0000000C.00000002.2574154940.00007FF6EC517000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                • Associated: 0000000C.00000002.2574176551.00007FF6EC51A000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_12_2_7ff6ec4b0000_tapinstall.jbxd
                                                                                                                Similarity
                                                                                                                • API ID: CurrentTime__scrt_fastfail$CounterFilePerformanceProcessQuerySystemThread__scrt_acquire_startup_lock__scrt_is_managed_app__scrt_release_startup_lock__security_init_cookie__vcrt_initialize
                                                                                                                • String ID:
                                                                                                                • API String ID: 1566696921-0
                                                                                                                • Opcode ID: 5dc8b7a00be0a8ea12488835e6aaa7bc2ada64c6aaa8309da5ac7729ad6df155
                                                                                                                • Instruction ID: ecd45fa23af193ae679aab47215750a1bf4df1c8d33e422d76f15f7bca63b3ec
                                                                                                                • Opcode Fuzzy Hash: 5dc8b7a00be0a8ea12488835e6aaa7bc2ada64c6aaa8309da5ac7729ad6df155
                                                                                                                • Instruction Fuzzy Hash: F7414A23E0C643C5FA54AB2594123BD2390AF4578CF454434E94DCB2DBEE2EAA4DC32B
                                                                                                                Function 00007FF6EC4F716C Relevance: 7.7, APIs: 5, Instructions: 203COMMON
                                                                                                                Download Yara Rule

                                                                                                                Control-flow Graph

                                                                                                                • Executed
                                                                                                                • Not Executed
                                                                                                                control_flow_graph 246 7ff6ec4f716c-7ff6ec4f718f 247 7ff6ec4f7195-7ff6ec4f7198 246->247 248 7ff6ec4f742c 246->248 249 7ff6ec4f71ba-7ff6ec4f71e0 247->249 250 7ff6ec4f719a-7ff6ec4f71b5 call 7ff6ec4e6b5c call 7ff6ec4e6b7c call 7ff6ec4e69d0 247->250 251 7ff6ec4f742e-7ff6ec4f7445 248->251 252 7ff6ec4f71e2-7ff6ec4f71e9 249->252 253 7ff6ec4f71eb-7ff6ec4f71f1 249->253 250->251 252->250 252->253 255 7ff6ec4f71f3-7ff6ec4f71fc call 7ff6ec4fe524 253->255 256 7ff6ec4f7201-7ff6ec4f7211 call 7ff6ec4f7a4c 253->256 255->256 263 7ff6ec4f731a-7ff6ec4f732a 256->263 264 7ff6ec4f7217-7ff6ec4f7227 256->264 266 7ff6ec4f732c-7ff6ec4f7333 263->266 267 7ff6ec4f737b-7ff6ec4f73a0 WriteFile 263->267 264->263 268 7ff6ec4f722d-7ff6ec4f7240 call 7ff6ec4e75e8 264->268 270 7ff6ec4f7335-7ff6ec4f7338 266->270 271 7ff6ec4f7367-7ff6ec4f7374 call 7ff6ec4f6ce0 266->271 273 7ff6ec4f73a2-7ff6ec4f73a8 GetLastError 267->273 274 7ff6ec4f73ab 267->274 284 7ff6ec4f7242-7ff6ec4f7252 268->284 285 7ff6ec4f7258-7ff6ec4f7274 GetConsoleMode 268->285 276 7ff6ec4f7353-7ff6ec4f7365 call 7ff6ec4f6f00 270->276 277 7ff6ec4f733a-7ff6ec4f733d 270->277 286 7ff6ec4f7379 271->286 273->274 275 7ff6ec4f73ae 274->275 280 7ff6ec4f73b3 275->280 292 7ff6ec4f730e-7ff6ec4f7315 276->292 281 7ff6ec4f733f-7ff6ec4f7351 call 7ff6ec4f6de4 277->281 282 7ff6ec4f73b8-7ff6ec4f73c2 277->282 280->282 281->292 287 7ff6ec4f73c4-7ff6ec4f73c9 282->287 288 7ff6ec4f7425-7ff6ec4f742a 282->288 284->263 284->285 285->263 291 7ff6ec4f727a-7ff6ec4f727d 285->291 286->292 293 7ff6ec4f73f5-7ff6ec4f7406 287->293 294 7ff6ec4f73cb-7ff6ec4f73ce 287->294 288->251 296 7ff6ec4f727f-7ff6ec4f7286 291->296 297 7ff6ec4f72fc-7ff6ec4f7309 call 7ff6ec4f66e8 291->297 292->280 298 7ff6ec4f740d-7ff6ec4f741d call 7ff6ec4e6b7c call 7ff6ec4e6b5c 293->298 299 7ff6ec4f7408-7ff6ec4f740b 293->299 300 7ff6ec4f73d0-7ff6ec4f73e0 call 7ff6ec4e6b7c call 7ff6ec4e6b5c 294->300 301 7ff6ec4f73eb-7ff6ec4f73f0 call 7ff6ec4e6b0c 294->301 296->282 303 7ff6ec4f728c-7ff6ec4f729c 296->303 297->292 298->288 299->248 299->298 300->301 301->293 304 7ff6ec4f72f5-7ff6ec4f72f7 303->304 305 7ff6ec4f729e 303->305 304->275 309 7ff6ec4f72a1-7ff6ec4f72b8 call 7ff6ec4fe604 305->309 319 7ff6ec4f72ec-7ff6ec4f72f2 GetLastError 309->319 320 7ff6ec4f72ba-7ff6ec4f72c4 309->320 319->304 321 7ff6ec4f72e1-7ff6ec4f72e8 320->321 322 7ff6ec4f72c6-7ff6ec4f72d8 call 7ff6ec4fe604 320->322 321->304 324 7ff6ec4f72ea 321->324 322->319 326 7ff6ec4f72da-7ff6ec4f72df 322->326 324->309 326->321
                                                                                                                APIs
                                                                                                                • _invalid_parameter_noinfo.LIBCMT ref: 00007FF6EC4F71AD
                                                                                                                • GetConsoleMode.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00007FF6EC4F712B,?,?,?,00007FF6EC4F77D2), ref: 00007FF6EC4F726C
                                                                                                                • GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00007FF6EC4F712B,?,?,?,00007FF6EC4F77D2), ref: 00007FF6EC4F72EC
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 0000000C.00000002.2574093388.00007FF6EC4B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF6EC4B0000, based on PE: true
                                                                                                                • Associated: 0000000C.00000002.2574070380.00007FF6EC4B0000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                • Associated: 0000000C.00000002.2574132408.00007FF6EC504000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                • Associated: 0000000C.00000002.2574154940.00007FF6EC517000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                • Associated: 0000000C.00000002.2574176551.00007FF6EC51A000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_12_2_7ff6ec4b0000_tapinstall.jbxd
                                                                                                                Similarity
                                                                                                                • API ID: ConsoleErrorLastMode_invalid_parameter_noinfo
                                                                                                                • String ID:
                                                                                                                • API String ID: 2210144848-0
                                                                                                                • Opcode ID: 5b577d0101186b3dee45c0514d8567f2aff468ee3d1ca196f04eb6bda83befe3
                                                                                                                • Instruction ID: e66d8dd3b6db50eab8ea8fd3f2389cfbdda3ab442837f1902ae8dc5d421e09dd
                                                                                                                • Opcode Fuzzy Hash: 5b577d0101186b3dee45c0514d8567f2aff468ee3d1ca196f04eb6bda83befe3
                                                                                                                • Instruction Fuzzy Hash: E781CE23E18A92DDF7109B6488803BC26A1FB44B9CF601135DE0E97791DF3EA58DC31A
                                                                                                                Function 00007FF6EC4B28B0 Relevance: 4.6, APIs: 3, Instructions: 94COMMON
                                                                                                                Download Yara Rule

                                                                                                                Control-flow Graph

                                                                                                                APIs
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 0000000C.00000002.2574093388.00007FF6EC4B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF6EC4B0000, based on PE: true
                                                                                                                • Associated: 0000000C.00000002.2574070380.00007FF6EC4B0000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                • Associated: 0000000C.00000002.2574132408.00007FF6EC504000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                • Associated: 0000000C.00000002.2574154940.00007FF6EC517000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                • Associated: 0000000C.00000002.2574176551.00007FF6EC51A000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_12_2_7ff6ec4b0000_tapinstall.jbxd
                                                                                                                Similarity
                                                                                                                • API ID: LoadString$FormatFreeLocalMessage
                                                                                                                • String ID:
                                                                                                                • API String ID: 725706356-0
                                                                                                                • Opcode ID: d1c2bf7ba6e30959b680a2a26bbfb6c667ed2b04af53c45da1eed3ab1d55b066
                                                                                                                • Instruction ID: c63a2c2bf68af9dce5f1c7dfd6a6790bd8ff478dbe919daa7df9c09c66e84771
                                                                                                                • Opcode Fuzzy Hash: d1c2bf7ba6e30959b680a2a26bbfb6c667ed2b04af53c45da1eed3ab1d55b066
                                                                                                                • Instruction Fuzzy Hash: EE416E32B08682C6E7708B11F4417AE72A4FB89788F504035DE4DD3B99EF2ED819CB06
                                                                                                                Function 00007FF6EC4E1608 Relevance: 4.5, APIs: 3, Instructions: 19COMMON
                                                                                                                Download Yara Rule

                                                                                                                Control-flow Graph

                                                                                                                APIs
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 0000000C.00000002.2574093388.00007FF6EC4B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF6EC4B0000, based on PE: true
                                                                                                                • Associated: 0000000C.00000002.2574070380.00007FF6EC4B0000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                • Associated: 0000000C.00000002.2574132408.00007FF6EC504000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                • Associated: 0000000C.00000002.2574154940.00007FF6EC517000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                • Associated: 0000000C.00000002.2574176551.00007FF6EC51A000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_12_2_7ff6ec4b0000_tapinstall.jbxd
                                                                                                                Similarity
                                                                                                                • API ID: Process$CurrentExitTerminate
                                                                                                                • String ID:
                                                                                                                • API String ID: 1703294689-0
                                                                                                                • Opcode ID: 08b53547627d342cef18f15c3e291c34f31992f781596ea9132903bd88c460e4
                                                                                                                • Instruction ID: 216be3833115bcf7089c7eaf8bb82f3288cf040381a286eecfb32b9abdfec32e
                                                                                                                • Opcode Fuzzy Hash: 08b53547627d342cef18f15c3e291c34f31992f781596ea9132903bd88c460e4
                                                                                                                • Instruction Fuzzy Hash: 57E01A62B4420287FA54AB30A8963792252AF88745F155538D80EC6352DE3FE85CC30B
                                                                                                                Function 00007FF6EC4E8634 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 19COMMON
                                                                                                                Download Yara Rule

                                                                                                                Control-flow Graph

                                                                                                                • Executed
                                                                                                                • Not Executed
                                                                                                                control_flow_graph 386 7ff6ec4e8634-7ff6ec4e8657 call 7ff6ec4e81a8 388 7ff6ec4e865c-7ff6ec4e865f 386->388 389 7ff6ec4e8661-7ff6ec4e8670 388->389 390 7ff6ec4e8677-7ff6ec4e8681 388->390 389->390
                                                                                                                APIs
                                                                                                                Strings
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 0000000C.00000002.2574093388.00007FF6EC4B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF6EC4B0000, based on PE: true
                                                                                                                • Associated: 0000000C.00000002.2574070380.00007FF6EC4B0000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                • Associated: 0000000C.00000002.2574132408.00007FF6EC504000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                • Associated: 0000000C.00000002.2574154940.00007FF6EC517000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                • Associated: 0000000C.00000002.2574176551.00007FF6EC51A000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_12_2_7ff6ec4b0000_tapinstall.jbxd
                                                                                                                Similarity
                                                                                                                • API ID: try_get_function
                                                                                                                • String ID: AppPolicyGetProcessTerminationMethod
                                                                                                                • API String ID: 2742660187-2031265017
                                                                                                                • Opcode ID: 09745aa082c0f9a3d57ff4a42a6b74f56dafb84feddb837b008a725231bf0058
                                                                                                                • Instruction ID: f71b6137d9b49b6870080e5623bbe08b00b0949b4efede7c985e9f65fe89d013
                                                                                                                • Opcode Fuzzy Hash: 09745aa082c0f9a3d57ff4a42a6b74f56dafb84feddb837b008a725231bf0058
                                                                                                                • Instruction Fuzzy Hash: 4EE04F93E04A0691FE058795A8423B012509F483B8E490335DD3CCA3D0AE3E9EA5C349
                                                                                                                Function 00007FF6EC4F6CE0 Relevance: 3.1, APIs: 2, Instructions: 74fileCOMMON
                                                                                                                Download Yara Rule

                                                                                                                Control-flow Graph

                                                                                                                • Executed
                                                                                                                • Not Executed
                                                                                                                control_flow_graph 391 7ff6ec4f6ce0-7ff6ec4f6d46 call 7ff6ec4b7750 394 7ff6ec4f6d48 391->394 395 7ff6ec4f6db7-7ff6ec4f6de1 call 7ff6ec4b76e0 391->395 396 7ff6ec4f6d4d-7ff6ec4f6d50 394->396 398 7ff6ec4f6d52-7ff6ec4f6d59 396->398 399 7ff6ec4f6d76-7ff6ec4f6d9b WriteFile 396->399 401 7ff6ec4f6d64-7ff6ec4f6d74 398->401 402 7ff6ec4f6d5b-7ff6ec4f6d61 398->402 403 7ff6ec4f6daf-7ff6ec4f6db5 GetLastError 399->403 404 7ff6ec4f6d9d-7ff6ec4f6da6 399->404 401->396 401->399 402->401 403->395 404->395 405 7ff6ec4f6da8-7ff6ec4f6dab 404->405 405->394 406 7ff6ec4f6dad 405->406 406->395
                                                                                                                APIs
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 0000000C.00000002.2574093388.00007FF6EC4B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF6EC4B0000, based on PE: true
                                                                                                                • Associated: 0000000C.00000002.2574070380.00007FF6EC4B0000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                • Associated: 0000000C.00000002.2574132408.00007FF6EC504000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                • Associated: 0000000C.00000002.2574154940.00007FF6EC517000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                • Associated: 0000000C.00000002.2574176551.00007FF6EC51A000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_12_2_7ff6ec4b0000_tapinstall.jbxd
                                                                                                                Similarity
                                                                                                                • API ID: ErrorFileLastWrite
                                                                                                                • String ID:
                                                                                                                • API String ID: 442123175-0
                                                                                                                • Opcode ID: db3742f2bb6f116d389edc3337e853886a6bb6baf124e39b63c995694271e509
                                                                                                                • Instruction ID: 5d9c87b67cb7409618b9f12101157a8b57d5336e8e24c54e4bb4c5eda28a0a0e
                                                                                                                • Opcode Fuzzy Hash: db3742f2bb6f116d389edc3337e853886a6bb6baf124e39b63c995694271e509
                                                                                                                • Instruction Fuzzy Hash: 8A31EE33A18A82CADB109F28E4443E977A0FB58784F549032EA4DC3718EF3DD559C716
                                                                                                                Function 00007FF6EC4E9EA4 Relevance: 3.1, APIs: 2, Instructions: 73COMMON
                                                                                                                Download Yara Rule

                                                                                                                Control-flow Graph

                                                                                                                APIs
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 0000000C.00000002.2574093388.00007FF6EC4B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF6EC4B0000, based on PE: true
                                                                                                                • Associated: 0000000C.00000002.2574070380.00007FF6EC4B0000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                • Associated: 0000000C.00000002.2574132408.00007FF6EC504000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                • Associated: 0000000C.00000002.2574154940.00007FF6EC517000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                • Associated: 0000000C.00000002.2574176551.00007FF6EC51A000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_12_2_7ff6ec4b0000_tapinstall.jbxd
                                                                                                                Similarity
                                                                                                                • API ID: FileHandleType
                                                                                                                • String ID:
                                                                                                                • API String ID: 3000768030-0
                                                                                                                • Opcode ID: 2a7858ea0a20d78d229f8241a9e12833e585a3072b3a1a0811a3e501217574ad
                                                                                                                • Instruction ID: 79f32407177a253f6a6a4b5d4d34c721736d0d64c86d4b03b47deb5ca4dc94a5
                                                                                                                • Opcode Fuzzy Hash: 2a7858ea0a20d78d229f8241a9e12833e585a3072b3a1a0811a3e501217574ad
                                                                                                                • Instruction Fuzzy Hash: 0E31D723A18B46C5D760CB1595903BC2650FB55BB8F650339EB6E8B3E0CF3AE465C34A
                                                                                                                Function 00007FF6EC4B4770 Relevance: 3.1, APIs: 2, Instructions: 51windowCOMMON
                                                                                                                Download Yara Rule

                                                                                                                Control-flow Graph

                                                                                                                • Executed
                                                                                                                • Not Executed
                                                                                                                control_flow_graph 427 7ff6ec4b4770-7ff6ec4b47c5 FormatMessageW 428 7ff6ec4b4811-7ff6ec4b4817 427->428 429 7ff6ec4b47c7-7ff6ec4b47c9 427->429 430 7ff6ec4b480b LocalFree 429->430 431 7ff6ec4b47cb-7ff6ec4b47ce 429->431 430->428 432 7ff6ec4b47d0 431->432 433 7ff6ec4b47f6-7ff6ec4b4801 call 7ff6ec4c6c8c 431->433 434 7ff6ec4b47d3-7ff6ec4b47d6 432->434 438 7ff6ec4b4806 433->438 436 7ff6ec4b47de-7ff6ec4b47f4 434->436 437 7ff6ec4b47d8-7ff6ec4b47db 434->437 436->433 436->434 437->436 438->430
                                                                                                                APIs
                                                                                                                • FormatMessageW.KERNEL32(?,?,?,?,?,?,?,?,00000000,?,00007FF6EC4B10DD), ref: 00007FF6EC4B47B7
                                                                                                                • LocalFree.KERNEL32(?,?,?,?,?,?,?,?,00000000,?,00007FF6EC4B10DD), ref: 00007FF6EC4B480B
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 0000000C.00000002.2574093388.00007FF6EC4B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF6EC4B0000, based on PE: true
                                                                                                                • Associated: 0000000C.00000002.2574070380.00007FF6EC4B0000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                • Associated: 0000000C.00000002.2574132408.00007FF6EC504000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                • Associated: 0000000C.00000002.2574154940.00007FF6EC517000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                • Associated: 0000000C.00000002.2574176551.00007FF6EC51A000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_12_2_7ff6ec4b0000_tapinstall.jbxd
                                                                                                                Similarity
                                                                                                                • API ID: FormatFreeLocalMessage
                                                                                                                • String ID:
                                                                                                                • API String ID: 1427518018-0
                                                                                                                • Opcode ID: faddade6f339ff3cc93d48928193cad67dc264e1d8a9395bb651df8655175f89
                                                                                                                • Instruction ID: 6755f4b5b7002b0f7e26f5f2f12e5372b7aa6d013013c0b70af48a7b019021f4
                                                                                                                • Opcode Fuzzy Hash: faddade6f339ff3cc93d48928193cad67dc264e1d8a9395bb651df8655175f89
                                                                                                                • Instruction Fuzzy Hash: D2118877A19B4881EB11CF12E84422E73A5FF88B84B558036CE5D87764EF3AC8A5C705
                                                                                                                Function 00007FF6EC4B8124 Relevance: 3.0, APIs: 2, Instructions: 23COMMON
                                                                                                                Download Yara Rule

                                                                                                                Control-flow Graph

                                                                                                                APIs
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 0000000C.00000002.2574093388.00007FF6EC4B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF6EC4B0000, based on PE: true
                                                                                                                • Associated: 0000000C.00000002.2574070380.00007FF6EC4B0000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                • Associated: 0000000C.00000002.2574132408.00007FF6EC504000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                • Associated: 0000000C.00000002.2574154940.00007FF6EC517000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                • Associated: 0000000C.00000002.2574176551.00007FF6EC51A000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_12_2_7ff6ec4b0000_tapinstall.jbxd
                                                                                                                Similarity
                                                                                                                • API ID: __vcrt_initialize__vcrt_initialize_locks__vcrt_initialize_winapi_thunks__vcrt_uninitialize
                                                                                                                • String ID:
                                                                                                                • API String ID: 1882725809-0
                                                                                                                • Opcode ID: 8f237d6502b14b0254a4c674743dae8b4da91eb28c515f3ea25adcbd20d46fa1
                                                                                                                • Instruction ID: 1d860df2b610662f4a00d168d24cd0b754a07f3b3eb325bb78be747b70b82129
                                                                                                                • Opcode Fuzzy Hash: 8f237d6502b14b0254a4c674743dae8b4da91eb28c515f3ea25adcbd20d46fa1
                                                                                                                • Instruction Fuzzy Hash: 08E0E502E0E342C8FF642B6524463BD27910F6A34CF0418B9D89DC218B8D0F685DE72F
                                                                                                                Function 00007FF6EC4E7764 Relevance: 2.6, APIs: 2, Instructions: 59COMMONLIBRARYCODE
                                                                                                                Download Yara Rule

                                                                                                                Control-flow Graph

                                                                                                                APIs
                                                                                                                • GetLastError.KERNEL32(?,?,00000000,00007FF6EC4E6B85,?,?,?,?,00007FF6EC4C6CA8,?,?,?,?,?,?,00000000), ref: 00007FF6EC4E7773
                                                                                                                • SetLastError.KERNEL32(?,?,00000000,00007FF6EC4E6B85,?,?,?,?,00007FF6EC4C6CA8,?,?,?,?,?,?,00000000), ref: 00007FF6EC4E7811
                                                                                                                  • Part of subcall function 00007FF6EC4E89B4: try_get_function.LIBVCRUNTIME ref: 00007FF6EC4E89D6
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 0000000C.00000002.2574093388.00007FF6EC4B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF6EC4B0000, based on PE: true
                                                                                                                • Associated: 0000000C.00000002.2574070380.00007FF6EC4B0000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                • Associated: 0000000C.00000002.2574132408.00007FF6EC504000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                • Associated: 0000000C.00000002.2574154940.00007FF6EC517000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                • Associated: 0000000C.00000002.2574176551.00007FF6EC51A000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_12_2_7ff6ec4b0000_tapinstall.jbxd
                                                                                                                Similarity
                                                                                                                • API ID: ErrorLast$try_get_function
                                                                                                                • String ID:
                                                                                                                • API String ID: 762735579-0
                                                                                                                • Opcode ID: d4d1791d7704cc127bea98e5a03ffeedfc60c8c5dcac260ef9461f8b7b2dea69
                                                                                                                • Instruction ID: 6b9bcb6064c276a253e36b01c77d5ca109b9c2d936caff7f28695baf585cfe04
                                                                                                                • Opcode Fuzzy Hash: d4d1791d7704cc127bea98e5a03ffeedfc60c8c5dcac260ef9461f8b7b2dea69
                                                                                                                • Instruction Fuzzy Hash: 36219F33E0864289FA58E73A590137921515F843B8F024734D93D8A7D6DE2EB949C30B
                                                                                                                Function 00007FF6EC4F7080 Relevance: 1.6, APIs: 1, Instructions: 67COMMON
                                                                                                                Download Yara Rule

                                                                                                                Control-flow Graph

                                                                                                                Memory Dump Source
                                                                                                                • Source File: 0000000C.00000002.2574093388.00007FF6EC4B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF6EC4B0000, based on PE: true
                                                                                                                • Associated: 0000000C.00000002.2574070380.00007FF6EC4B0000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                • Associated: 0000000C.00000002.2574132408.00007FF6EC504000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                • Associated: 0000000C.00000002.2574154940.00007FF6EC517000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                • Associated: 0000000C.00000002.2574176551.00007FF6EC51A000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_12_2_7ff6ec4b0000_tapinstall.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: 77c9f455ae7dbfbf764ac100925fa24616ef860103a1a996772a9699631fd484
                                                                                                                • Instruction ID: ad21d84bebb287539154962e0590de21e288f3e9319a5dc5bc4cc2c7f2f80cec
                                                                                                                • Opcode Fuzzy Hash: 77c9f455ae7dbfbf764ac100925fa24616ef860103a1a996772a9699631fd484
                                                                                                                • Instruction Fuzzy Hash: FE21E533E08286CDE741AF15984137D2A51AF447A8F651538E91C8B3D2CF7EE44DC71A
                                                                                                                Function 00007FF6EC4E154C Relevance: 1.6, APIs: 1, Instructions: 53COMMON
                                                                                                                Download Yara Rule

                                                                                                                Control-flow Graph

                                                                                                                APIs
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 0000000C.00000002.2574093388.00007FF6EC4B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF6EC4B0000, based on PE: true
                                                                                                                • Associated: 0000000C.00000002.2574070380.00007FF6EC4B0000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                • Associated: 0000000C.00000002.2574132408.00007FF6EC504000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                • Associated: 0000000C.00000002.2574154940.00007FF6EC517000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                • Associated: 0000000C.00000002.2574176551.00007FF6EC51A000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_12_2_7ff6ec4b0000_tapinstall.jbxd
                                                                                                                Similarity
                                                                                                                • API ID: HandleModule$AddressFreeLibraryProc
                                                                                                                • String ID:
                                                                                                                • API String ID: 3947729631-0
                                                                                                                • Opcode ID: 9b5487346ef9f63116b54207664187879175fdd5b6014f44a2d1d5806b6a0d0e
                                                                                                                • Instruction ID: 939ae2cfdedb2829d53d7c4ab89e4a57ab5c01ed420187a1fbcc939f10fb456c
                                                                                                                • Opcode Fuzzy Hash: 9b5487346ef9f63116b54207664187879175fdd5b6014f44a2d1d5806b6a0d0e
                                                                                                                • Instruction Fuzzy Hash: 6C2145B2E04601CEEB61CF64C4407AC36A0EB4471CF45563AE60D9AB86DF79D589CB86
                                                                                                                Function 00007FF6EC4C6C8C Relevance: 1.5, APIs: 1, Instructions: 28COMMON
                                                                                                                Download Yara Rule
                                                                                                                APIs
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 0000000C.00000002.2574093388.00007FF6EC4B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF6EC4B0000, based on PE: true
                                                                                                                • Associated: 0000000C.00000002.2574070380.00007FF6EC4B0000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                • Associated: 0000000C.00000002.2574132408.00007FF6EC504000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                • Associated: 0000000C.00000002.2574154940.00007FF6EC517000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                • Associated: 0000000C.00000002.2574176551.00007FF6EC51A000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_12_2_7ff6ec4b0000_tapinstall.jbxd
                                                                                                                Similarity
                                                                                                                • API ID: _invalid_parameter_noinfo
                                                                                                                • String ID:
                                                                                                                • API String ID: 3215553584-0
                                                                                                                • Opcode ID: b1701a4419845fdea9b25c0b889f21a2cfcb31a46c6b6b47c9f4c5ea8d08c04c
                                                                                                                • Instruction ID: 01f0903ea9352550e67a7717f66c821510e4e7705cbecee03b7fe271cb826027
                                                                                                                • Opcode Fuzzy Hash: b1701a4419845fdea9b25c0b889f21a2cfcb31a46c6b6b47c9f4c5ea8d08c04c
                                                                                                                • Instruction Fuzzy Hash: C9F01DB3A04B11DCEB019F60D8411EC36B4FB1439CF508A31EA5C466A9EF39D158C355
                                                                                                                Function 00007FF6EC4E7830 Relevance: 1.5, APIs: 1, Instructions: 17COMMON
                                                                                                                Download Yara Rule
                                                                                                                APIs
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 0000000C.00000002.2574093388.00007FF6EC4B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF6EC4B0000, based on PE: true
                                                                                                                • Associated: 0000000C.00000002.2574070380.00007FF6EC4B0000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                • Associated: 0000000C.00000002.2574132408.00007FF6EC504000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                • Associated: 0000000C.00000002.2574154940.00007FF6EC517000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                • Associated: 0000000C.00000002.2574176551.00007FF6EC51A000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_12_2_7ff6ec4b0000_tapinstall.jbxd
                                                                                                                Similarity
                                                                                                                • API ID: __vcrt_uninitialize_ptdtry_get_function
                                                                                                                • String ID:
                                                                                                                • API String ID: 4056716597-0
                                                                                                                • Opcode ID: b076e8293cea706eb79524f1c87288ba3ed481fb71afc0357e97a801dbc09688
                                                                                                                • Instruction ID: e971b99e8ab7bde713218cfb501e772c5a7173b02996efa7cefe2ab9218ccab9
                                                                                                                • Opcode Fuzzy Hash: b076e8293cea706eb79524f1c87288ba3ed481fb71afc0357e97a801dbc09688
                                                                                                                • Instruction Fuzzy Hash: B0E0BF32D49602D8E954E77555812B815402F35338F521975D01ECA2D2AE1F774ED71B
                                                                                                                Function 00007FF6EC4E7978 Relevance: 1.3, APIs: 1, Instructions: 36memoryCOMMONLIBRARYCODE
                                                                                                                Download Yara Rule
                                                                                                                APIs
                                                                                                                • HeapAlloc.KERNEL32(?,?,00000000,00007FF6EC4E77C1,?,?,00000000,00007FF6EC4E6B85,?,?,?,?,00007FF6EC4C6CA8), ref: 00007FF6EC4E79CD
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 0000000C.00000002.2574093388.00007FF6EC4B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF6EC4B0000, based on PE: true
                                                                                                                • Associated: 0000000C.00000002.2574070380.00007FF6EC4B0000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                • Associated: 0000000C.00000002.2574132408.00007FF6EC504000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                • Associated: 0000000C.00000002.2574154940.00007FF6EC517000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                • Associated: 0000000C.00000002.2574176551.00007FF6EC51A000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_12_2_7ff6ec4b0000_tapinstall.jbxd
                                                                                                                Similarity
                                                                                                                • API ID: AllocHeap
                                                                                                                • String ID:
                                                                                                                • API String ID: 4292702814-0
                                                                                                                • Opcode ID: 3983c4821dd1e57c8f0338e38868bd111ba754eec4fe96f30a7891404f0fea4d
                                                                                                                • Instruction ID: 7744b5587ada8bb5e5aaf5aef8cc7dfcaa616e00cbdfde4f14de47337d9e8367
                                                                                                                • Opcode Fuzzy Hash: 3983c4821dd1e57c8f0338e38868bd111ba754eec4fe96f30a7891404f0fea4d
                                                                                                                • Instruction Fuzzy Hash: 98F04F33B09607C8FE55D66654513B512849F44768F0A4431C90DCE382EE1EE999C31A

                                                                                                                Non-executed Functions

                                                                                                                Function 00007FF6EC4B7030 Relevance: 40.5, APIs: 19, Strings: 4, Instructions: 255registryCOMMON
                                                                                                                Download Yara Rule
                                                                                                                APIs
                                                                                                                Strings
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 0000000C.00000002.2574093388.00007FF6EC4B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF6EC4B0000, based on PE: true
                                                                                                                • Associated: 0000000C.00000002.2574070380.00007FF6EC4B0000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                • Associated: 0000000C.00000002.2574132408.00007FF6EC504000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                • Associated: 0000000C.00000002.2574154940.00007FF6EC517000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                • Associated: 0000000C.00000002.2574176551.00007FF6EC51A000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_12_2_7ff6ec4b0000_tapinstall.jbxd
                                                                                                                Similarity
                                                                                                                • API ID: Setup$DeviceDriverInfoInstallParams$BuildCloseEnumListOpen
                                                                                                                • String ID: DriverDesc$InfPath$InfSection$ProviderName
                                                                                                                • API String ID: 1704563315-109328823
                                                                                                                • Opcode ID: 470132caa0e5c2b1524e902dcaad2fd13110990853be0799e79165d4b753c384
                                                                                                                • Instruction ID: 4b3845b85b8d930b0286b4d2c3802818406ab7140c6722fe54bbfe33ff540d72
                                                                                                                • Opcode Fuzzy Hash: 470132caa0e5c2b1524e902dcaad2fd13110990853be0799e79165d4b753c384
                                                                                                                • Instruction Fuzzy Hash: D9B1C433A08B82C6EB248F61A4443BE77A0FB84B8CF405135DE4D86A58EF3ED649D715
                                                                                                                Function 00007FF6EC4B6C90 Relevance: 40.5, APIs: 17, Strings: 6, Instructions: 208libraryfileloaderCOMMON
                                                                                                                Download Yara Rule
                                                                                                                APIs
                                                                                                                • SetupOpenInfFileW.SETUPAPI(?,?,00000000,00000000,?,00007FF6EC4B3786), ref: 00007FF6EC4B6CD1
                                                                                                                • GetLastError.KERNEL32(?,?,00000000,00000000,?,00007FF6EC4B3786), ref: 00007FF6EC4B6CE0
                                                                                                                • SetupFindFirstLineW.SETUPAPI(?,?,00000000,00000000,?,00007FF6EC4B3786), ref: 00007FF6EC4B6D0C
                                                                                                                • SetupGetStringFieldW.SETUPAPI(?,?,00000000,00000000,?,00007FF6EC4B3786), ref: 00007FF6EC4B6D32
                                                                                                                • SetupFindFirstLineW.SETUPAPI(?,?,00000000,00000000,?,00007FF6EC4B3786), ref: 00007FF6EC4B6D89
                                                                                                                • SetupGetStringFieldW.SETUPAPI(?,?,00000000,00000000,?,00007FF6EC4B3786), ref: 00007FF6EC4B6DB3
                                                                                                                • CLSIDFromString.OLE32(?,?,00000000,00000000,?,00007FF6EC4B3786), ref: 00007FF6EC4B6DC9
                                                                                                                • SetupDiGetClassDescriptionExW.SETUPAPI(?,?,00000000,00000000,?,00007FF6EC4B3786), ref: 00007FF6EC4B6DF2
                                                                                                                • LoadLibraryW.KERNEL32(?,?,00000000,00000000,?,00007FF6EC4B3786), ref: 00007FF6EC4B6E3A
                                                                                                                • GetProcAddress.KERNEL32(?,?,00000000,00000000,?,00007FF6EC4B3786), ref: 00007FF6EC4B6E5E
                                                                                                                • GetLastError.KERNEL32 ref: 00007FF6EC4B6EA1
                                                                                                                • GetLastError.KERNEL32 ref: 00007FF6EC4B6EAE
                                                                                                                • SetupFindFirstLineW.SETUPAPI ref: 00007FF6EC4B6F08
                                                                                                                Strings
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 0000000C.00000002.2574093388.00007FF6EC4B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF6EC4B0000, based on PE: true
                                                                                                                • Associated: 0000000C.00000002.2574070380.00007FF6EC4B0000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                • Associated: 0000000C.00000002.2574132408.00007FF6EC504000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                • Associated: 0000000C.00000002.2574154940.00007FF6EC517000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                • Associated: 0000000C.00000002.2574176551.00007FF6EC51A000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_12_2_7ff6ec4b0000_tapinstall.jbxd
                                                                                                                Similarity
                                                                                                                • API ID: Setup$ErrorFindFirstLastLineString$Field$AddressClassDescriptionFileFromLibraryLoadOpenProc
                                                                                                                • String ID: ClassGUID$DriverVer$Provider$SetupVerifyInfFile$Version$setupapi.dll
                                                                                                                • API String ID: 2815445529-1638047923
                                                                                                                • Opcode ID: ccf9f4b43b9fad1fa27bc109124458a99df6b9793aee5966b8e4b19aae1b4082
                                                                                                                • Instruction ID: faacf0b5783f1dfd75fb0afef8a6c6619a1f67685dfe4e9bf2df698a86a98f6d
                                                                                                                • Opcode Fuzzy Hash: ccf9f4b43b9fad1fa27bc109124458a99df6b9793aee5966b8e4b19aae1b4082
                                                                                                                • Instruction Fuzzy Hash: 8D916F23A08A8681F714AB61E8117FE2251FF84B88F404035DD0ED66D9EF3EE95DC75A
                                                                                                                Function 00007FF6EC4B13E0 Relevance: 23.0, APIs: 12, Strings: 1, Instructions: 279COMMON
                                                                                                                Download Yara Rule
                                                                                                                APIs
                                                                                                                Strings
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 0000000C.00000002.2574093388.00007FF6EC4B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF6EC4B0000, based on PE: true
                                                                                                                • Associated: 0000000C.00000002.2574070380.00007FF6EC4B0000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                • Associated: 0000000C.00000002.2574132408.00007FF6EC504000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                • Associated: 0000000C.00000002.2574154940.00007FF6EC517000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                • Associated: 0000000C.00000002.2574176551.00007FF6EC51A000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_12_2_7ff6ec4b0000_tapinstall.jbxd
                                                                                                                Similarity
                                                                                                                • API ID: Setup$ClassFromGuidsName$DestroyDeviceErrorInfoLastList
                                                                                                                • String ID:
                                                                                                                • API String ID: 1066883911-3916222277
                                                                                                                • Opcode ID: 95c7f67f37713cc790260966e8adad9794b378fe7e5710a0f5457cdb6cacd70d
                                                                                                                • Instruction ID: fd4f527f709dab4b3704614043163f55ec4c5fb3abed671eaf0b6e324d70762e
                                                                                                                • Opcode Fuzzy Hash: 95c7f67f37713cc790260966e8adad9794b378fe7e5710a0f5457cdb6cacd70d
                                                                                                                • Instruction Fuzzy Hash: 9AB18363A0864286EB248B25A8407BE63A0FB85BA8F544235EE5D877D8EF3DD509C705
                                                                                                                Function 00007FF6EC4FA070 Relevance: 15.4, APIs: 10, Instructions: 368COMMON
                                                                                                                Download Yara Rule
                                                                                                                APIs
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 0000000C.00000002.2574093388.00007FF6EC4B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF6EC4B0000, based on PE: true
                                                                                                                • Associated: 0000000C.00000002.2574070380.00007FF6EC4B0000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                • Associated: 0000000C.00000002.2574132408.00007FF6EC504000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                • Associated: 0000000C.00000002.2574154940.00007FF6EC517000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                • Associated: 0000000C.00000002.2574176551.00007FF6EC51A000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_12_2_7ff6ec4b0000_tapinstall.jbxd
                                                                                                                Similarity
                                                                                                                • API ID: memcpy_s
                                                                                                                • String ID:
                                                                                                                • API String ID: 1502251526-0
                                                                                                                • Opcode ID: ac952aa7c694147f99d3e4b40430f2bf787c9728cbc095bc21ac10cb0df3e7be
                                                                                                                • Instruction ID: 6498d177b13996d3a0fa711141f4b3a031d6061b13aed23e2c84d6d0f6e239a2
                                                                                                                • Opcode Fuzzy Hash: ac952aa7c694147f99d3e4b40430f2bf787c9728cbc095bc21ac10cb0df3e7be
                                                                                                                • Instruction Fuzzy Hash: 43E1BE73A082C28EEB25CF15D404BE937A0FB4978CF646135DA4987B84DF3AD918CB45
                                                                                                                Function 00007FF6EC4EE0B0 Relevance: 14.4, APIs: 7, Strings: 1, Instructions: 434COMMON
                                                                                                                Download Yara Rule
                                                                                                                APIs
                                                                                                                • _invalid_parameter_noinfo.LIBCMT ref: 00007FF6EC4EE0E0
                                                                                                                  • Part of subcall function 00007FF6EC4E6A20: IsProcessorFeaturePresent.KERNEL32(?,?,?,?,00007FF6EC4E69CD), ref: 00007FF6EC4E6A29
                                                                                                                  • Part of subcall function 00007FF6EC4E6A20: GetCurrentProcess.KERNEL32(?,?,?,?,00007FF6EC4E69CD), ref: 00007FF6EC4E6A4E
                                                                                                                • _invalid_parameter_noinfo.LIBCMT ref: 00007FF6EC4EE305
                                                                                                                Strings
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 0000000C.00000002.2574093388.00007FF6EC4B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF6EC4B0000, based on PE: true
                                                                                                                • Associated: 0000000C.00000002.2574070380.00007FF6EC4B0000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                • Associated: 0000000C.00000002.2574132408.00007FF6EC504000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                • Associated: 0000000C.00000002.2574154940.00007FF6EC517000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                • Associated: 0000000C.00000002.2574176551.00007FF6EC51A000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_12_2_7ff6ec4b0000_tapinstall.jbxd
                                                                                                                Similarity
                                                                                                                • API ID: _invalid_parameter_noinfo$CurrentFeaturePresentProcessProcessor
                                                                                                                • String ID: *?
                                                                                                                • API String ID: 1697365638-2564092906
                                                                                                                • Opcode ID: 63c62522b583ab65492df3df2897c9d34e58fcc378565526384e87568434e7d9
                                                                                                                • Instruction ID: 7d444589fdca194abcf0f8a7864e428214854c61de9834b13297eb68cbace56f
                                                                                                                • Opcode Fuzzy Hash: 63c62522b583ab65492df3df2897c9d34e58fcc378565526384e87568434e7d9
                                                                                                                • Instruction Fuzzy Hash: 95F10463B18695C9EB20CF6698006BA63A0FF44BD8F464535EE5D8BB84EF3ED449C305
                                                                                                                Function 00007FF6EC4B4D80 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 43shutdownCOMMON
                                                                                                                Download Yara Rule
                                                                                                                APIs
                                                                                                                Strings
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 0000000C.00000002.2574093388.00007FF6EC4B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF6EC4B0000, based on PE: true
                                                                                                                • Associated: 0000000C.00000002.2574070380.00007FF6EC4B0000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                • Associated: 0000000C.00000002.2574132408.00007FF6EC504000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                • Associated: 0000000C.00000002.2574154940.00007FF6EC517000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                • Associated: 0000000C.00000002.2574176551.00007FF6EC51A000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_12_2_7ff6ec4b0000_tapinstall.jbxd
                                                                                                                Similarity
                                                                                                                • API ID: ProcessToken$AdjustCloseCurrentHandleInitiateLookupOpenPrivilegePrivilegesShutdownSystemValue
                                                                                                                • String ID: SeShutdownPrivilege
                                                                                                                • API String ID: 2036077386-3733053543
                                                                                                                • Opcode ID: f561dac5e6c18281b4010f054e9054ffc8b813bd40337e654f72e59e3645770f
                                                                                                                • Instruction ID: db286ecc763dd4d06857f0374c47c1787e7a98f8dec0ac0a1a677b2f3fa30f56
                                                                                                                • Opcode Fuzzy Hash: f561dac5e6c18281b4010f054e9054ffc8b813bd40337e654f72e59e3645770f
                                                                                                                • Instruction Fuzzy Hash: 13112173A18A4282EB50DF61F41676A77A0FB88748F405035EA8EC7B68DF7DD458CB05
                                                                                                                Function 00007FF6EC4F9BC0 Relevance: 10.7, APIs: 7, Instructions: 246COMMON
                                                                                                                Download Yara Rule
                                                                                                                APIs
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 0000000C.00000002.2574093388.00007FF6EC4B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF6EC4B0000, based on PE: true
                                                                                                                • Associated: 0000000C.00000002.2574070380.00007FF6EC4B0000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                • Associated: 0000000C.00000002.2574132408.00007FF6EC504000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                • Associated: 0000000C.00000002.2574154940.00007FF6EC517000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                • Associated: 0000000C.00000002.2574176551.00007FF6EC51A000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_12_2_7ff6ec4b0000_tapinstall.jbxd
                                                                                                                Similarity
                                                                                                                • API ID: memcpy_s
                                                                                                                • String ID:
                                                                                                                • API String ID: 1502251526-0
                                                                                                                • Opcode ID: 367b353356dc7549a3a05ae401a0d7ae4e6ca703a61e1e2289ec1d18ee3772f9
                                                                                                                • Instruction ID: c5bb2856bbeec3ecd63b509ade8b207f88ed34b347053e9c2a5fda3975fe9538
                                                                                                                • Opcode Fuzzy Hash: 367b353356dc7549a3a05ae401a0d7ae4e6ca703a61e1e2289ec1d18ee3772f9
                                                                                                                • Instruction Fuzzy Hash: 35A1CF73A082C2CED7798F15A440BE97791FB6578CF60A135DB4A87B84CF399948C705
                                                                                                                Function 00007FF6EC4F4960 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 234COMMON
                                                                                                                Download Yara Rule
                                                                                                                APIs
                                                                                                                  • Part of subcall function 00007FF6EC4E75E8: GetLastError.KERNEL32(?,?,?,00007FF6EC4F7232,?,?,?,?,?,?,?,?,?,?,?,00007FF6EC4F712B), ref: 00007FF6EC4E75F7
                                                                                                                  • Part of subcall function 00007FF6EC4E75E8: SetLastError.KERNEL32(?,?,?,00007FF6EC4F7232,?,?,?,?,?,?,?,?,?,?,?,00007FF6EC4F712B), ref: 00007FF6EC4E7695
                                                                                                                • TranslateName.LIBCMT ref: 00007FF6EC4F49CD
                                                                                                                • TranslateName.LIBCMT ref: 00007FF6EC4F4A08
                                                                                                                • GetACP.KERNEL32(?,?,?,00000000,00000092,00007FF6EC4E27F8), ref: 00007FF6EC4F4A4D
                                                                                                                • IsValidCodePage.KERNEL32(?,?,?,00000000,00000092,00007FF6EC4E27F8), ref: 00007FF6EC4F4A75
                                                                                                                Strings
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 0000000C.00000002.2574093388.00007FF6EC4B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF6EC4B0000, based on PE: true
                                                                                                                • Associated: 0000000C.00000002.2574070380.00007FF6EC4B0000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                • Associated: 0000000C.00000002.2574132408.00007FF6EC504000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                • Associated: 0000000C.00000002.2574154940.00007FF6EC517000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                • Associated: 0000000C.00000002.2574176551.00007FF6EC51A000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_12_2_7ff6ec4b0000_tapinstall.jbxd
                                                                                                                Similarity
                                                                                                                • API ID: ErrorLastNameTranslate$CodePageValid
                                                                                                                • String ID: utf8
                                                                                                                • API String ID: 2136749100-905460609
                                                                                                                • Opcode ID: d9b8ad3760af016a63c72bc9a843d741a47231133edd535d7ed3e9ae3113bd32
                                                                                                                • Instruction ID: 3b93b0c70027b93fdaa4f7eca1707dba79bbb10bb30e4ab361ac5af2b963170c
                                                                                                                • Opcode Fuzzy Hash: d9b8ad3760af016a63c72bc9a843d741a47231133edd535d7ed3e9ae3113bd32
                                                                                                                • Instruction Fuzzy Hash: 4E918B33A08786C9EB309F21D4013B927A5EB44B98F646131DE5DC7686EF3EE559C30A
                                                                                                                Function 00007FF6EC4F5478 Relevance: 10.7, APIs: 7, Instructions: 171COMMON
                                                                                                                Download Yara Rule
                                                                                                                APIs
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 0000000C.00000002.2574093388.00007FF6EC4B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF6EC4B0000, based on PE: true
                                                                                                                • Associated: 0000000C.00000002.2574070380.00007FF6EC4B0000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                • Associated: 0000000C.00000002.2574132408.00007FF6EC504000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                • Associated: 0000000C.00000002.2574154940.00007FF6EC517000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                • Associated: 0000000C.00000002.2574176551.00007FF6EC51A000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_12_2_7ff6ec4b0000_tapinstall.jbxd
                                                                                                                Similarity
                                                                                                                • API ID: Locale$CodeErrorInfoLastPageValid$DefaultEnumLocalesProcessSystemUser
                                                                                                                • String ID:
                                                                                                                • API String ID: 3939093798-0
                                                                                                                • Opcode ID: 698639ebde3256074987202a2cc8b981a0ae2b2705bee52486481ff24fbfc6ce
                                                                                                                • Instruction ID: df25ce292f469c186aed775c7b406eea175697504bfa2891dfa0118d4b597b2e
                                                                                                                • Opcode Fuzzy Hash: 698639ebde3256074987202a2cc8b981a0ae2b2705bee52486481ff24fbfc6ce
                                                                                                                • Instruction Fuzzy Hash: 30716933B08682CAFB119BA494007BC22A1BB4475CF646535CE1D97695EF3EA859C31A
                                                                                                                Function 00007FF6EC4E6788 Relevance: 9.1, APIs: 6, Instructions: 83COMMONLIBRARYCODE
                                                                                                                Download Yara Rule
                                                                                                                APIs
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 0000000C.00000002.2574093388.00007FF6EC4B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF6EC4B0000, based on PE: true
                                                                                                                • Associated: 0000000C.00000002.2574070380.00007FF6EC4B0000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                • Associated: 0000000C.00000002.2574132408.00007FF6EC504000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                • Associated: 0000000C.00000002.2574154940.00007FF6EC517000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                • Associated: 0000000C.00000002.2574176551.00007FF6EC51A000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_12_2_7ff6ec4b0000_tapinstall.jbxd
                                                                                                                Similarity
                                                                                                                • API ID: ExceptionFilterUnhandled$CaptureContextDebuggerEntryFunctionLookupPresentUnwindVirtual
                                                                                                                • String ID:
                                                                                                                • API String ID: 1239891234-0
                                                                                                                • Opcode ID: 33f4d05915216eab4ab632b90a56ad91ab0ee05a89d810f3c8b53b4161930c69
                                                                                                                • Instruction ID: f1f41d001a2f05d0fdd1aa5ce437751e7bbc4725eefcd057c3a732eb400361f3
                                                                                                                • Opcode Fuzzy Hash: 33f4d05915216eab4ab632b90a56ad91ab0ee05a89d810f3c8b53b4161930c69
                                                                                                                • Instruction Fuzzy Hash: 7D318137608F8186D760CF25E8403AE33A4FB88758F540135EA9D83B58DF39D559CB05
                                                                                                                Function 00007FF6EC4EECAC Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 119fileCOMMON
                                                                                                                Download Yara Rule
                                                                                                                APIs
                                                                                                                Strings
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 0000000C.00000002.2574093388.00007FF6EC4B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF6EC4B0000, based on PE: true
                                                                                                                • Associated: 0000000C.00000002.2574070380.00007FF6EC4B0000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                • Associated: 0000000C.00000002.2574132408.00007FF6EC504000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                • Associated: 0000000C.00000002.2574154940.00007FF6EC517000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                • Associated: 0000000C.00000002.2574176551.00007FF6EC51A000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_12_2_7ff6ec4b0000_tapinstall.jbxd
                                                                                                                Similarity
                                                                                                                • API ID: Find$File$CloseFirstNext
                                                                                                                • String ID: .$.
                                                                                                                • API String ID: 3541575487-3769392785
                                                                                                                • Opcode ID: 147d8d088a2ab65af6ce8502f9dfb33cdb0b941aabc59c27737b474ffebd2bbe
                                                                                                                • Instruction ID: 9d598ac54362be3a0c93c15a680af0d3f17b9d674a5f5d159cfdf11239951f64
                                                                                                                • Opcode Fuzzy Hash: 147d8d088a2ab65af6ce8502f9dfb33cdb0b941aabc59c27737b474ffebd2bbe
                                                                                                                • Instruction Fuzzy Hash: 58410C53B1859288EB60DF66A8047BAA391EB447E8F468131DE0D8F7C4EE7ED549C309
                                                                                                                Function 00007FF6EC4B3630 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 98fileCOMMON
                                                                                                                Download Yara Rule
                                                                                                                APIs
                                                                                                                Strings
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 0000000C.00000002.2574093388.00007FF6EC4B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF6EC4B0000, based on PE: true
                                                                                                                • Associated: 0000000C.00000002.2574070380.00007FF6EC4B0000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                • Associated: 0000000C.00000002.2574132408.00007FF6EC504000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                • Associated: 0000000C.00000002.2574154940.00007FF6EC517000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                • Associated: 0000000C.00000002.2574176551.00007FF6EC51A000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_12_2_7ff6ec4b0000_tapinstall.jbxd
                                                                                                                Similarity
                                                                                                                • API ID: DirectoryFileFindFirstWindows
                                                                                                                • String ID: \INF\OEM*.INF
                                                                                                                • API String ID: 1585389207-2728984289
                                                                                                                • Opcode ID: 96e7f8943384205df238da4809613e295090238b8a99556eaef6c16c72f10844
                                                                                                                • Instruction ID: 8dd92956fb135e902daafd25ea59a733a5e3e134ce5503b05c76377396e644b0
                                                                                                                • Opcode Fuzzy Hash: 96e7f8943384205df238da4809613e295090238b8a99556eaef6c16c72f10844
                                                                                                                • Instruction Fuzzy Hash: E341B663B18682C1EE209F15E4113BD6290EF85768F548135CA4D877D9EF3EE80DC30A
                                                                                                                Function 00007FF6EC4F66E8 Relevance: 7.8, APIs: 5, Instructions: 321fileCOMMON
                                                                                                                Download Yara Rule
                                                                                                                APIs
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 0000000C.00000002.2574093388.00007FF6EC4B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF6EC4B0000, based on PE: true
                                                                                                                • Associated: 0000000C.00000002.2574070380.00007FF6EC4B0000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                • Associated: 0000000C.00000002.2574132408.00007FF6EC504000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                • Associated: 0000000C.00000002.2574154940.00007FF6EC517000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                • Associated: 0000000C.00000002.2574176551.00007FF6EC51A000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_12_2_7ff6ec4b0000_tapinstall.jbxd
                                                                                                                Similarity
                                                                                                                • API ID: ErrorFileLastWrite$Console
                                                                                                                • String ID:
                                                                                                                • API String ID: 786612050-0
                                                                                                                • Opcode ID: d3beed3413ee1199dba947ae966059d4b9df67c161722cedc9c5d103b3af1309
                                                                                                                • Instruction ID: e45bfda9529816ba675bfb6e24eeccf3385fe7a7b26cbe7c1fde3508d7faf429
                                                                                                                • Opcode Fuzzy Hash: d3beed3413ee1199dba947ae966059d4b9df67c161722cedc9c5d103b3af1309
                                                                                                                • Instruction Fuzzy Hash: E4D1FF63B08A828AE711CF64D5842ED7BB1FB4578CB245136CE4E87B89DE39D11AC305
                                                                                                                Function 00007FF6EC4E8B44 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 35COMMON
                                                                                                                Download Yara Rule
                                                                                                                APIs
                                                                                                                Strings
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 0000000C.00000002.2574093388.00007FF6EC4B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF6EC4B0000, based on PE: true
                                                                                                                • Associated: 0000000C.00000002.2574070380.00007FF6EC4B0000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                • Associated: 0000000C.00000002.2574132408.00007FF6EC504000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                • Associated: 0000000C.00000002.2574154940.00007FF6EC517000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                • Associated: 0000000C.00000002.2574176551.00007FF6EC51A000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_12_2_7ff6ec4b0000_tapinstall.jbxd
                                                                                                                Similarity
                                                                                                                • API ID: InfoLocaletry_get_function
                                                                                                                • String ID: GetLocaleInfoEx
                                                                                                                • API String ID: 2200034068-2904428671
                                                                                                                • Opcode ID: 02750f415f3cd806410832db7a44b855064978a5e13e35f6515160912ac6add6
                                                                                                                • Instruction ID: bfc3a95baa994d2e237e81a04f1a1ddbbf616b96298252760257166b350a0b0f
                                                                                                                • Opcode Fuzzy Hash: 02750f415f3cd806410832db7a44b855064978a5e13e35f6515160912ac6add6
                                                                                                                • Instruction Fuzzy Hash: 5801F926B08B42C5EB00DB15B4022A9B760EF84FC8F554035EE5C97B56DF3DD915C349
                                                                                                                Function 00007FF6EC4F4ED0 Relevance: 4.7, APIs: 3, Instructions: 169COMMON
                                                                                                                Download Yara Rule
                                                                                                                APIs
                                                                                                                  • Part of subcall function 00007FF6EC4E75E8: GetLastError.KERNEL32(?,?,?,00007FF6EC4F7232,?,?,?,?,?,?,?,?,?,?,?,00007FF6EC4F712B), ref: 00007FF6EC4E75F7
                                                                                                                  • Part of subcall function 00007FF6EC4E75E8: SetLastError.KERNEL32(?,?,?,00007FF6EC4F7232,?,?,?,?,?,?,?,?,?,?,?,00007FF6EC4F712B), ref: 00007FF6EC4E7695
                                                                                                                • GetLocaleInfoW.KERNEL32 ref: 00007FF6EC4F4F3C
                                                                                                                  • Part of subcall function 00007FF6EC4C676C: _invalid_parameter_noinfo.LIBCMT ref: 00007FF6EC4C6789
                                                                                                                • GetLocaleInfoW.KERNEL32 ref: 00007FF6EC4F4F85
                                                                                                                  • Part of subcall function 00007FF6EC4C676C: _invalid_parameter_noinfo.LIBCMT ref: 00007FF6EC4C67E2
                                                                                                                • GetLocaleInfoW.KERNEL32 ref: 00007FF6EC4F5050
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 0000000C.00000002.2574093388.00007FF6EC4B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF6EC4B0000, based on PE: true
                                                                                                                • Associated: 0000000C.00000002.2574070380.00007FF6EC4B0000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                • Associated: 0000000C.00000002.2574132408.00007FF6EC504000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                • Associated: 0000000C.00000002.2574154940.00007FF6EC517000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                • Associated: 0000000C.00000002.2574176551.00007FF6EC51A000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_12_2_7ff6ec4b0000_tapinstall.jbxd
                                                                                                                Similarity
                                                                                                                • API ID: InfoLocale$ErrorLast_invalid_parameter_noinfo
                                                                                                                • String ID:
                                                                                                                • API String ID: 3644580040-0
                                                                                                                • Opcode ID: e8c6a04a7efb30580b1de6acdcde22ad9448435ad199d966b2e32c4fa01e2337
                                                                                                                • Instruction ID: 200638aba1055ca55db9ac511e5e96aa4a80279e50224e26af090ca717483726
                                                                                                                • Opcode Fuzzy Hash: e8c6a04a7efb30580b1de6acdcde22ad9448435ad199d966b2e32c4fa01e2337
                                                                                                                • Instruction Fuzzy Hash: 4C618833A08682CEEB349F11E5403A972A1FB84748F209135CB9EC7691DE3EE469C746
                                                                                                                Function 00007FF6EC4E8BC8 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 17COMMON
                                                                                                                Download Yara Rule
                                                                                                                APIs
                                                                                                                Strings
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 0000000C.00000002.2574093388.00007FF6EC4B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF6EC4B0000, based on PE: true
                                                                                                                • Associated: 0000000C.00000002.2574070380.00007FF6EC4B0000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                • Associated: 0000000C.00000002.2574132408.00007FF6EC504000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                • Associated: 0000000C.00000002.2574154940.00007FF6EC517000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                • Associated: 0000000C.00000002.2574176551.00007FF6EC51A000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_12_2_7ff6ec4b0000_tapinstall.jbxd
                                                                                                                Similarity
                                                                                                                • API ID: try_get_function
                                                                                                                • String ID: GetSystemTimePreciseAsFileTime
                                                                                                                • API String ID: 2742660187-595813830
                                                                                                                • Opcode ID: 1d0520b3f6df9746826bb7b6fcba1e6990199ef5daaa10c23599dce049dd0ac3
                                                                                                                • Instruction ID: 45dd62eef08a5452e7a18dff57647bb12391d6e2404c048d4bc3b12386849d3c
                                                                                                                • Opcode Fuzzy Hash: 1d0520b3f6df9746826bb7b6fcba1e6990199ef5daaa10c23599dce049dd0ac3
                                                                                                                • Instruction Fuzzy Hash: 86E08653E19907C0FF158B55A8123B01350EF1878CF460436CA1CCA250EE3DA9A9C31E
                                                                                                                Function 00007FF6EC4EE810 Relevance: 1.6, APIs: 1, Instructions: 148COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 0000000C.00000002.2574093388.00007FF6EC4B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF6EC4B0000, based on PE: true
                                                                                                                • Associated: 0000000C.00000002.2574070380.00007FF6EC4B0000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                • Associated: 0000000C.00000002.2574132408.00007FF6EC504000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                • Associated: 0000000C.00000002.2574154940.00007FF6EC517000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                • Associated: 0000000C.00000002.2574176551.00007FF6EC51A000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_12_2_7ff6ec4b0000_tapinstall.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: 856df5863eccf1104c719aaa65f4f0d1cbd3d57ca5dc9ce7de057cdd0c072f42
                                                                                                                • Instruction ID: 6ebb3eda049122bcefaa5e07cefa3520380e36ac648289b2171d4d1e83e775b8
                                                                                                                • Opcode Fuzzy Hash: 856df5863eccf1104c719aaa65f4f0d1cbd3d57ca5dc9ce7de057cdd0c072f42
                                                                                                                • Instruction Fuzzy Hash: 8551D223B0869188FB20DB76A9006AE7BA0BB417D8F154234EE9D8BBD5CF3DD005C705
                                                                                                                Function 00007FF6EC4F5120 Relevance: 1.6, APIs: 1, Instructions: 70COMMON
                                                                                                                Download Yara Rule
                                                                                                                APIs
                                                                                                                  • Part of subcall function 00007FF6EC4E75E8: GetLastError.KERNEL32(?,?,?,00007FF6EC4F7232,?,?,?,?,?,?,?,?,?,?,?,00007FF6EC4F712B), ref: 00007FF6EC4E75F7
                                                                                                                  • Part of subcall function 00007FF6EC4E75E8: SetLastError.KERNEL32(?,?,?,00007FF6EC4F7232,?,?,?,?,?,?,?,?,?,?,?,00007FF6EC4F712B), ref: 00007FF6EC4E7695
                                                                                                                • GetLocaleInfoW.KERNEL32 ref: 00007FF6EC4F5188
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 0000000C.00000002.2574093388.00007FF6EC4B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF6EC4B0000, based on PE: true
                                                                                                                • Associated: 0000000C.00000002.2574070380.00007FF6EC4B0000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                • Associated: 0000000C.00000002.2574132408.00007FF6EC504000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                • Associated: 0000000C.00000002.2574154940.00007FF6EC517000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                • Associated: 0000000C.00000002.2574176551.00007FF6EC51A000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_12_2_7ff6ec4b0000_tapinstall.jbxd
                                                                                                                Similarity
                                                                                                                • API ID: ErrorLast$InfoLocale
                                                                                                                • String ID:
                                                                                                                • API String ID: 3736152602-0
                                                                                                                • Opcode ID: 2daf3a8a6570d13e4a69e0773b16970abee15f26fc3cb4f4b112bd2ae792f481
                                                                                                                • Instruction ID: 9df7ad1655230c6947982152482e45e3bab813617d5e643efea8362866607448
                                                                                                                • Opcode Fuzzy Hash: 2daf3a8a6570d13e4a69e0773b16970abee15f26fc3cb4f4b112bd2ae792f481
                                                                                                                • Instruction Fuzzy Hash: C931A033E08682CAEB249B25E5413AE72A0FB48788F509135DA5DC7695DF3EF518C705
                                                                                                                Function 00007FF6EC4F4D3C Relevance: 1.6, APIs: 1, Instructions: 61COMMON
                                                                                                                Download Yara Rule
                                                                                                                APIs
                                                                                                                  • Part of subcall function 00007FF6EC4E75E8: GetLastError.KERNEL32(?,?,?,00007FF6EC4F7232,?,?,?,?,?,?,?,?,?,?,?,00007FF6EC4F712B), ref: 00007FF6EC4E75F7
                                                                                                                  • Part of subcall function 00007FF6EC4E75E8: SetLastError.KERNEL32(?,?,?,00007FF6EC4F7232,?,?,?,?,?,?,?,?,?,?,?,00007FF6EC4F712B), ref: 00007FF6EC4E7695
                                                                                                                • EnumSystemLocalesW.KERNEL32(?,?,?,00007FF6EC4F557B,?,00000000,00000092,?,?,00000000,?,00007FF6EC4E27F1), ref: 00007FF6EC4F4DDA
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 0000000C.00000002.2574093388.00007FF6EC4B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF6EC4B0000, based on PE: true
                                                                                                                • Associated: 0000000C.00000002.2574070380.00007FF6EC4B0000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                • Associated: 0000000C.00000002.2574132408.00007FF6EC504000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                • Associated: 0000000C.00000002.2574154940.00007FF6EC517000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                • Associated: 0000000C.00000002.2574176551.00007FF6EC51A000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_12_2_7ff6ec4b0000_tapinstall.jbxd
                                                                                                                Similarity
                                                                                                                • API ID: ErrorLast$EnumLocalesSystem
                                                                                                                • String ID:
                                                                                                                • API String ID: 2417226690-0
                                                                                                                • Opcode ID: b310e04edf9a4858b7711b1bc3cd10a3b5863322fdd0602e956277415e6d3450
                                                                                                                • Instruction ID: 09c3f7a2a5dfcba34d5be62a6c1d96b766d7ee6796631256323d8a499224d13f
                                                                                                                • Opcode Fuzzy Hash: b310e04edf9a4858b7711b1bc3cd10a3b5863322fdd0602e956277415e6d3450
                                                                                                                • Instruction Fuzzy Hash: BC11E463E18689CAEB248F15D0803B877A1FB90FA8F54A235CA19833C4CE79D6D5C751
                                                                                                                Function 00007FF6EC4F534C Relevance: 1.6, APIs: 1, Instructions: 50COMMON
                                                                                                                Download Yara Rule
                                                                                                                APIs
                                                                                                                  • Part of subcall function 00007FF6EC4E75E8: GetLastError.KERNEL32(?,?,?,00007FF6EC4F7232,?,?,?,?,?,?,?,?,?,?,?,00007FF6EC4F712B), ref: 00007FF6EC4E75F7
                                                                                                                  • Part of subcall function 00007FF6EC4E75E8: SetLastError.KERNEL32(?,?,?,00007FF6EC4F7232,?,?,?,?,?,?,?,?,?,?,?,00007FF6EC4F712B), ref: 00007FF6EC4E7695
                                                                                                                • GetLocaleInfoW.KERNEL32(?,?,?,00007FF6EC4F50CD), ref: 00007FF6EC4F5383
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 0000000C.00000002.2574093388.00007FF6EC4B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF6EC4B0000, based on PE: true
                                                                                                                • Associated: 0000000C.00000002.2574070380.00007FF6EC4B0000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                • Associated: 0000000C.00000002.2574132408.00007FF6EC504000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                • Associated: 0000000C.00000002.2574154940.00007FF6EC517000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                • Associated: 0000000C.00000002.2574176551.00007FF6EC51A000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_12_2_7ff6ec4b0000_tapinstall.jbxd
                                                                                                                Similarity
                                                                                                                • API ID: ErrorLast$InfoLocale
                                                                                                                • String ID:
                                                                                                                • API String ID: 3736152602-0
                                                                                                                • Opcode ID: f0e1e85cb0904cfb13678112b23ba47b692ebdb17e326b7273fc79358d1f6376
                                                                                                                • Instruction ID: 107bec3ccefb89d6d9dee934f100d14a8a14183c24a91deb528a1991111c81e8
                                                                                                                • Opcode Fuzzy Hash: f0e1e85cb0904cfb13678112b23ba47b692ebdb17e326b7273fc79358d1f6376
                                                                                                                • Instruction Fuzzy Hash: 9F113A33A1C5DAC6E7644B16D04037D22A0FB00768F602131EA2EC76C4DEBAD899C305
                                                                                                                Function 00007FF6EC4F4E0C Relevance: 1.5, APIs: 1, Instructions: 41COMMON
                                                                                                                Download Yara Rule
                                                                                                                APIs
                                                                                                                  • Part of subcall function 00007FF6EC4E75E8: GetLastError.KERNEL32(?,?,?,00007FF6EC4F7232,?,?,?,?,?,?,?,?,?,?,?,00007FF6EC4F712B), ref: 00007FF6EC4E75F7
                                                                                                                  • Part of subcall function 00007FF6EC4E75E8: SetLastError.KERNEL32(?,?,?,00007FF6EC4F7232,?,?,?,?,?,?,?,?,?,?,?,00007FF6EC4F712B), ref: 00007FF6EC4E7695
                                                                                                                • EnumSystemLocalesW.KERNEL32(?,?,?,00007FF6EC4F5537,?,00000000,00000092,?,?,00000000,?,00007FF6EC4E27F1), ref: 00007FF6EC4F4E8A
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 0000000C.00000002.2574093388.00007FF6EC4B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF6EC4B0000, based on PE: true
                                                                                                                • Associated: 0000000C.00000002.2574070380.00007FF6EC4B0000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                • Associated: 0000000C.00000002.2574132408.00007FF6EC504000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                • Associated: 0000000C.00000002.2574154940.00007FF6EC517000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                • Associated: 0000000C.00000002.2574176551.00007FF6EC51A000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_12_2_7ff6ec4b0000_tapinstall.jbxd
                                                                                                                Similarity
                                                                                                                • API ID: ErrorLast$EnumLocalesSystem
                                                                                                                • String ID:
                                                                                                                • API String ID: 2417226690-0
                                                                                                                • Opcode ID: e95a6f0b37c8df2f7d892436cbea75250c8106ecf43136de523b6d98b723d434
                                                                                                                • Instruction ID: 9c42d95d995435f29e9a9bcfcac9d5fea667bd8966abf5f429a9b80ff0f20e77
                                                                                                                • Opcode Fuzzy Hash: e95a6f0b37c8df2f7d892436cbea75250c8106ecf43136de523b6d98b723d434
                                                                                                                • Instruction Fuzzy Hash: 0601F573F082C5CAE7204B15E4407B976A1EB50BA8F55F231CA78876D4CF2EA888C706
                                                                                                                Function 00007FF6EC4E7A70 Relevance: 1.5, APIs: 1, Instructions: 32COMMON
                                                                                                                Download Yara Rule
                                                                                                                APIs
                                                                                                                • EnumSystemLocalesW.KERNEL32(?,?,00000000,00007FF6EC4E8911,?,?,?,?,?,?,?,?,00000000,00007FF6EC4F4244), ref: 00007FF6EC4E7ABF
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 0000000C.00000002.2574093388.00007FF6EC4B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF6EC4B0000, based on PE: true
                                                                                                                • Associated: 0000000C.00000002.2574070380.00007FF6EC4B0000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                • Associated: 0000000C.00000002.2574132408.00007FF6EC504000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                • Associated: 0000000C.00000002.2574154940.00007FF6EC517000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                • Associated: 0000000C.00000002.2574176551.00007FF6EC51A000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_12_2_7ff6ec4b0000_tapinstall.jbxd
                                                                                                                Similarity
                                                                                                                • API ID: EnumLocalesSystem
                                                                                                                • String ID:
                                                                                                                • API String ID: 2099609381-0
                                                                                                                • Opcode ID: 0c79f0349c4a0605245a055538df7ef28e0d12ebb44365a436a3ebf26f8b2171
                                                                                                                • Instruction ID: 4cf7c58d17c8dde466863e060692e70470d809f3771039aa140cde04155645bc
                                                                                                                • Opcode Fuzzy Hash: 0c79f0349c4a0605245a055538df7ef28e0d12ebb44365a436a3ebf26f8b2171
                                                                                                                • Instruction Fuzzy Hash: AFF0A972A08A8082E300CB29E8942A93365EB88BC0F049039EA0DC3724CF3DD9A4C309
                                                                                                                Function 00007FF6EC4F4CB8 Relevance: 1.5, APIs: 1, Instructions: 26COMMON
                                                                                                                Download Yara Rule
                                                                                                                APIs
                                                                                                                  • Part of subcall function 00007FF6EC4E75E8: GetLastError.KERNEL32(?,?,?,00007FF6EC4F7232,?,?,?,?,?,?,?,?,?,?,?,00007FF6EC4F712B), ref: 00007FF6EC4E75F7
                                                                                                                  • Part of subcall function 00007FF6EC4E75E8: SetLastError.KERNEL32(?,?,?,00007FF6EC4F7232,?,?,?,?,?,?,?,?,?,?,?,00007FF6EC4F712B), ref: 00007FF6EC4E7695
                                                                                                                • EnumSystemLocalesW.KERNEL32 ref: 00007FF6EC4F4CFF
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 0000000C.00000002.2574093388.00007FF6EC4B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF6EC4B0000, based on PE: true
                                                                                                                • Associated: 0000000C.00000002.2574070380.00007FF6EC4B0000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                • Associated: 0000000C.00000002.2574132408.00007FF6EC504000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                • Associated: 0000000C.00000002.2574154940.00007FF6EC517000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                • Associated: 0000000C.00000002.2574176551.00007FF6EC51A000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_12_2_7ff6ec4b0000_tapinstall.jbxd
                                                                                                                Similarity
                                                                                                                • API ID: ErrorLast$EnumLocalesSystem
                                                                                                                • String ID:
                                                                                                                • API String ID: 2417226690-0
                                                                                                                • Opcode ID: 37355801d101d15e73ed97373d1325733675572864da2e4454ebca36426ced02
                                                                                                                • Instruction ID: 4c13d3ff8e7b1386e7358133f24bb4397233de358adb8502bdb94de182b0031c
                                                                                                                • Opcode Fuzzy Hash: 37355801d101d15e73ed97373d1325733675572864da2e4454ebca36426ced02
                                                                                                                • Instruction Fuzzy Hash: 0CF05E63A0878985EB109F65F440369BBE1EB90BB8F15A231DA78832D5DE798594C306
                                                                                                                Function 00007FF6EC4E7B7C Relevance: 1.5, APIs: 1, Instructions: 19COMMON
                                                                                                                Download Yara Rule
                                                                                                                APIs
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 0000000C.00000002.2574093388.00007FF6EC4B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF6EC4B0000, based on PE: true
                                                                                                                • Associated: 0000000C.00000002.2574070380.00007FF6EC4B0000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                • Associated: 0000000C.00000002.2574132408.00007FF6EC504000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                • Associated: 0000000C.00000002.2574154940.00007FF6EC517000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                • Associated: 0000000C.00000002.2574176551.00007FF6EC51A000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_12_2_7ff6ec4b0000_tapinstall.jbxd
                                                                                                                Similarity
                                                                                                                • API ID: EnumLocalesSystem
                                                                                                                • String ID:
                                                                                                                • API String ID: 2099609381-0
                                                                                                                • Opcode ID: a3705e45a4f268f33fd337935757e13d22bf4229caecad54140b34f6bcf306e8
                                                                                                                • Instruction ID: d21e5cfdb5cb6ce9bda6a7a5653b44578eeb64b7b3949dcba9f338d3ac3ac21f
                                                                                                                • Opcode Fuzzy Hash: a3705e45a4f268f33fd337935757e13d22bf4229caecad54140b34f6bcf306e8
                                                                                                                • Instruction Fuzzy Hash: 52E06DA2A48E0185EB00DF09EC493253361AB58BE0F405039D90DC7724DF3ED1A9C305
                                                                                                                Function 00007FF6EC4E7BF8 Relevance: 1.5, APIs: 1, Instructions: 17COMMON
                                                                                                                Download Yara Rule
                                                                                                                APIs
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 0000000C.00000002.2574093388.00007FF6EC4B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF6EC4B0000, based on PE: true
                                                                                                                • Associated: 0000000C.00000002.2574070380.00007FF6EC4B0000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                • Associated: 0000000C.00000002.2574132408.00007FF6EC504000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                • Associated: 0000000C.00000002.2574154940.00007FF6EC517000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                • Associated: 0000000C.00000002.2574176551.00007FF6EC51A000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_12_2_7ff6ec4b0000_tapinstall.jbxd
                                                                                                                Similarity
                                                                                                                • API ID: EnumLocalesSystem
                                                                                                                • String ID:
                                                                                                                • API String ID: 2099609381-0
                                                                                                                • Opcode ID: ae0b7570886a34609fae074dd6b97874d1210b0956683149f338bd6385165f94
                                                                                                                • Instruction ID: 1ae124d27b93df1e3adceba1cc9e156b18ceac56e29b31313e930bd2a72e4ec5
                                                                                                                • Opcode Fuzzy Hash: ae0b7570886a34609fae074dd6b97874d1210b0956683149f338bd6385165f94
                                                                                                                • Instruction Fuzzy Hash: B6E04F22A48E0285E2049B49FC593752365ABE97A0F801139EC0DC7720AF3E96AAC305
                                                                                                                Function 00007FF6EC4F57E0 Relevance: 1.3, APIs: 1, Instructions: 7memoryCOMMON
                                                                                                                Download Yara Rule
                                                                                                                APIs
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 0000000C.00000002.2574093388.00007FF6EC4B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF6EC4B0000, based on PE: true
                                                                                                                • Associated: 0000000C.00000002.2574070380.00007FF6EC4B0000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                • Associated: 0000000C.00000002.2574132408.00007FF6EC504000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                • Associated: 0000000C.00000002.2574154940.00007FF6EC517000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                • Associated: 0000000C.00000002.2574176551.00007FF6EC51A000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_12_2_7ff6ec4b0000_tapinstall.jbxd
                                                                                                                Similarity
                                                                                                                • API ID: HeapProcess
                                                                                                                • String ID:
                                                                                                                • API String ID: 54951025-0
                                                                                                                • Opcode ID: ad7aa9be03b136a8b86c241834f3511267ad507e402bf7d5c4e724964e796d7d
                                                                                                                • Instruction ID: 62c220c4a218ffe6759491dd272af2d5e83ec935db7f6dd1593a9be5471ec3b4
                                                                                                                • Opcode Fuzzy Hash: ad7aa9be03b136a8b86c241834f3511267ad507e402bf7d5c4e724964e796d7d
                                                                                                                • Instruction Fuzzy Hash: 64B09221E17A02C2EB082B167C8636422A4BF9C700F944038C90CC2320EE2D24B9A716
                                                                                                                Function 00007FF6EC501B20 Relevance: .0, Instructions: 32COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 0000000C.00000002.2574093388.00007FF6EC4B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF6EC4B0000, based on PE: true
                                                                                                                • Associated: 0000000C.00000002.2574070380.00007FF6EC4B0000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                • Associated: 0000000C.00000002.2574132408.00007FF6EC504000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                • Associated: 0000000C.00000002.2574154940.00007FF6EC517000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                • Associated: 0000000C.00000002.2574176551.00007FF6EC51A000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_12_2_7ff6ec4b0000_tapinstall.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: 12c6a83125842657aa20d81587556ef437bc21cebfee6fedb56fe02cecd375e9
                                                                                                                • Instruction ID: 8fe06ed472955fcca65732f3cc88ccaa484a527ae67e5f2701443162e3738913
                                                                                                                • Opcode Fuzzy Hash: 12c6a83125842657aa20d81587556ef437bc21cebfee6fedb56fe02cecd375e9
                                                                                                                • Instruction Fuzzy Hash: 2BF06272B286959ADBA48F2CA84376977D0E748384F908039E68DC3B14DA3D9061CF09
                                                                                                                Function 00007FF6EC4B8738 Relevance: .0, Instructions: 2COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 0000000C.00000002.2574093388.00007FF6EC4B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF6EC4B0000, based on PE: true
                                                                                                                • Associated: 0000000C.00000002.2574070380.00007FF6EC4B0000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                • Associated: 0000000C.00000002.2574132408.00007FF6EC504000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                • Associated: 0000000C.00000002.2574154940.00007FF6EC517000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                • Associated: 0000000C.00000002.2574176551.00007FF6EC51A000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_12_2_7ff6ec4b0000_tapinstall.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: 075bea70bcd4d8cceaabd6cf7978304fe9b2e4df568cf5a1b525f3513ad4298d
                                                                                                                • Instruction ID: d7e8574b92f77fa9d48ff6563d61ee2a6fee279f9f1dbb939d6562db8bd516ad
                                                                                                                • Opcode Fuzzy Hash: 075bea70bcd4d8cceaabd6cf7978304fe9b2e4df568cf5a1b525f3513ad4298d
                                                                                                                • Instruction Fuzzy Hash: 28A00122A08942D0E7458B00A8552756360FB50308B400431D40DC10A4EF2EA814C34A
                                                                                                                Function 00007FF6EC4BE890 Relevance: 82.7, APIs: 44, Strings: 3, Instructions: 459COMMONLIBRARYCODE
                                                                                                                Download Yara Rule
                                                                                                                APIs
                                                                                                                Strings
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 0000000C.00000002.2574093388.00007FF6EC4B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF6EC4B0000, based on PE: true
                                                                                                                • Associated: 0000000C.00000002.2574070380.00007FF6EC4B0000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                • Associated: 0000000C.00000002.2574132408.00007FF6EC504000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                • Associated: 0000000C.00000002.2574154940.00007FF6EC517000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                • Associated: 0000000C.00000002.2574176551.00007FF6EC51A000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_12_2_7ff6ec4b0000_tapinstall.jbxd
                                                                                                                Similarity
                                                                                                                • API ID: Name::operator+Name::operator+=$Decorator::getName$Name::Name::operator=$Name::doPchar$DimensionSigned$DataDecoratedEncodingStringSymbolType
                                                                                                                • String ID: `anonymous namespace'$`string'$operator
                                                                                                                • API String ID: 2020783597-815891235
                                                                                                                • Opcode ID: aede423d4dabe3da59b1e03a92da396b2b5059be44e77dc81dd73a52e45e54ff
                                                                                                                • Instruction ID: e0db67b818d523fbc6248b3479d6ff729beebb8ef50be753484a6959c53a2364
                                                                                                                • Opcode Fuzzy Hash: aede423d4dabe3da59b1e03a92da396b2b5059be44e77dc81dd73a52e45e54ff
                                                                                                                • Instruction Fuzzy Hash: 84228C63E18A56D8FB14DB64D8943FC23B1BF4478CF904036DA0D9769EDE2AE459C30A
                                                                                                                Function 00007FF6EC4BC6CC Relevance: 73.8, APIs: 17, Strings: 25, Instructions: 277COMMONLIBRARYCODE
                                                                                                                Download Yara Rule
                                                                                                                APIs
                                                                                                                Strings
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 0000000C.00000002.2574093388.00007FF6EC4B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF6EC4B0000, based on PE: true
                                                                                                                • Associated: 0000000C.00000002.2574070380.00007FF6EC4B0000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                • Associated: 0000000C.00000002.2574132408.00007FF6EC504000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                • Associated: 0000000C.00000002.2574154940.00007FF6EC517000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                • Associated: 0000000C.00000002.2574176551.00007FF6EC51A000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_12_2_7ff6ec4b0000_tapinstall.jbxd
                                                                                                                Similarity
                                                                                                                • API ID: Name::operator=$Name::operator+Name::operator+=$Decorator::getNameName::Type$DataName::doPchar
                                                                                                                • String ID: volatile$<unknown>$UNKNOWN$__int128$__int16$__int32$__int64$__int8$__w64 $bool$char$char16_t$char32_t$const$double$float$int$long$long $short$signed $unsigned $void$volatile$wchar_t
                                                                                                                • API String ID: 1480303775-3737837666
                                                                                                                • Opcode ID: 5336914cda9eb7d28fc33c9881fb9f0eefb368431fddd4b441b46ed6f18de0a2
                                                                                                                • Instruction ID: 9842fa8fe49514c9972eb3d19fb1170e8f958473249af7172a9dc03ae3012d99
                                                                                                                • Opcode Fuzzy Hash: 5336914cda9eb7d28fc33c9881fb9f0eefb368431fddd4b441b46ed6f18de0a2
                                                                                                                • Instruction Fuzzy Hash: 0AD13A63E18A13D5FB14CB64D8C47BC22A0BB1438CF904432DA0ED6698EF7EE558C34A
                                                                                                                Function 00007FF6EC4C03F0 Relevance: 59.7, APIs: 30, Strings: 4, Instructions: 242COMMONLIBRARYCODE
                                                                                                                Download Yara Rule
                                                                                                                APIs
                                                                                                                Strings
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 0000000C.00000002.2574093388.00007FF6EC4B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF6EC4B0000, based on PE: true
                                                                                                                • Associated: 0000000C.00000002.2574070380.00007FF6EC4B0000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                • Associated: 0000000C.00000002.2574132408.00007FF6EC504000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                • Associated: 0000000C.00000002.2574154940.00007FF6EC517000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                • Associated: 0000000C.00000002.2574176551.00007FF6EC51A000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_12_2_7ff6ec4b0000_tapinstall.jbxd
                                                                                                                Similarity
                                                                                                                • API ID: Decorator::get$Name::operator+=$DimensionSigned$Name$Name::operator+$DecoratedName::$DataName::doName::getPcharStringType
                                                                                                                • String ID: NULL$`generic-class-parameter-$`generic-method-parameter-$`template-type-parameter-
                                                                                                                • API String ID: 283215372-4167119577
                                                                                                                • Opcode ID: 7b301788f1c808b6dbcb0f6369f2a7d1d94637bd6059d460935599cb42e21360
                                                                                                                • Instruction ID: 1e6cb8bfa78ef06f1a15089cf850a03545d57ccafece2f99b6e486f7986bebc4
                                                                                                                • Opcode Fuzzy Hash: 7b301788f1c808b6dbcb0f6369f2a7d1d94637bd6059d460935599cb42e21360
                                                                                                                • Instruction Fuzzy Hash: 38B16B63F0D602D9FB25DB64C4447FC27A19B5078CF940036CA1D9A6AADF3EA51EC30A
                                                                                                                Function 00007FF6EC4BE070 Relevance: 52.9, APIs: 35, Instructions: 365COMMONLIBRARYCODE
                                                                                                                Download Yara Rule
                                                                                                                APIs
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 0000000C.00000002.2574093388.00007FF6EC4B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF6EC4B0000, based on PE: true
                                                                                                                • Associated: 0000000C.00000002.2574070380.00007FF6EC4B0000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                • Associated: 0000000C.00000002.2574132408.00007FF6EC504000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                • Associated: 0000000C.00000002.2574154940.00007FF6EC517000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                • Associated: 0000000C.00000002.2574176551.00007FF6EC51A000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_12_2_7ff6ec4b0000_tapinstall.jbxd
                                                                                                                Similarity
                                                                                                                • API ID: Name::operator+$Decorator::get$DataIndirectNameName::Name::doName::operator+=PcharScopeType
                                                                                                                • String ID:
                                                                                                                • API String ID: 3173522582-0
                                                                                                                • Opcode ID: 0f8fc59074820430211e5edccfc92087bcdcd104a7c28eeafd2b21ab4534d517
                                                                                                                • Instruction ID: 9f572545ff1c68f66e93c688ff554fb1578070266a7f89f43c10bed6c09b890d
                                                                                                                • Opcode Fuzzy Hash: 0f8fc59074820430211e5edccfc92087bcdcd104a7c28eeafd2b21ab4534d517
                                                                                                                • Instruction Fuzzy Hash: 39027C77B08A82EAEB10DF74D4802EC37B1EB4474CB444436DA4D97B9ADE39D519C34A
                                                                                                                Function 00007FF6EC4E92EC Relevance: 36.8, APIs: 10, Strings: 11, Instructions: 57COMMON
                                                                                                                Download Yara Rule
                                                                                                                APIs
                                                                                                                • try_get_function.LIBVCRUNTIME ref: 00007FF6EC4E9307
                                                                                                                • try_get_function.LIBVCRUNTIME ref: 00007FF6EC4E9326
                                                                                                                  • Part of subcall function 00007FF6EC4E81A8: GetProcAddress.KERNEL32(?,?,00000006,00007FF6EC4E8A2A,?,?,00000000,00007FF6EC4E77AE,?,?,00000000,00007FF6EC4E6B85), ref: 00007FF6EC4E8300
                                                                                                                • try_get_function.LIBVCRUNTIME ref: 00007FF6EC4E9345
                                                                                                                  • Part of subcall function 00007FF6EC4E81A8: LoadLibraryExW.KERNELBASE(?,?,00000006,00007FF6EC4E8A2A,?,?,00000000,00007FF6EC4E77AE,?,?,00000000,00007FF6EC4E6B85), ref: 00007FF6EC4E824B
                                                                                                                  • Part of subcall function 00007FF6EC4E81A8: GetLastError.KERNEL32(?,?,00000006,00007FF6EC4E8A2A,?,?,00000000,00007FF6EC4E77AE,?,?,00000000,00007FF6EC4E6B85), ref: 00007FF6EC4E8259
                                                                                                                  • Part of subcall function 00007FF6EC4E81A8: LoadLibraryExW.KERNEL32(?,?,00000006,00007FF6EC4E8A2A,?,?,00000000,00007FF6EC4E77AE,?,?,00000000,00007FF6EC4E6B85), ref: 00007FF6EC4E829B
                                                                                                                • try_get_function.LIBVCRUNTIME ref: 00007FF6EC4E9364
                                                                                                                  • Part of subcall function 00007FF6EC4E81A8: FreeLibrary.KERNEL32(?,?,00000006,00007FF6EC4E8A2A,?,?,00000000,00007FF6EC4E77AE,?,?,00000000,00007FF6EC4E6B85), ref: 00007FF6EC4E82D4
                                                                                                                • try_get_function.LIBVCRUNTIME ref: 00007FF6EC4E9383
                                                                                                                • try_get_function.LIBVCRUNTIME ref: 00007FF6EC4E93A2
                                                                                                                • try_get_function.LIBVCRUNTIME ref: 00007FF6EC4E93C1
                                                                                                                • try_get_function.LIBVCRUNTIME ref: 00007FF6EC4E93E0
                                                                                                                • try_get_function.LIBVCRUNTIME ref: 00007FF6EC4E93FF
                                                                                                                • try_get_function.LIBVCRUNTIME ref: 00007FF6EC4E941E
                                                                                                                Strings
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 0000000C.00000002.2574093388.00007FF6EC4B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF6EC4B0000, based on PE: true
                                                                                                                • Associated: 0000000C.00000002.2574070380.00007FF6EC4B0000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                • Associated: 0000000C.00000002.2574132408.00007FF6EC504000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                • Associated: 0000000C.00000002.2574154940.00007FF6EC517000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                • Associated: 0000000C.00000002.2574176551.00007FF6EC51A000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_12_2_7ff6ec4b0000_tapinstall.jbxd
                                                                                                                Similarity
                                                                                                                • API ID: try_get_function$Library$Load$AddressErrorFreeLastProc
                                                                                                                • String ID: AreFileApisANSI$CompareStringEx$EnumSystemLocalesEx$GetDateFormatEx$GetLocaleInfoEx$GetTimeFormatEx$GetUserDefaultLocaleName$IsValidLocaleName$LCIDToLocaleName$LCMapStringEx$LocaleNameToLCID
                                                                                                                • API String ID: 3255926029-3252031757
                                                                                                                • Opcode ID: f5ddb8dc0f958fd9ea081183d1d9282a99c58eacf92a6cfce449543f48408e78
                                                                                                                • Instruction ID: d65d04f118eabf8b8f073560a9c335607a8a988fec153732c2e9881a60247cdb
                                                                                                                • Opcode Fuzzy Hash: f5ddb8dc0f958fd9ea081183d1d9282a99c58eacf92a6cfce449543f48408e78
                                                                                                                • Instruction Fuzzy Hash: 15319566908A47A0FA04DB54EC527F02361BF4438CFC1157BD51DD61A1BF3EA6AAC38B
                                                                                                                Function 00007FF6EC4B61F0 Relevance: 28.2, APIs: 12, Strings: 4, Instructions: 191COMMON
                                                                                                                Download Yara Rule
                                                                                                                APIs
                                                                                                                Strings
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 0000000C.00000002.2574093388.00007FF6EC4B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF6EC4B0000, based on PE: true
                                                                                                                • Associated: 0000000C.00000002.2574070380.00007FF6EC4B0000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                • Associated: 0000000C.00000002.2574132408.00007FF6EC504000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                • Associated: 0000000C.00000002.2574154940.00007FF6EC517000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                • Associated: 0000000C.00000002.2574176551.00007FF6EC51A000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_12_2_7ff6ec4b0000_tapinstall.jbxd
                                                                                                                Similarity
                                                                                                                • API ID: Get_$Des_Res_$Conf_Log_$First_Free_Handle$Data_Next_$DetailDeviceInfoListNode_SetupSize_Status_
                                                                                                                • String ID: DMA : %u$IO : %04I64x-%04I64x$IRQ : %u$MEM : %08I64x-%08I64x
                                                                                                                • API String ID: 2957808706-3427375868
                                                                                                                • Opcode ID: a4e06f8e4a64dca8354c6e1283bba188da2d5f0b0782a176430cef695ac593de
                                                                                                                • Instruction ID: 9ac7568f2334999a52369a146bf34c071b05dcbbc4e8bfa3613c7e2cc600f2f1
                                                                                                                • Opcode Fuzzy Hash: a4e06f8e4a64dca8354c6e1283bba188da2d5f0b0782a176430cef695ac593de
                                                                                                                • Instruction Fuzzy Hash: 3191A433618A82C6E7549F25E4417BE6364FB81B8CF001435EA4D8769DDF3EE859CB09
                                                                                                                Function 00007FF6EC4B2C90 Relevance: 26.6, APIs: 11, Strings: 4, Instructions: 380serviceregistryCOMMON
                                                                                                                Download Yara Rule
                                                                                                                APIs
                                                                                                                Strings
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 0000000C.00000002.2574093388.00007FF6EC4B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF6EC4B0000, based on PE: true
                                                                                                                • Associated: 0000000C.00000002.2574070380.00007FF6EC4B0000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                • Associated: 0000000C.00000002.2574132408.00007FF6EC504000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                • Associated: 0000000C.00000002.2574154940.00007FF6EC517000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                • Associated: 0000000C.00000002.2574176551.00007FF6EC51A000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_12_2_7ff6ec4b0000_tapinstall.jbxd
                                                                                                                Similarity
                                                                                                                • API ID: Close$OpenService$ClassHandleSetup$ErrorFromGuidsLastManagerName_invalid_parameter_noinfo
                                                                                                                • String ID: LowerFilters$UpperFilters$lower$upper
                                                                                                                • API String ID: 159866419-3449112408
                                                                                                                • Opcode ID: a2b8f44849a2b4c4615213b9abc1f695b87c42ada8e51fb98db3f05113dc89bc
                                                                                                                • Instruction ID: cf8ff4c64c3aeb01e1562ab9d37aa1d522a5a2128e1b125c4350f357061227e6
                                                                                                                • Opcode Fuzzy Hash: a2b8f44849a2b4c4615213b9abc1f695b87c42ada8e51fb98db3f05113dc89bc
                                                                                                                • Instruction Fuzzy Hash: 9BE1D223B09A46C1EA249B16D55037E62A5FF44BD8F448231EE1E877D9DF3EE849C306
                                                                                                                Function 00007FF6EC4C1088 Relevance: 24.7, APIs: 12, Strings: 2, Instructions: 195COMMONLIBRARYCODE
                                                                                                                Download Yara Rule
                                                                                                                APIs
                                                                                                                Strings
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 0000000C.00000002.2574093388.00007FF6EC4B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF6EC4B0000, based on PE: true
                                                                                                                • Associated: 0000000C.00000002.2574070380.00007FF6EC4B0000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                • Associated: 0000000C.00000002.2574132408.00007FF6EC504000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                • Associated: 0000000C.00000002.2574154940.00007FF6EC517000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                • Associated: 0000000C.00000002.2574176551.00007FF6EC51A000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_12_2_7ff6ec4b0000_tapinstall.jbxd
                                                                                                                Similarity
                                                                                                                • API ID: Decorator::getNameReplicator::operator+=Template
                                                                                                                • String ID: generic-type-$template-parameter-
                                                                                                                • API String ID: 2731555906-13229604
                                                                                                                • Opcode ID: 84b3677d49f92f823a7e74a3a09ad7f2eb3bf894bac47f523860a981e25c4147
                                                                                                                • Instruction ID: b13d8abbcffc5dbacaed8d1185534691bcfa5d3fc32811e6cd56d26387b6426b
                                                                                                                • Opcode Fuzzy Hash: 84b3677d49f92f823a7e74a3a09ad7f2eb3bf894bac47f523860a981e25c4147
                                                                                                                • Instruction Fuzzy Hash: 45916C67A18A46D8FB108F65D4506BC37A1AB45B88B810035EA0DDB7A5DE3EE51EC30A
                                                                                                                Function 00007FF6EC4B5BD0 Relevance: 21.3, APIs: 11, Strings: 1, Instructions: 272timeCOMMON
                                                                                                                Download Yara Rule
                                                                                                                APIs
                                                                                                                Strings
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 0000000C.00000002.2574093388.00007FF6EC4B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF6EC4B0000, based on PE: true
                                                                                                                • Associated: 0000000C.00000002.2574070380.00007FF6EC4B0000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                • Associated: 0000000C.00000002.2574132408.00007FF6EC504000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                • Associated: 0000000C.00000002.2574154940.00007FF6EC517000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                • Associated: 0000000C.00000002.2574176551.00007FF6EC51A000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_12_2_7ff6ec4b0000_tapinstall.jbxd
                                                                                                                Similarity
                                                                                                                • API ID: Setup$Driver$Info$InstallParams$DeviceEnumFormatListTime$BuildDateDestroyDetailErrorFileFreeLastLocalMessageSystem
                                                                                                                • String ID:
                                                                                                                • API String ID: 2668181066-3916222277
                                                                                                                • Opcode ID: e4b5dfb2d01c01c868df09e416ecf3eefc922ffbc0b423e26137771d3025f2ca
                                                                                                                • Instruction ID: 53d3e3f1d9fdfc8d81541ee2ddbadc19bf9c309f1528f4971b6925faba71961c
                                                                                                                • Opcode Fuzzy Hash: e4b5dfb2d01c01c868df09e416ecf3eefc922ffbc0b423e26137771d3025f2ca
                                                                                                                • Instruction Fuzzy Hash: 37C1A273A0858586F324AB61E4117FE6251EF84788F404435EE4E8B7DACF3EE548CB96
                                                                                                                Function 00007FF6EC4C3800 Relevance: 19.6, APIs: 8, Strings: 3, Instructions: 316COMMONLIBRARYCODE
                                                                                                                Download Yara Rule
                                                                                                                APIs
                                                                                                                Strings
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 0000000C.00000002.2574093388.00007FF6EC4B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF6EC4B0000, based on PE: true
                                                                                                                • Associated: 0000000C.00000002.2574070380.00007FF6EC4B0000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                • Associated: 0000000C.00000002.2574132408.00007FF6EC504000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                • Associated: 0000000C.00000002.2574154940.00007FF6EC517000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                • Associated: 0000000C.00000002.2574176551.00007FF6EC51A000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_12_2_7ff6ec4b0000_tapinstall.jbxd
                                                                                                                Similarity
                                                                                                                • API ID: FrameHandler3::Unwind$BlockException$CatchDestructExecutionFramesHandlerHelperIs_bad_exception_allowedMatchNestedObjectSearchStateThrowTypestd::bad_alloc::bad_alloc
                                                                                                                • String ID: csm$csm$csm
                                                                                                                • API String ID: 15165021-393685449
                                                                                                                • Opcode ID: 21b97b16db538992eb6a75333495f7bcb45038915a3eb3cb518b00d563e8fba0
                                                                                                                • Instruction ID: b4bf65d8d0b74d514eb74bd359d5014d5dd2ae8f7f399136f808f4530c6f180a
                                                                                                                • Opcode Fuzzy Hash: 21b97b16db538992eb6a75333495f7bcb45038915a3eb3cb518b00d563e8fba0
                                                                                                                • Instruction Fuzzy Hash: D7E17D23A08741CAFB20DB65D4407AD6BA0FB5979CF100135EE8D9BB69DF39E498C706
                                                                                                                Function 00007FF6EC4B6530 Relevance: 17.6, APIs: 6, Strings: 4, Instructions: 116COMMON
                                                                                                                Download Yara Rule
                                                                                                                APIs
                                                                                                                Strings
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 0000000C.00000002.2574093388.00007FF6EC4B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF6EC4B0000, based on PE: true
                                                                                                                • Associated: 0000000C.00000002.2574070380.00007FF6EC4B0000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                • Associated: 0000000C.00000002.2574132408.00007FF6EC504000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                • Associated: 0000000C.00000002.2574154940.00007FF6EC517000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                • Associated: 0000000C.00000002.2574176551.00007FF6EC51A000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_12_2_7ff6ec4b0000_tapinstall.jbxd
                                                                                                                Similarity
                                                                                                                • API ID: Des_Res_$Get_$Data_Free_HandleNext_$Size_
                                                                                                                • String ID: DMA : %u$IO : %04I64x-%04I64x$IRQ : %u$MEM : %08I64x-%08I64x
                                                                                                                • API String ID: 1110773400-3427375868
                                                                                                                • Opcode ID: 9e4a8363610eefb0b6cbcea2d3461c166d1163f148688767d300006fdf73812f
                                                                                                                • Instruction ID: 2edd9aecea76e690a31c77825e1893a8a6e437dc6e710113bfd851461187c4e3
                                                                                                                • Opcode Fuzzy Hash: 9e4a8363610eefb0b6cbcea2d3461c166d1163f148688767d300006fdf73812f
                                                                                                                • Instruction Fuzzy Hash: 08418E23A08A42C2EA649F29E5457BD6360FB84B88F044435DE4DC7799DF3EE859C706
                                                                                                                Function 00007FF6EC4B5920 Relevance: 16.6, APIs: 11, Instructions: 150COMMON
                                                                                                                Download Yara Rule
                                                                                                                APIs
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 0000000C.00000002.2574093388.00007FF6EC4B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF6EC4B0000, based on PE: true
                                                                                                                • Associated: 0000000C.00000002.2574070380.00007FF6EC4B0000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                • Associated: 0000000C.00000002.2574132408.00007FF6EC504000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                • Associated: 0000000C.00000002.2574154940.00007FF6EC517000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                • Associated: 0000000C.00000002.2574176551.00007FF6EC51A000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_12_2_7ff6ec4b0000_tapinstall.jbxd
                                                                                                                Similarity
                                                                                                                • API ID: Setup$Driver$DeviceFileInfoInstallParamsQueue$ListScan$BuildCallClassCloseDestroyDetailEnumErrorFormatFreeInstallerLastLocalMessageOpenSelected
                                                                                                                • String ID:
                                                                                                                • API String ID: 1606212837-0
                                                                                                                • Opcode ID: e12b59f62743ec06b6094670a4a11f57fde35331bb7a5217e71e5602add53916
                                                                                                                • Instruction ID: 8824c844a09091701c365e3fb40e64feeb3813f5c6c54c3bd549df72392d2f6e
                                                                                                                • Opcode Fuzzy Hash: e12b59f62743ec06b6094670a4a11f57fde35331bb7a5217e71e5602add53916
                                                                                                                • Instruction Fuzzy Hash: 79618F22A1868286E7209F21E8517FE73A4FB84B98F404635DE1D87AD8DF3ED549C705
                                                                                                                Function 00007FF6EC4B34B0 Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 83libraryloaderCOMMON
                                                                                                                Download Yara Rule
                                                                                                                APIs
                                                                                                                Strings
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 0000000C.00000002.2574093388.00007FF6EC4B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF6EC4B0000, based on PE: true
                                                                                                                • Associated: 0000000C.00000002.2574070380.00007FF6EC4B0000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                • Associated: 0000000C.00000002.2574132408.00007FF6EC504000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                • Associated: 0000000C.00000002.2574154940.00007FF6EC517000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                • Associated: 0000000C.00000002.2574176551.00007FF6EC51A000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_12_2_7ff6ec4b0000_tapinstall.jbxd
                                                                                                                Similarity
                                                                                                                • API ID: Library$AddressErrorFreeFullLastLoadNamePathProc
                                                                                                                • String ID: SetupUninstallOEMInfW$setupapi.dll
                                                                                                                • API String ID: 3805412813-3713901415
                                                                                                                • Opcode ID: 07190c82b7a186e3b5898b35f52d877f32724abc198f9c48db99fcc8c26ec65d
                                                                                                                • Instruction ID: 9155300f61fb25ffc78a127da68d5bcc337aecf6e3e694fe60f31b0b005d3b68
                                                                                                                • Opcode Fuzzy Hash: 07190c82b7a186e3b5898b35f52d877f32724abc198f9c48db99fcc8c26ec65d
                                                                                                                • Instruction Fuzzy Hash: 27319023A0CA8682FB209B11E9553BE6291EF84748F404035DD4EC7B99DF3EE84CC74A
                                                                                                                Function 00007FF6EC4C3CDC Relevance: 14.3, APIs: 5, Strings: 3, Instructions: 317COMMONLIBRARYCODE
                                                                                                                Download Yara Rule
                                                                                                                APIs
                                                                                                                Strings
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 0000000C.00000002.2574093388.00007FF6EC4B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF6EC4B0000, based on PE: true
                                                                                                                • Associated: 0000000C.00000002.2574070380.00007FF6EC4B0000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                • Associated: 0000000C.00000002.2574132408.00007FF6EC504000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                • Associated: 0000000C.00000002.2574154940.00007FF6EC517000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                • Associated: 0000000C.00000002.2574176551.00007FF6EC51A000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_12_2_7ff6ec4b0000_tapinstall.jbxd
                                                                                                                Similarity
                                                                                                                • API ID: Exception$DestructHelperIs_bad_exception_allowedMatchObjectThrowTypestd::bad_alloc::bad_alloc
                                                                                                                • String ID: csm$csm$csm
                                                                                                                • API String ID: 3999431683-393685449
                                                                                                                • Opcode ID: dd461791980e8857ea159d38e58e30428d4de1eaec1c9c9603251b4acd30a3b7
                                                                                                                • Instruction ID: f673187162e364a6128c46d46efc27bd4a8313a590cb389a3a6d0c455ea4c392
                                                                                                                • Opcode Fuzzy Hash: dd461791980e8857ea159d38e58e30428d4de1eaec1c9c9603251b4acd30a3b7
                                                                                                                • Instruction Fuzzy Hash: E7E18A73A08682CAFB20DB2594447BD3BA0FB5475CF105136DE8D8B769CE3AE589C706
                                                                                                                Function 00007FF6EC4B2540 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 139COMMON
                                                                                                                Download Yara Rule
                                                                                                                APIs
                                                                                                                Strings
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 0000000C.00000002.2574093388.00007FF6EC4B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF6EC4B0000, based on PE: true
                                                                                                                • Associated: 0000000C.00000002.2574070380.00007FF6EC4B0000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                • Associated: 0000000C.00000002.2574132408.00007FF6EC504000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                • Associated: 0000000C.00000002.2574154940.00007FF6EC517000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                • Associated: 0000000C.00000002.2574176551.00007FF6EC51A000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_12_2_7ff6ec4b0000_tapinstall.jbxd
                                                                                                                Similarity
                                                                                                                • API ID: Setup$Device$Info$ClassCreateList$CallDestroyFullInstallerNamePathPropertyRegistry
                                                                                                                • String ID:
                                                                                                                • API String ID: 1846165353-3916222277
                                                                                                                • Opcode ID: cea8426861f3347b505c897b4f246ebb9bfdbc3591874b8a41b436473b598dc7
                                                                                                                • Instruction ID: 5bc7057d5dcab0720f364fe996cae36628a6a344218d32091017fcfb4a114ffc
                                                                                                                • Opcode Fuzzy Hash: cea8426861f3347b505c897b4f246ebb9bfdbc3591874b8a41b436473b598dc7
                                                                                                                • Instruction Fuzzy Hash: BF517223A08A8281EB209F15E4047AE73A5FB84B98F544131DE9D83798EF7ED549C709
                                                                                                                Function 00007FF6EC4C07B4 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 76COMMONLIBRARYCODE
                                                                                                                Download Yara Rule
                                                                                                                APIs
                                                                                                                Strings
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 0000000C.00000002.2574093388.00007FF6EC4B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF6EC4B0000, based on PE: true
                                                                                                                • Associated: 0000000C.00000002.2574070380.00007FF6EC4B0000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                • Associated: 0000000C.00000002.2574132408.00007FF6EC504000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                • Associated: 0000000C.00000002.2574154940.00007FF6EC517000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                • Associated: 0000000C.00000002.2574176551.00007FF6EC51A000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_12_2_7ff6ec4b0000_tapinstall.jbxd
                                                                                                                Similarity
                                                                                                                • API ID: NameName::Name::operator+Name::operator+=$Decorator::getDimensionName::doPcharSigned
                                                                                                                • String ID: `template-parameter$void
                                                                                                                • API String ID: 1951524168-4057429177
                                                                                                                • Opcode ID: 7a7c9e4356da7ebb837bbe34803b1ef7ec7b8755a3141d29af5874025b868cc2
                                                                                                                • Instruction ID: 980ec05919c03193fa805bb2b899ab49a885158b9678e5a799d7601296df23a5
                                                                                                                • Opcode Fuzzy Hash: 7a7c9e4356da7ebb837bbe34803b1ef7ec7b8755a3141d29af5874025b868cc2
                                                                                                                • Instruction Fuzzy Hash: F1316D23B08A02D8FB018B65D8953BD23A1BB04B88F854035DE1D9B669DF3EE41DC35A
                                                                                                                Function 00007FF6EC4BD948 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 102COMMONLIBRARYCODE
                                                                                                                Download Yara Rule
                                                                                                                APIs
                                                                                                                Strings
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 0000000C.00000002.2574093388.00007FF6EC4B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF6EC4B0000, based on PE: true
                                                                                                                • Associated: 0000000C.00000002.2574070380.00007FF6EC4B0000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                • Associated: 0000000C.00000002.2574132408.00007FF6EC504000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                • Associated: 0000000C.00000002.2574154940.00007FF6EC517000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                • Associated: 0000000C.00000002.2574176551.00007FF6EC51A000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_12_2_7ff6ec4b0000_tapinstall.jbxd
                                                                                                                Similarity
                                                                                                                • API ID: NameName::$Name::doName::operator+Pchar
                                                                                                                • String ID: `non-type-template-parameter
                                                                                                                • API String ID: 3026640183-4247534891
                                                                                                                • Opcode ID: 2045f689735eeea40cce7efe3b8163e352433e1db3c7d53e5d39b0a4b2283e44
                                                                                                                • Instruction ID: 7a0fe22d8d79509bbc7c75ece33ef6230f9713f14b6bfd1a78202620ff68271f
                                                                                                                • Opcode Fuzzy Hash: 2045f689735eeea40cce7efe3b8163e352433e1db3c7d53e5d39b0a4b2283e44
                                                                                                                • Instruction Fuzzy Hash: 2D416A23A0CB92D5E710DB15D4842FC37A4BB14B88F9544B5DE4D97A8DDF2AE829C309
                                                                                                                Function 00007FF6EC4B23C0 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 84libraryloaderCOMMON
                                                                                                                Download Yara Rule
                                                                                                                APIs
                                                                                                                Strings
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 0000000C.00000002.2574093388.00007FF6EC4B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF6EC4B0000, based on PE: true
                                                                                                                • Associated: 0000000C.00000002.2574070380.00007FF6EC4B0000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                • Associated: 0000000C.00000002.2574132408.00007FF6EC504000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                • Associated: 0000000C.00000002.2574154940.00007FF6EC517000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                • Associated: 0000000C.00000002.2574176551.00007FF6EC51A000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_12_2_7ff6ec4b0000_tapinstall.jbxd
                                                                                                                Similarity
                                                                                                                • API ID: FreeLibrary$AddressAttributesFileFormatFullLoadLocalMessageNamePathProc
                                                                                                                • String ID: UpdateDriverForPlugAndPlayDevicesW$newdev.dll
                                                                                                                • API String ID: 3199543795-3767700378
                                                                                                                • Opcode ID: 04ab7d4148ff324d2fd50ef0ea174a2fd79d77ffbdc2d0a2a02e6489278d7139
                                                                                                                • Instruction ID: 1222e1130660f5d38d71b137611a25be44a42d6d6314ff457326eaabe60ed382
                                                                                                                • Opcode Fuzzy Hash: 04ab7d4148ff324d2fd50ef0ea174a2fd79d77ffbdc2d0a2a02e6489278d7139
                                                                                                                • Instruction Fuzzy Hash: 83315023A1CA82C5EA609B20E4A53BE6360EF84B48F444035DE4D97799DF3EE85DC709
                                                                                                                Function 00007FF6EC4BC60C Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 51COMMONLIBRARYCODE
                                                                                                                Download Yara Rule
                                                                                                                APIs
                                                                                                                Strings
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 0000000C.00000002.2574093388.00007FF6EC4B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF6EC4B0000, based on PE: true
                                                                                                                • Associated: 0000000C.00000002.2574070380.00007FF6EC4B0000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                • Associated: 0000000C.00000002.2574132408.00007FF6EC504000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                • Associated: 0000000C.00000002.2574154940.00007FF6EC517000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                • Associated: 0000000C.00000002.2574176551.00007FF6EC51A000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_12_2_7ff6ec4b0000_tapinstall.jbxd
                                                                                                                Similarity
                                                                                                                • API ID: Name::operator+=$Decorator::getNameName::operator+$Name::Name::operator=ScopeScoped
                                                                                                                • String ID: void
                                                                                                                • API String ID: 3176039966-3531332078
                                                                                                                • Opcode ID: 9e892f4fd707f0d60684168cfb52e33d9422594bf1c05951a142ce3f47b87fe0
                                                                                                                • Instruction ID: 5e9cdd6e99a40d67da2c32d98bd2c6ca2a1489b4056af0b9908e6762bd17a40c
                                                                                                                • Opcode Fuzzy Hash: 9e892f4fd707f0d60684168cfb52e33d9422594bf1c05951a142ce3f47b87fe0
                                                                                                                • Instruction Fuzzy Hash: A7118E63A1C642C5EB208B24D4957BD73A0FF9874CF845031E58DC62ADDE2EE51AC70A
                                                                                                                Function 00007FF6EC4FEE2C Relevance: 10.8, APIs: 7, Instructions: 291COMMON
                                                                                                                Download Yara Rule
                                                                                                                APIs
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 0000000C.00000002.2574093388.00007FF6EC4B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF6EC4B0000, based on PE: true
                                                                                                                • Associated: 0000000C.00000002.2574070380.00007FF6EC4B0000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                • Associated: 0000000C.00000002.2574132408.00007FF6EC504000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                • Associated: 0000000C.00000002.2574154940.00007FF6EC517000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                • Associated: 0000000C.00000002.2574176551.00007FF6EC51A000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_12_2_7ff6ec4b0000_tapinstall.jbxd
                                                                                                                Similarity
                                                                                                                • API ID: _invalid_parameter_noinfo
                                                                                                                • String ID:
                                                                                                                • API String ID: 3215553584-0
                                                                                                                • Opcode ID: 3e9133d60d70ee4b184cf4df9feb1deb47fa9a1110e34a9b0a205f5e93016ed5
                                                                                                                • Instruction ID: 11686d92e6b07a52a3ed5f7ef12a8fb057428615f45cf0235c10c6d46d89af87
                                                                                                                • Opcode Fuzzy Hash: 3e9133d60d70ee4b184cf4df9feb1deb47fa9a1110e34a9b0a205f5e93016ed5
                                                                                                                • Instruction Fuzzy Hash: 5EC1BF33A086C6CAF6609B1594443BD7AA1EB80B88F665131DA4D87791CF7FE85DC30A
                                                                                                                Function 00007FF6EC4B6700 Relevance: 10.7, APIs: 3, Strings: 3, Instructions: 156registryCOMMON
                                                                                                                Download Yara Rule
                                                                                                                APIs
                                                                                                                • SetupDiGetDeviceInfoListDetailW.SETUPAPI ref: 00007FF6EC4B672F
                                                                                                                • SetupDiOpenClassRegKeyExW.SETUPAPI ref: 00007FF6EC4B676F
                                                                                                                • RegCloseKey.ADVAPI32 ref: 00007FF6EC4B690B
                                                                                                                  • Part of subcall function 00007FF6EC4B4C30: RegQueryValueExW.ADVAPI32 ref: 00007FF6EC4B4C83
                                                                                                                  • Part of subcall function 00007FF6EC4B4C30: GetLastError.KERNEL32 ref: 00007FF6EC4B4C94
                                                                                                                  • Part of subcall function 00007FF6EC4B4C30: RegQueryValueExW.ADVAPI32 ref: 00007FF6EC4B4CF6
                                                                                                                  • Part of subcall function 00007FF6EC4B4770: FormatMessageW.KERNEL32(?,?,?,?,?,?,?,?,00000000,?,00007FF6EC4B10DD), ref: 00007FF6EC4B47B7
                                                                                                                  • Part of subcall function 00007FF6EC4B4770: LocalFree.KERNEL32(?,?,?,?,?,?,?,?,00000000,?,00007FF6EC4B10DD), ref: 00007FF6EC4B480B
                                                                                                                Strings
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 0000000C.00000002.2574093388.00007FF6EC4B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF6EC4B0000, based on PE: true
                                                                                                                • Associated: 0000000C.00000002.2574070380.00007FF6EC4B0000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                • Associated: 0000000C.00000002.2574132408.00007FF6EC504000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                • Associated: 0000000C.00000002.2574154940.00007FF6EC517000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                • Associated: 0000000C.00000002.2574176551.00007FF6EC51A000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_12_2_7ff6ec4b0000_tapinstall.jbxd
                                                                                                                Similarity
                                                                                                                • API ID: QuerySetupValue$ClassCloseDetailDeviceErrorFormatFreeInfoLastListLocalMessageOpen
                                                                                                                • String ID: %s$LowerFilters$UpperFilters
                                                                                                                • API String ID: 1933970874-1836264166
                                                                                                                • Opcode ID: 04773ff56f4774923785c4d0de67fe9c2026f8c065fe9d7dfa9ad0910a36cf95
                                                                                                                • Instruction ID: 0e22ce1c0daa8af3965fa1ba6b18097780a31194208dfb5432b96365dc3d46e2
                                                                                                                • Opcode Fuzzy Hash: 04773ff56f4774923785c4d0de67fe9c2026f8c065fe9d7dfa9ad0910a36cf95
                                                                                                                • Instruction Fuzzy Hash: EA51BF23F0864681FA196B21E4153FE52419F84B88F484134DD0ECB7CBDE6EE849C39B
                                                                                                                Function 00007FF6EC4B1160 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 152COMMON
                                                                                                                Download Yara Rule
                                                                                                                APIs
                                                                                                                Strings
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 0000000C.00000002.2574093388.00007FF6EC4B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF6EC4B0000, based on PE: true
                                                                                                                • Associated: 0000000C.00000002.2574070380.00007FF6EC4B0000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                • Associated: 0000000C.00000002.2574132408.00007FF6EC504000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                • Associated: 0000000C.00000002.2574154940.00007FF6EC517000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                • Associated: 0000000C.00000002.2574176551.00007FF6EC51A000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_12_2_7ff6ec4b0000_tapinstall.jbxd
                                                                                                                Similarity
                                                                                                                • API ID: ClassSetup$BuildInfoList$DescriptionErrorFromGuidLastName
                                                                                                                • String ID: %-20s: %s
                                                                                                                • API String ID: 3437477559-1251934994
                                                                                                                • Opcode ID: 8de683dbc796dd8caca86f2723ecdf9223d82be46d02b5834d92cca158fced3c
                                                                                                                • Instruction ID: 74d846461e19cdc2e1516e6f512aa50b81dc40ff689a0a1cfaa7a5dbebd0e0e7
                                                                                                                • Opcode Fuzzy Hash: 8de683dbc796dd8caca86f2723ecdf9223d82be46d02b5834d92cca158fced3c
                                                                                                                • Instruction Fuzzy Hash: 87518063618A82C5EB608F15E4447BE73A0FF84B88F445435EA8D87A98EF3DD509C709
                                                                                                                Function 00007FF6EC4BDD94 Relevance: 10.6, APIs: 7, Instructions: 134COMMONLIBRARYCODE
                                                                                                                Download Yara Rule
                                                                                                                APIs
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 0000000C.00000002.2574093388.00007FF6EC4B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF6EC4B0000, based on PE: true
                                                                                                                • Associated: 0000000C.00000002.2574070380.00007FF6EC4B0000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                • Associated: 0000000C.00000002.2574132408.00007FF6EC504000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                • Associated: 0000000C.00000002.2574154940.00007FF6EC517000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                • Associated: 0000000C.00000002.2574176551.00007FF6EC51A000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_12_2_7ff6ec4b0000_tapinstall.jbxd
                                                                                                                Similarity
                                                                                                                • API ID: Name::doName::operator+Name::operator+=Pchar$NameName::Name::append
                                                                                                                • String ID:
                                                                                                                • API String ID: 3659116837-0
                                                                                                                • Opcode ID: 6aaf8ef8ab975a96cade839fcc4cba8efc94d6294a4ba3211e0c36a2a6d5e19c
                                                                                                                • Instruction ID: 4c939437ae3090c44b0ce42276a32b6d5fcccad4f96d8b247ececae15638e606
                                                                                                                • Opcode Fuzzy Hash: 6aaf8ef8ab975a96cade839fcc4cba8efc94d6294a4ba3211e0c36a2a6d5e19c
                                                                                                                • Instruction Fuzzy Hash: 33613733A18A42D9E711DF24E8843EC37A1AB5478CF958075EA0D877ADEF3AD459C306
                                                                                                                Function 00007FF6EC4DF964 Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 113COMMON
                                                                                                                Download Yara Rule
                                                                                                                APIs
                                                                                                                Strings
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 0000000C.00000002.2574093388.00007FF6EC4B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF6EC4B0000, based on PE: true
                                                                                                                • Associated: 0000000C.00000002.2574070380.00007FF6EC4B0000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                • Associated: 0000000C.00000002.2574132408.00007FF6EC504000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                • Associated: 0000000C.00000002.2574154940.00007FF6EC517000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                • Associated: 0000000C.00000002.2574176551.00007FF6EC51A000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_12_2_7ff6ec4b0000_tapinstall.jbxd
                                                                                                                Similarity
                                                                                                                • API ID: FileModuleName_set_error_mode
                                                                                                                • String ID: ...$<program name unknown>$Microsoft Visual C++ Runtime Library$Runtime Error!Program:
                                                                                                                • API String ID: 3581924421-4022980321
                                                                                                                • Opcode ID: 0d1e8a8cf0d7e4a4f35967af43162b7572eefee810724939d3ab0ebac19dc9a6
                                                                                                                • Instruction ID: c072f60b7a5bf65fa8d4048e839564887238731ab96c065abd348e37bc65b2c3
                                                                                                                • Opcode Fuzzy Hash: 0d1e8a8cf0d7e4a4f35967af43162b7572eefee810724939d3ab0ebac19dc9a6
                                                                                                                • Instruction Fuzzy Hash: 2B41D327B08746C4FB24EB26A8013BA6750AF94B9CF410532DE1DC7795DE3EE509CB0A
                                                                                                                Function 00007FF6EC4B3A00 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 69COMMON
                                                                                                                Download Yara Rule
                                                                                                                APIs
                                                                                                                Strings
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 0000000C.00000002.2574093388.00007FF6EC4B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF6EC4B0000, based on PE: true
                                                                                                                • Associated: 0000000C.00000002.2574070380.00007FF6EC4B0000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                • Associated: 0000000C.00000002.2574132408.00007FF6EC504000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                • Associated: 0000000C.00000002.2574154940.00007FF6EC517000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                • Associated: 0000000C.00000002.2574176551.00007FF6EC51A000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_12_2_7ff6ec4b0000_tapinstall.jbxd
                                                                                                                Similarity
                                                                                                                • API ID: Setup$ClassDeviceInstallParams$CallDetailDevice_Get_InfoInstallerList
                                                                                                                • String ID: %-60s: %s
                                                                                                                • API String ID: 4184553637-3470069224
                                                                                                                • Opcode ID: c50b428a501a26c9097843eac2ab180f505a000ca60ac8a98767d06fd166e556
                                                                                                                • Instruction ID: 4b5f7555d8108a4c359abf66285fe58f0d52d2fd7db6ce56691aad447619164b
                                                                                                                • Opcode Fuzzy Hash: c50b428a501a26c9097843eac2ab180f505a000ca60ac8a98767d06fd166e556
                                                                                                                • Instruction Fuzzy Hash: 7A310D7260CA82C2F7609F22E8497AA7765FB84B88F404135CE4D87B98DF3ED559CB05
                                                                                                                Function 00007FF6EC4B27B0 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 67libraryloaderCOMMON
                                                                                                                Download Yara Rule
                                                                                                                APIs
                                                                                                                Strings
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 0000000C.00000002.2574093388.00007FF6EC4B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF6EC4B0000, based on PE: true
                                                                                                                • Associated: 0000000C.00000002.2574070380.00007FF6EC4B0000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                • Associated: 0000000C.00000002.2574132408.00007FF6EC504000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                • Associated: 0000000C.00000002.2574154940.00007FF6EC517000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                • Associated: 0000000C.00000002.2574176551.00007FF6EC51A000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_12_2_7ff6ec4b0000_tapinstall.jbxd
                                                                                                                Similarity
                                                                                                                • API ID: Library$AddressFreeLoadProc$AttributesFileFullNamePath
                                                                                                                • String ID: SetupSetNonInteractiveMode$setupapi.dll
                                                                                                                • API String ID: 1784877336-1268865691
                                                                                                                • Opcode ID: 46b5fed04645d8eac7faa08d99b50c110e1da90dcc4f8194fdf02fdc9e3b2f99
                                                                                                                • Instruction ID: e9af2f0911411673e2fb3a93ee6cd59d2cb0132d99dc13fbb74e873c0ad465f2
                                                                                                                • Opcode Fuzzy Hash: 46b5fed04645d8eac7faa08d99b50c110e1da90dcc4f8194fdf02fdc9e3b2f99
                                                                                                                • Instruction Fuzzy Hash: E6218E26B0CB5182DA20AB16B441639A390BB88FD8F401134EE8D87B28DF3DE455C70A
                                                                                                                Function 00007FF6EC50071C Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48fileCOMMON
                                                                                                                Download Yara Rule
                                                                                                                APIs
                                                                                                                Strings
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 0000000C.00000002.2574093388.00007FF6EC4B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF6EC4B0000, based on PE: true
                                                                                                                • Associated: 0000000C.00000002.2574070380.00007FF6EC4B0000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                • Associated: 0000000C.00000002.2574132408.00007FF6EC504000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                • Associated: 0000000C.00000002.2574154940.00007FF6EC517000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                • Associated: 0000000C.00000002.2574176551.00007FF6EC51A000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_12_2_7ff6ec4b0000_tapinstall.jbxd
                                                                                                                Similarity
                                                                                                                • API ID: ConsoleWrite$CloseCreateErrorFileHandleLast
                                                                                                                • String ID: CONOUT$
                                                                                                                • API String ID: 3230265001-3130406586
                                                                                                                • Opcode ID: b8a696af87e1db244be29ab8bf7f91a733210b6ee2ef81bc7abc92eec04a5109
                                                                                                                • Instruction ID: 7af4e06e0942a373f7b01ac0949c808217b9d93b432083bcfa92cfb57e480afb
                                                                                                                • Opcode Fuzzy Hash: b8a696af87e1db244be29ab8bf7f91a733210b6ee2ef81bc7abc92eec04a5109
                                                                                                                • Instruction Fuzzy Hash: 51118122A18B4186E3508B0AE85573967A4FB98FE8F004238DE5DC7794EF3DD964C749
                                                                                                                Function 00007FF6EC500584 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 41fileCOMMON
                                                                                                                Download Yara Rule
                                                                                                                APIs
                                                                                                                Strings
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 0000000C.00000002.2574093388.00007FF6EC4B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF6EC4B0000, based on PE: true
                                                                                                                • Associated: 0000000C.00000002.2574070380.00007FF6EC4B0000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                • Associated: 0000000C.00000002.2574132408.00007FF6EC504000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                • Associated: 0000000C.00000002.2574154940.00007FF6EC517000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                • Associated: 0000000C.00000002.2574176551.00007FF6EC51A000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_12_2_7ff6ec4b0000_tapinstall.jbxd
                                                                                                                Similarity
                                                                                                                • API ID: ConsoleWrite$CloseCreateErrorFileHandleLast
                                                                                                                • String ID: CONOUT$
                                                                                                                • API String ID: 3230265001-3130406586
                                                                                                                • Opcode ID: 7293e43c7665d0d01c90415b99719ea9fa37c371d7253cfd48f9f2110afdc670
                                                                                                                • Instruction ID: 59a6874b49296dd9bb474092b006c282b9c0201804869f662634de3edef4e07e
                                                                                                                • Opcode Fuzzy Hash: 7293e43c7665d0d01c90415b99719ea9fa37c371d7253cfd48f9f2110afdc670
                                                                                                                • Instruction Fuzzy Hash: 13115E23608A4182E7508F59E4153292361FB88BECF104235DA5DCB794EF3DD864C70A
                                                                                                                Function 00007FF6EC4B3B40 Relevance: 9.0, APIs: 4, Strings: 1, Instructions: 255COMMON
                                                                                                                Download Yara Rule
                                                                                                                APIs
                                                                                                                • SetupDiGetDeviceInfoListDetailW.SETUPAPI ref: 00007FF6EC4B3B8A
                                                                                                                • CM_Get_Device_ID_ExW.SETUPAPI ref: 00007FF6EC4B3BB9
                                                                                                                • CM_Get_DevNode_Status_Ex.SETUPAPI ref: 00007FF6EC4B3BE1
                                                                                                                • SetupDiSetDeviceRegistryPropertyW.SETUPAPI ref: 00007FF6EC4B3E64
                                                                                                                  • Part of subcall function 00007FF6EC4B4770: FormatMessageW.KERNEL32(?,?,?,?,?,?,?,?,00000000,?,00007FF6EC4B10DD), ref: 00007FF6EC4B47B7
                                                                                                                  • Part of subcall function 00007FF6EC4B4770: LocalFree.KERNEL32(?,?,?,?,?,?,?,?,00000000,?,00007FF6EC4B10DD), ref: 00007FF6EC4B480B
                                                                                                                Strings
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 0000000C.00000002.2574093388.00007FF6EC4B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF6EC4B0000, based on PE: true
                                                                                                                • Associated: 0000000C.00000002.2574070380.00007FF6EC4B0000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                • Associated: 0000000C.00000002.2574132408.00007FF6EC504000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                • Associated: 0000000C.00000002.2574154940.00007FF6EC517000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                • Associated: 0000000C.00000002.2574176551.00007FF6EC51A000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_12_2_7ff6ec4b0000_tapinstall.jbxd
                                                                                                                Similarity
                                                                                                                • API ID: DeviceGet_Setup$DetailDevice_FormatFreeInfoListLocalMessageNode_PropertyRegistryStatus_
                                                                                                                • String ID: %-60s:
                                                                                                                • API String ID: 1934003045-769737362
                                                                                                                • Opcode ID: 76ee0f2f911fd73d96a53c46ad47b70ddff763a65de86f8359f85a3177142f00
                                                                                                                • Instruction ID: f3a06eb0e1a72911f3ee6afacbc8620ba8f1ee01a04c9e0910a18a85f3f43389
                                                                                                                • Opcode Fuzzy Hash: 76ee0f2f911fd73d96a53c46ad47b70ddff763a65de86f8359f85a3177142f00
                                                                                                                • Instruction Fuzzy Hash: D1B1AD23A08A86C1EA209F16A44137E63A4FB50B8CF444135EE5E87799DF3EE459C70A
                                                                                                                Function 00007FF6EC4C0034 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 121COMMONLIBRARYCODE
                                                                                                                Download Yara Rule
                                                                                                                APIs
                                                                                                                Strings
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 0000000C.00000002.2574093388.00007FF6EC4B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF6EC4B0000, based on PE: true
                                                                                                                • Associated: 0000000C.00000002.2574070380.00007FF6EC4B0000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                • Associated: 0000000C.00000002.2574132408.00007FF6EC504000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                • Associated: 0000000C.00000002.2574154940.00007FF6EC517000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                • Associated: 0000000C.00000002.2574176551.00007FF6EC51A000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_12_2_7ff6ec4b0000_tapinstall.jbxd
                                                                                                                Similarity
                                                                                                                • API ID: Name::operator+=$Replicator::operator+=
                                                                                                                • String ID: ...
                                                                                                                • API String ID: 3157425598-440645147
                                                                                                                • Opcode ID: e288a20144f83b690d569a74b32a78b9f7e8ec2015eadcaccc5e11f1d194f4ae
                                                                                                                • Instruction ID: 650070bfb59543b2d14f1bfe9649467e7d2babb54fb7f128aa0b8b362a8b03f1
                                                                                                                • Opcode Fuzzy Hash: e288a20144f83b690d569a74b32a78b9f7e8ec2015eadcaccc5e11f1d194f4ae
                                                                                                                • Instruction Fuzzy Hash: 3451BF23E08B46D8FB22CF29D84473976E0AB45B4CF558075C95E8A6B6CE3FA44DC306
                                                                                                                Function 00007FF6EC4E16E4 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 24libraryloaderCOMMON
                                                                                                                Download Yara Rule
                                                                                                                APIs
                                                                                                                Strings
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 0000000C.00000002.2574093388.00007FF6EC4B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF6EC4B0000, based on PE: true
                                                                                                                • Associated: 0000000C.00000002.2574070380.00007FF6EC4B0000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                • Associated: 0000000C.00000002.2574132408.00007FF6EC504000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                • Associated: 0000000C.00000002.2574154940.00007FF6EC517000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                • Associated: 0000000C.00000002.2574176551.00007FF6EC51A000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_12_2_7ff6ec4b0000_tapinstall.jbxd
                                                                                                                Similarity
                                                                                                                • API ID: AddressFreeHandleLibraryModuleProc
                                                                                                                • String ID: CorExitProcess$mscoree.dll
                                                                                                                • API String ID: 4061214504-1276376045
                                                                                                                • Opcode ID: 0ccf8903cf5fd9aeb41b039fa9f1cb800aac3f93f93f03788acfe0ad99044ca6
                                                                                                                • Instruction ID: a135a3e02f9497439f38a3ae8c012280a448684647e990306ed03ee69c5b62dc
                                                                                                                • Opcode Fuzzy Hash: 0ccf8903cf5fd9aeb41b039fa9f1cb800aac3f93f93f03788acfe0ad99044ca6
                                                                                                                • Instruction Fuzzy Hash: 21F054A3B19642C1EF449B51E4913791364AF44B48F49143AE94FCA161DF2DE89CC34A
                                                                                                                Function 00007FF6EC4C30D0 Relevance: 7.8, APIs: 5, Instructions: 289COMMONLIBRARYCODE
                                                                                                                Download Yara Rule
                                                                                                                APIs
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 0000000C.00000002.2574093388.00007FF6EC4B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF6EC4B0000, based on PE: true
                                                                                                                • Associated: 0000000C.00000002.2574070380.00007FF6EC4B0000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                • Associated: 0000000C.00000002.2574132408.00007FF6EC504000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                • Associated: 0000000C.00000002.2574154940.00007FF6EC517000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                • Associated: 0000000C.00000002.2574176551.00007FF6EC51A000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_12_2_7ff6ec4b0000_tapinstall.jbxd
                                                                                                                Similarity
                                                                                                                • API ID: AdjustPointer
                                                                                                                • String ID:
                                                                                                                • API String ID: 1740715915-0
                                                                                                                • Opcode ID: 92d83d9b34f83b521a09ba5b49f4fa4ff0e4aabc531c5689a04bfc7cad77936e
                                                                                                                • Instruction ID: 851c36d37f5f457566d4a0f88aed806abf8c61694d20dfe3882f91c42421c8ae
                                                                                                                • Opcode Fuzzy Hash: 92d83d9b34f83b521a09ba5b49f4fa4ff0e4aabc531c5689a04bfc7cad77936e
                                                                                                                • Instruction Fuzzy Hash: E8B1AD23A0AA46C1FE65DB519444BB86390EF44B8CF098435DE4D8F7A5DE3EE44EC34A
                                                                                                                Function 00007FF6EC502044 Relevance: 7.7, APIs: 5, Instructions: 158COMMON
                                                                                                                Download Yara Rule
                                                                                                                APIs
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 0000000C.00000002.2574093388.00007FF6EC4B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF6EC4B0000, based on PE: true
                                                                                                                • Associated: 0000000C.00000002.2574070380.00007FF6EC4B0000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                • Associated: 0000000C.00000002.2574132408.00007FF6EC504000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                • Associated: 0000000C.00000002.2574154940.00007FF6EC517000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                • Associated: 0000000C.00000002.2574176551.00007FF6EC51A000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_12_2_7ff6ec4b0000_tapinstall.jbxd
                                                                                                                Similarity
                                                                                                                • API ID: _set_statfp
                                                                                                                • String ID:
                                                                                                                • API String ID: 1156100317-0
                                                                                                                • Opcode ID: 2bc9a1a893ca783c65b1834ad9b2aafb0e365d30d060e1b3bfacd12602894cdc
                                                                                                                • Instruction ID: b686fad83919f61323a6292231734ebe8834dfe80dc0baf79fdd56391dbba727
                                                                                                                • Opcode Fuzzy Hash: 2bc9a1a893ca783c65b1834ad9b2aafb0e365d30d060e1b3bfacd12602894cdc
                                                                                                                • Instruction Fuzzy Hash: 36512613D08A4681F6229E34DC5637A6260BF4135CF148A35EE5EE65D1FF3EA4A2C60A
                                                                                                                Function 00007FF6EC4B37D0 Relevance: 7.6, APIs: 5, Instructions: 82COMMON
                                                                                                                Download Yara Rule
                                                                                                                APIs
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 0000000C.00000002.2574093388.00007FF6EC4B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF6EC4B0000, based on PE: true
                                                                                                                • Associated: 0000000C.00000002.2574070380.00007FF6EC4B0000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                • Associated: 0000000C.00000002.2574132408.00007FF6EC504000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                • Associated: 0000000C.00000002.2574154940.00007FF6EC517000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                • Associated: 0000000C.00000002.2574176551.00007FF6EC51A000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_12_2_7ff6ec4b0000_tapinstall.jbxd
                                                                                                                Similarity
                                                                                                                • API ID: Setup$Class$InstallParams$CallDeviceInstaller$DetailDevice_Get_InfoList
                                                                                                                • String ID:
                                                                                                                • API String ID: 3081971210-0
                                                                                                                • Opcode ID: 695bbc71baaaec773e58d73fb442ecad0b1640a0d8d46f012f6265395287b3fe
                                                                                                                • Instruction ID: 56ad7d61261cb0929bae60c445bafe20261742b541241822f66c4af342313d93
                                                                                                                • Opcode Fuzzy Hash: 695bbc71baaaec773e58d73fb442ecad0b1640a0d8d46f012f6265395287b3fe
                                                                                                                • Instruction Fuzzy Hash: F13150B2A0864586F7248B12E5093BD66A0FB89FCCF004135DE8D87B88DF3ED519CB06
                                                                                                                Function 00007FF6EC5017D4 Relevance: 7.6, APIs: 5, Instructions: 56COMMONLIBRARYCODE
                                                                                                                Download Yara Rule
                                                                                                                APIs
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 0000000C.00000002.2574093388.00007FF6EC4B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF6EC4B0000, based on PE: true
                                                                                                                • Associated: 0000000C.00000002.2574070380.00007FF6EC4B0000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                • Associated: 0000000C.00000002.2574132408.00007FF6EC504000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                • Associated: 0000000C.00000002.2574154940.00007FF6EC517000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                • Associated: 0000000C.00000002.2574176551.00007FF6EC51A000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_12_2_7ff6ec4b0000_tapinstall.jbxd
                                                                                                                Similarity
                                                                                                                • API ID: _set_statfp
                                                                                                                • String ID:
                                                                                                                • API String ID: 1156100317-0
                                                                                                                • Opcode ID: e7b1107881e48292ca022c74fe2ec48e51bdb5760dfe1fdbb7d7208ffa06045a
                                                                                                                • Instruction ID: 97926a8cb44379b78b9698142cb40c8c425ffb7633f8a0d5b2e60dbeafdfcc23
                                                                                                                • Opcode Fuzzy Hash: e7b1107881e48292ca022c74fe2ec48e51bdb5760dfe1fdbb7d7208ffa06045a
                                                                                                                • Instruction Fuzzy Hash: A5119123E18A0301F76511A4D4573B61080BF5537CF580B34F97ECA2E7BE1EAA61C10B
                                                                                                                Function 00007FF6EC4C43FC Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 195COMMONLIBRARYCODE
                                                                                                                Download Yara Rule
                                                                                                                APIs
                                                                                                                Strings
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 0000000C.00000002.2574093388.00007FF6EC4B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF6EC4B0000, based on PE: true
                                                                                                                • Associated: 0000000C.00000002.2574070380.00007FF6EC4B0000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                • Associated: 0000000C.00000002.2574132408.00007FF6EC504000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                • Associated: 0000000C.00000002.2574154940.00007FF6EC517000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                • Associated: 0000000C.00000002.2574176551.00007FF6EC51A000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_12_2_7ff6ec4b0000_tapinstall.jbxd
                                                                                                                Similarity
                                                                                                                • API ID: CallEncodePointerTranslator
                                                                                                                • String ID: MOC$RCC
                                                                                                                • API String ID: 3544855599-2084237596
                                                                                                                • Opcode ID: f803d8c648c2122474ce86b0b39a3cc156ebe4fa619f756f266b7816edd56d32
                                                                                                                • Instruction ID: e96f4a69503d1dd0ed0d1537b2dde95e9c1fc519b1cdbee0c72c2abb6e82e70a
                                                                                                                • Opcode Fuzzy Hash: f803d8c648c2122474ce86b0b39a3cc156ebe4fa619f756f266b7816edd56d32
                                                                                                                • Instruction Fuzzy Hash: BF91AE73A08B86CAE711CB65E9407AD77A0FB44788F104129EE4D8B768DF3DE199CB05
                                                                                                                Function 00007FF6EC4D0EDC Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 191COMMON
                                                                                                                Download Yara Rule
                                                                                                                APIs
                                                                                                                Strings
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 0000000C.00000002.2574093388.00007FF6EC4B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF6EC4B0000, based on PE: true
                                                                                                                • Associated: 0000000C.00000002.2574070380.00007FF6EC4B0000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                • Associated: 0000000C.00000002.2574132408.00007FF6EC504000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                • Associated: 0000000C.00000002.2574154940.00007FF6EC517000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                • Associated: 0000000C.00000002.2574176551.00007FF6EC51A000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_12_2_7ff6ec4b0000_tapinstall.jbxd
                                                                                                                Similarity
                                                                                                                • API ID: _invalid_parameter_noinfo
                                                                                                                • String ID: $*
                                                                                                                • API String ID: 3215553584-3982473090
                                                                                                                • Opcode ID: ebf6addb0422a3df8c88c69004cf465780081765257e989b9b1ed44549212502
                                                                                                                • Instruction ID: 7f3996c7f9346bac7129ad808d4ce52c0ef5f55b99e923892b6992939e128a89
                                                                                                                • Opcode Fuzzy Hash: ebf6addb0422a3df8c88c69004cf465780081765257e989b9b1ed44549212502
                                                                                                                • Instruction Fuzzy Hash: 62817FB3908242C5EB65BF25804427C3FA0EB05B6CF540139EE89C6699DF3AE549DF1A
                                                                                                                Function 00007FF6EC4D0734 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 191COMMON
                                                                                                                Download Yara Rule
                                                                                                                APIs
                                                                                                                Strings
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 0000000C.00000002.2574093388.00007FF6EC4B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF6EC4B0000, based on PE: true
                                                                                                                • Associated: 0000000C.00000002.2574070380.00007FF6EC4B0000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                • Associated: 0000000C.00000002.2574132408.00007FF6EC504000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                • Associated: 0000000C.00000002.2574154940.00007FF6EC517000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                • Associated: 0000000C.00000002.2574176551.00007FF6EC51A000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_12_2_7ff6ec4b0000_tapinstall.jbxd
                                                                                                                Similarity
                                                                                                                • API ID: _invalid_parameter_noinfo
                                                                                                                • String ID: $*
                                                                                                                • API String ID: 3215553584-3982473090
                                                                                                                • Opcode ID: e60271a038c53331095bc1501989483a53fb311e552cdae94f782dd2e6294a65
                                                                                                                • Instruction ID: 637225335ddddcdc00d240f6a213685d71549fd25693afb9d1e726e77a8c0719
                                                                                                                • Opcode Fuzzy Hash: e60271a038c53331095bc1501989483a53fb311e552cdae94f782dd2e6294a65
                                                                                                                • Instruction Fuzzy Hash: 9C817073808202C5FB76AF25805437D7EA0EB05B0CF544976DAA9C7285CE3AE489CF5E
                                                                                                                Function 00007FF6EC4CF940 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 191COMMON
                                                                                                                Download Yara Rule
                                                                                                                APIs
                                                                                                                Strings
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 0000000C.00000002.2574093388.00007FF6EC4B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF6EC4B0000, based on PE: true
                                                                                                                • Associated: 0000000C.00000002.2574070380.00007FF6EC4B0000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                • Associated: 0000000C.00000002.2574132408.00007FF6EC504000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                • Associated: 0000000C.00000002.2574154940.00007FF6EC517000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                • Associated: 0000000C.00000002.2574176551.00007FF6EC51A000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_12_2_7ff6ec4b0000_tapinstall.jbxd
                                                                                                                Similarity
                                                                                                                • API ID: _invalid_parameter_noinfo
                                                                                                                • String ID: $*
                                                                                                                • API String ID: 3215553584-3982473090
                                                                                                                • Opcode ID: 696b434c9b65d82e3cb3a69da655823cedb2bb2a6dca5773e12b0c135f28c375
                                                                                                                • Instruction ID: 2420b7dfbfc471f473f748c08ff3a6c4852b1d4c838c972a05cbaf3fe58d3c1b
                                                                                                                • Opcode Fuzzy Hash: 696b434c9b65d82e3cb3a69da655823cedb2bb2a6dca5773e12b0c135f28c375
                                                                                                                • Instruction Fuzzy Hash: D6814D7390C646C6FB649E2980547787FA0EB15B5CF140136CA89CA2A9DF3EE44DCB1A
                                                                                                                Function 00007FF6EC4D0018 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 187COMMON
                                                                                                                Download Yara Rule
                                                                                                                APIs
                                                                                                                Strings
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 0000000C.00000002.2574093388.00007FF6EC4B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF6EC4B0000, based on PE: true
                                                                                                                • Associated: 0000000C.00000002.2574070380.00007FF6EC4B0000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                • Associated: 0000000C.00000002.2574132408.00007FF6EC504000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                • Associated: 0000000C.00000002.2574154940.00007FF6EC517000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                • Associated: 0000000C.00000002.2574176551.00007FF6EC51A000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_12_2_7ff6ec4b0000_tapinstall.jbxd
                                                                                                                Similarity
                                                                                                                • API ID: _invalid_parameter_noinfo
                                                                                                                • String ID: $*
                                                                                                                • API String ID: 3215553584-3982473090
                                                                                                                • Opcode ID: 4b0bb82413f354565f6b76abb1ea6af1657192eeb5dcd769b60e7d6808cf1343
                                                                                                                • Instruction ID: 613abcae45e379a62af26384575a854e43300e55e3b8c961d06fa938928147bf
                                                                                                                • Opcode Fuzzy Hash: 4b0bb82413f354565f6b76abb1ea6af1657192eeb5dcd769b60e7d6808cf1343
                                                                                                                • Instruction Fuzzy Hash: B3814273C4D242C6EB66AE25904437C3FA0EB45B4CF144935CA6AC7295CE3BE849CF1A
                                                                                                                Function 00007FF6EC4EC164 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 180COMMONLIBRARYCODE
                                                                                                                Download Yara Rule
                                                                                                                APIs
                                                                                                                Strings
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 0000000C.00000002.2574093388.00007FF6EC4B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF6EC4B0000, based on PE: true
                                                                                                                • Associated: 0000000C.00000002.2574070380.00007FF6EC4B0000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                • Associated: 0000000C.00000002.2574132408.00007FF6EC504000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                • Associated: 0000000C.00000002.2574154940.00007FF6EC517000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                • Associated: 0000000C.00000002.2574176551.00007FF6EC51A000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_12_2_7ff6ec4b0000_tapinstall.jbxd
                                                                                                                Similarity
                                                                                                                • API ID: _invalid_parameter_noinfo
                                                                                                                • String ID: -$e+000$gfff
                                                                                                                • API String ID: 3215553584-2620144452
                                                                                                                • Opcode ID: 0074e114a49e6fc809f4dcc0a04a1e80794e2a9b4d8ec782b6f912fc4b48aee0
                                                                                                                • Instruction ID: d48305ecc94504e053459e8f993e68b5c528d6ec2143a779e6077c02d70c0e9b
                                                                                                                • Opcode Fuzzy Hash: 0074e114a49e6fc809f4dcc0a04a1e80794e2a9b4d8ec782b6f912fc4b48aee0
                                                                                                                • Instruction Fuzzy Hash: A971E563B187C1CAE760CB25A94076DA791FB44B94F099231DB9C8BBD9CE3EE448C705
                                                                                                                Function 00007FF6EC4CF718 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 156COMMON
                                                                                                                Download Yara Rule
                                                                                                                APIs
                                                                                                                Strings
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 0000000C.00000002.2574093388.00007FF6EC4B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF6EC4B0000, based on PE: true
                                                                                                                • Associated: 0000000C.00000002.2574070380.00007FF6EC4B0000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                • Associated: 0000000C.00000002.2574132408.00007FF6EC504000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                • Associated: 0000000C.00000002.2574154940.00007FF6EC517000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                • Associated: 0000000C.00000002.2574176551.00007FF6EC51A000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_12_2_7ff6ec4b0000_tapinstall.jbxd
                                                                                                                Similarity
                                                                                                                • API ID: _invalid_parameter_noinfo
                                                                                                                • String ID: $*
                                                                                                                • API String ID: 3215553584-3982473090
                                                                                                                • Opcode ID: 26b87493f0452009ca218a176671395cca8a3695ea8e3c936177f10e7989a2f7
                                                                                                                • Instruction ID: 91df721c2d7f5ddce84a12b8e1a4a6567997d4dd843e9af36169d2d1310bf28c
                                                                                                                • Opcode Fuzzy Hash: 26b87493f0452009ca218a176671395cca8a3695ea8e3c936177f10e7989a2f7
                                                                                                                • Instruction Fuzzy Hash: 2A61567791C252CAFB689F28809477C37A0EB05B1DF14113AC64E891B9CF2EE44DD71A
                                                                                                                Function 00007FF6EC4CFBE8 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 151COMMON
                                                                                                                Download Yara Rule
                                                                                                                APIs
                                                                                                                Strings
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 0000000C.00000002.2574093388.00007FF6EC4B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF6EC4B0000, based on PE: true
                                                                                                                • Associated: 0000000C.00000002.2574070380.00007FF6EC4B0000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                • Associated: 0000000C.00000002.2574132408.00007FF6EC504000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                • Associated: 0000000C.00000002.2574154940.00007FF6EC517000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                • Associated: 0000000C.00000002.2574176551.00007FF6EC51A000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_12_2_7ff6ec4b0000_tapinstall.jbxd
                                                                                                                Similarity
                                                                                                                • API ID: _invalid_parameter_noinfo
                                                                                                                • String ID: $*
                                                                                                                • API String ID: 3215553584-3982473090
                                                                                                                • Opcode ID: 48a48ff5bc0ae375988f414688e987a49450b8b663d7d16d07c4109e67f0f616
                                                                                                                • Instruction ID: 3c8bed285558f03af39f50d6c243f761d82805a214668d3446a2d904a1d7d9c1
                                                                                                                • Opcode Fuzzy Hash: 48a48ff5bc0ae375988f414688e987a49450b8b663d7d16d07c4109e67f0f616
                                                                                                                • Instruction Fuzzy Hash: 1E61507390C202CAF7648E3490557BC3BA0EB15B5DF141136DA4B8A2A9DF2EE48DC70A
                                                                                                                Function 00007FF6EC4D02B0 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 147COMMON
                                                                                                                Download Yara Rule
                                                                                                                APIs
                                                                                                                Strings
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 0000000C.00000002.2574093388.00007FF6EC4B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF6EC4B0000, based on PE: true
                                                                                                                • Associated: 0000000C.00000002.2574070380.00007FF6EC4B0000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                • Associated: 0000000C.00000002.2574132408.00007FF6EC504000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                • Associated: 0000000C.00000002.2574154940.00007FF6EC517000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                • Associated: 0000000C.00000002.2574176551.00007FF6EC51A000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_12_2_7ff6ec4b0000_tapinstall.jbxd
                                                                                                                Similarity
                                                                                                                • API ID: _invalid_parameter_noinfo
                                                                                                                • String ID: $*
                                                                                                                • API String ID: 3215553584-3982473090
                                                                                                                • Opcode ID: f977a82e5c76788af1767a775f5033a8640c51099ef2c99c72258bbf43d06a9c
                                                                                                                • Instruction ID: 89712f69c0b23a00264e9585e4d3393167feffeee3220ffd5dda15d549864b59
                                                                                                                • Opcode Fuzzy Hash: f977a82e5c76788af1767a775f5033a8640c51099ef2c99c72258bbf43d06a9c
                                                                                                                • Instruction Fuzzy Hash: 7461837390C602CAE766AE28804477C3FA0EB05B1EF541539C65AC3295DF3EE489CF4A
                                                                                                                Function 00007FF6EC4C41E8 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 142COMMONLIBRARYCODE
                                                                                                                Download Yara Rule
                                                                                                                APIs
                                                                                                                Strings
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 0000000C.00000002.2574093388.00007FF6EC4B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF6EC4B0000, based on PE: true
                                                                                                                • Associated: 0000000C.00000002.2574070380.00007FF6EC4B0000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                • Associated: 0000000C.00000002.2574132408.00007FF6EC504000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                • Associated: 0000000C.00000002.2574154940.00007FF6EC517000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                • Associated: 0000000C.00000002.2574176551.00007FF6EC51A000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_12_2_7ff6ec4b0000_tapinstall.jbxd
                                                                                                                Similarity
                                                                                                                • API ID: CallEncodePointerTranslator
                                                                                                                • String ID: MOC$RCC
                                                                                                                • API String ID: 3544855599-2084237596
                                                                                                                • Opcode ID: 1468b56452d10623d81cdb1e1ed026f28ff39d5af83e5faff62cb6f8af0a23b1
                                                                                                                • Instruction ID: 9b4eb02fa2a122f0ea112d8bb76a1bc5e5c05518920d5bfe42d14160efeca80b
                                                                                                                • Opcode Fuzzy Hash: 1468b56452d10623d81cdb1e1ed026f28ff39d5af83e5faff62cb6f8af0a23b1
                                                                                                                • Instruction Fuzzy Hash: 88516A33A08A49CAEB20CF65D1407AD77A0FB84B8CF045625EE5D97B64DF39E059C705
                                                                                                                Function 00007FF6EC4C54F0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 114COMMON
                                                                                                                Download Yara Rule
                                                                                                                APIs
                                                                                                                Strings
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 0000000C.00000002.2574093388.00007FF6EC4B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF6EC4B0000, based on PE: true
                                                                                                                • Associated: 0000000C.00000002.2574070380.00007FF6EC4B0000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                • Associated: 0000000C.00000002.2574132408.00007FF6EC504000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                • Associated: 0000000C.00000002.2574154940.00007FF6EC517000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                • Associated: 0000000C.00000002.2574176551.00007FF6EC51A000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_12_2_7ff6ec4b0000_tapinstall.jbxd
                                                                                                                Similarity
                                                                                                                • API ID: CreateDestructExceptionFrameInfoObject__except_validate_context_record
                                                                                                                • String ID: csm
                                                                                                                • API String ID: 146877497-1018135373
                                                                                                                • Opcode ID: a3fecbfbc24f64bd75b4b319e201772004d7a2b71ee4399e5099f2da34a284b3
                                                                                                                • Instruction ID: 28b062d11ddf8b43464e4befc8e674e06600d03acb31fd2b98a12882121c15f3
                                                                                                                • Opcode Fuzzy Hash: a3fecbfbc24f64bd75b4b319e201772004d7a2b71ee4399e5099f2da34a284b3
                                                                                                                • Instruction Fuzzy Hash: 30516E73618781C6E660DB15E44076E77B0FB89794F040235EA8D87B65DF3DE898CB05
                                                                                                                Function 00007FF6EC4B4C30 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 74registryCOMMON
                                                                                                                Download Yara Rule
                                                                                                                APIs
                                                                                                                Strings
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 0000000C.00000002.2574093388.00007FF6EC4B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF6EC4B0000, based on PE: true
                                                                                                                • Associated: 0000000C.00000002.2574070380.00007FF6EC4B0000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                • Associated: 0000000C.00000002.2574132408.00007FF6EC504000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                • Associated: 0000000C.00000002.2574154940.00007FF6EC517000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                • Associated: 0000000C.00000002.2574176551.00007FF6EC51A000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_12_2_7ff6ec4b0000_tapinstall.jbxd
                                                                                                                Similarity
                                                                                                                • API ID: QueryValue$ErrorLast
                                                                                                                • String ID: LowerFilters
                                                                                                                • API String ID: 181557691-1260524392
                                                                                                                • Opcode ID: 7cfd38d4b9c6a9580be2e36a9189f51fd8cc7de6ed91d8435a286111ac9b45e5
                                                                                                                • Instruction ID: 32fb814bba691d1835a85845ff5871466702900c6f5ccd1735321abe0ff3d803
                                                                                                                • Opcode Fuzzy Hash: 7cfd38d4b9c6a9580be2e36a9189f51fd8cc7de6ed91d8435a286111ac9b45e5
                                                                                                                • Instruction Fuzzy Hash: FE219123608B4686EA109B15F46137EA395EF887E8F441635EE5C87BE8EF3DE409C705
                                                                                                                Function 00007FF6EC4B56D0 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 69COMMON
                                                                                                                Download Yara Rule
                                                                                                                APIs
                                                                                                                Strings
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 0000000C.00000002.2574093388.00007FF6EC4B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF6EC4B0000, based on PE: true
                                                                                                                • Associated: 0000000C.00000002.2574070380.00007FF6EC4B0000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                • Associated: 0000000C.00000002.2574132408.00007FF6EC504000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                • Associated: 0000000C.00000002.2574154940.00007FF6EC517000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                • Associated: 0000000C.00000002.2574176551.00007FF6EC51A000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_12_2_7ff6ec4b0000_tapinstall.jbxd
                                                                                                                Similarity
                                                                                                                • API ID: DetailDeviceDevice_Get_InfoListSetup
                                                                                                                • String ID: %-60s: %s$%s
                                                                                                                • API String ID: 3680031113-1339393084
                                                                                                                • Opcode ID: a51e5089ce0a16c6d52d016b188cefe7c1f7e6d2c4a6f8978211d45e4c582602
                                                                                                                • Instruction ID: d0c41a8c35b2fc92550c4c6c55bbaab0f60fb2baff16a9fb1fb5d409c059269d
                                                                                                                • Opcode Fuzzy Hash: a51e5089ce0a16c6d52d016b188cefe7c1f7e6d2c4a6f8978211d45e4c582602
                                                                                                                • Instruction Fuzzy Hash: D9219363B08642C1FB21DF19E4513BEA3A4EF84B88F444035DA4D87A99EF2ED509C759
                                                                                                                Function 00007FF6EC4B6B80 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 65COMMON
                                                                                                                Download Yara Rule
                                                                                                                APIs
                                                                                                                Strings
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 0000000C.00000002.2574093388.00007FF6EC4B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF6EC4B0000, based on PE: true
                                                                                                                • Associated: 0000000C.00000002.2574070380.00007FF6EC4B0000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                • Associated: 0000000C.00000002.2574132408.00007FF6EC504000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                • Associated: 0000000C.00000002.2574154940.00007FF6EC517000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                • Associated: 0000000C.00000002.2574176551.00007FF6EC51A000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_12_2_7ff6ec4b0000_tapinstall.jbxd
                                                                                                                Similarity
                                                                                                                • API ID: DetailDeviceDevice_Get_InfoListSetup
                                                                                                                • String ID: %-60s: %s$%s
                                                                                                                • API String ID: 3680031113-1339393084
                                                                                                                • Opcode ID: c99e091277bb5b53b775382925c4bb54c33a56cc676f35083c55ea4e68d6ed99
                                                                                                                • Instruction ID: 1fdbd2658bbbd4d93352325e7354134663a8afd4d031162c326cd41905997590
                                                                                                                • Opcode Fuzzy Hash: c99e091277bb5b53b775382925c4bb54c33a56cc676f35083c55ea4e68d6ed99
                                                                                                                • Instruction Fuzzy Hash: F1219E33B08A8285EB249F19E4513FE63A0EF84788F844135DE4D87A98EF3DD50AC709
                                                                                                                Function 00007FF6EC4C562B Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 65COMMON
                                                                                                                Download Yara Rule
                                                                                                                APIs
                                                                                                                Strings
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 0000000C.00000002.2574093388.00007FF6EC4B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF6EC4B0000, based on PE: true
                                                                                                                • Associated: 0000000C.00000002.2574070380.00007FF6EC4B0000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                • Associated: 0000000C.00000002.2574132408.00007FF6EC504000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                • Associated: 0000000C.00000002.2574154940.00007FF6EC517000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                • Associated: 0000000C.00000002.2574176551.00007FF6EC51A000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_12_2_7ff6ec4b0000_tapinstall.jbxd
                                                                                                                Similarity
                                                                                                                • API ID: Exception$DestructObject$Raise
                                                                                                                • String ID: csm
                                                                                                                • API String ID: 2826525264-1018135373
                                                                                                                • Opcode ID: c65463ea9101793cc31d4246695a90cc3882a240b8c6c27d7b38a8955c006e5e
                                                                                                                • Instruction ID: bcf01a7765dc855d1bbe806a7bd38c4432461b48b31a4294824c3e9749b2e80d
                                                                                                                • Opcode Fuzzy Hash: c65463ea9101793cc31d4246695a90cc3882a240b8c6c27d7b38a8955c006e5e
                                                                                                                • Instruction Fuzzy Hash: 4031FC77608241C6E6309F11A04076E7BA0FB95B98F000135DA8E477A5CF3DE889DB06
                                                                                                                Function 00007FF6EC4C53FA Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 63COMMON
                                                                                                                Download Yara Rule
                                                                                                                APIs
                                                                                                                Strings
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 0000000C.00000002.2574093388.00007FF6EC4B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF6EC4B0000, based on PE: true
                                                                                                                • Associated: 0000000C.00000002.2574070380.00007FF6EC4B0000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                • Associated: 0000000C.00000002.2574132408.00007FF6EC504000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                • Associated: 0000000C.00000002.2574154940.00007FF6EC517000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                • Associated: 0000000C.00000002.2574176551.00007FF6EC51A000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_12_2_7ff6ec4b0000_tapinstall.jbxd
                                                                                                                Similarity
                                                                                                                • API ID: Exception$DestructObject$Raise
                                                                                                                • String ID: csm
                                                                                                                • API String ID: 2826525264-1018135373
                                                                                                                • Opcode ID: cc8eb6da96c197ed980eb35cf3cd2df0145045b221062dc3d4578f740a01ffa4
                                                                                                                • Instruction ID: a495400d5fe01e57e023c27a9aac4fa3b4c80d3fcc247be1be3551745a849ce4
                                                                                                                • Opcode Fuzzy Hash: cc8eb6da96c197ed980eb35cf3cd2df0145045b221062dc3d4578f740a01ffa4
                                                                                                                • Instruction Fuzzy Hash: 58211A37608641C6E7309B11E04076E7760FB99BA9F040221DE9D477A9CF3EE889DB0A
                                                                                                                Function 00007FF6EC4E94F4 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 50COMMON
                                                                                                                Download Yara Rule
                                                                                                                APIs
                                                                                                                • try_get_function.LIBVCRUNTIME ref: 00007FF6EC4E9527
                                                                                                                • try_get_function.LIBVCRUNTIME ref: 00007FF6EC4E954E
                                                                                                                  • Part of subcall function 00007FF6EC4E81A8: GetProcAddress.KERNEL32(?,?,00000006,00007FF6EC4E8A2A,?,?,00000000,00007FF6EC4E77AE,?,?,00000000,00007FF6EC4E6B85), ref: 00007FF6EC4E8300
                                                                                                                Strings
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 0000000C.00000002.2574093388.00007FF6EC4B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF6EC4B0000, based on PE: true
                                                                                                                • Associated: 0000000C.00000002.2574070380.00007FF6EC4B0000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                • Associated: 0000000C.00000002.2574132408.00007FF6EC504000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                • Associated: 0000000C.00000002.2574154940.00007FF6EC517000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                • Associated: 0000000C.00000002.2574176551.00007FF6EC51A000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_12_2_7ff6ec4b0000_tapinstall.jbxd
                                                                                                                Similarity
                                                                                                                • API ID: try_get_function$AddressProc
                                                                                                                • String ID: GetProcessWindowStation$GetUserObjectInformationW
                                                                                                                • API String ID: 1640347226-2732317663
                                                                                                                • Opcode ID: 6f5883c30fa4d970a6b2ca5bc24385a593e52fa01d7559c029fb7798c3f6cd56
                                                                                                                • Instruction ID: 293c7973bf212734bdbb83687f83f8c319a2ad1a37a5c533dffd2d98b9ee1d72
                                                                                                                • Opcode Fuzzy Hash: 6f5883c30fa4d970a6b2ca5bc24385a593e52fa01d7559c029fb7798c3f6cd56
                                                                                                                • Instruction Fuzzy Hash: 6411AE23A1974385FA40CB14E8023F923A0BF45798F450139D95D8B694EF3EE459C709
                                                                                                                Function 00007FF6EC4E90A0 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 49COMMON
                                                                                                                Download Yara Rule
                                                                                                                APIs
                                                                                                                Strings
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 0000000C.00000002.2574093388.00007FF6EC4B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF6EC4B0000, based on PE: true
                                                                                                                • Associated: 0000000C.00000002.2574070380.00007FF6EC4B0000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                • Associated: 0000000C.00000002.2574132408.00007FF6EC504000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                • Associated: 0000000C.00000002.2574154940.00007FF6EC517000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                • Associated: 0000000C.00000002.2574176551.00007FF6EC51A000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_12_2_7ff6ec4b0000_tapinstall.jbxd
                                                                                                                Similarity
                                                                                                                • API ID: try_get_function
                                                                                                                • String ID: MessageBoxW$RoInitialize
                                                                                                                • API String ID: 2742660187-1810702038
                                                                                                                • Opcode ID: dd70e31a59fc5cbf4f5a0b82821224db7ed2afd1b9f1bcf175a30592a1cc4cdc
                                                                                                                • Instruction ID: 17808a7dd9c0c85023ce44c662b1d14cb522397860e11a960f90866795824e98
                                                                                                                • Opcode Fuzzy Hash: dd70e31a59fc5cbf4f5a0b82821224db7ed2afd1b9f1bcf175a30592a1cc4cdc
                                                                                                                • Instruction Fuzzy Hash: 8B118223B08A4695FB049B41F8422F56360EF447D8F48043ADE5C8BB95DE3DE9A5C70A
                                                                                                                Function 00007FF6EC4E9188 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 38COMMON
                                                                                                                Download Yara Rule
                                                                                                                APIs
                                                                                                                Strings
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 0000000C.00000002.2574093388.00007FF6EC4B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF6EC4B0000, based on PE: true
                                                                                                                • Associated: 0000000C.00000002.2574070380.00007FF6EC4B0000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                • Associated: 0000000C.00000002.2574132408.00007FF6EC504000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                • Associated: 0000000C.00000002.2574154940.00007FF6EC517000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                • Associated: 0000000C.00000002.2574176551.00007FF6EC51A000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_12_2_7ff6ec4b0000_tapinstall.jbxd
                                                                                                                Similarity
                                                                                                                • API ID: try_get_function
                                                                                                                • String ID: SetThreadStackGuarantee$SystemFunction036
                                                                                                                • API String ID: 2742660187-2910880125
                                                                                                                • Opcode ID: 82353169a2ab33f6a6eac203720c7793f9c27a950768576486ffb45298bb144f
                                                                                                                • Instruction ID: bb56452a43ce5929b5496ea9ccc8e4f12690e716a4320a426fb5c8e663f60be2
                                                                                                                • Opcode Fuzzy Hash: 82353169a2ab33f6a6eac203720c7793f9c27a950768576486ffb45298bb144f
                                                                                                                • Instruction Fuzzy Hash: 83014413E19A46D5FB0997A5E8422F06311DF48398F491035DD1C8A691EE7DE9A9C30A
                                                                                                                Function 00007FF6EC4E9448 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 30COMMON
                                                                                                                Download Yara Rule
                                                                                                                APIs
                                                                                                                • try_get_function.LIBVCRUNTIME ref: 00007FF6EC4E9468
                                                                                                                • try_get_function.LIBVCRUNTIME ref: 00007FF6EC4E949A
                                                                                                                  • Part of subcall function 00007FF6EC4E81A8: GetProcAddress.KERNEL32(?,?,00000006,00007FF6EC4E8A2A,?,?,00000000,00007FF6EC4E77AE,?,?,00000000,00007FF6EC4E6B85), ref: 00007FF6EC4E8300
                                                                                                                Strings
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 0000000C.00000002.2574093388.00007FF6EC4B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF6EC4B0000, based on PE: true
                                                                                                                • Associated: 0000000C.00000002.2574070380.00007FF6EC4B0000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                • Associated: 0000000C.00000002.2574132408.00007FF6EC504000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                • Associated: 0000000C.00000002.2574154940.00007FF6EC517000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                • Associated: 0000000C.00000002.2574176551.00007FF6EC51A000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_12_2_7ff6ec4b0000_tapinstall.jbxd
                                                                                                                Similarity
                                                                                                                • API ID: try_get_function$AddressProc
                                                                                                                • String ID: GetActiveWindow$GetLastActivePopup
                                                                                                                • API String ID: 1640347226-3742175580
                                                                                                                • Opcode ID: 96139b02f01ac1a12e8e8bbed336b4c2bf4c2c17f5e7323450708969746c16ee
                                                                                                                • Instruction ID: 17ecda64aa124370fc6ba9e3423626ab3e126a42ee85a068bdaa08a30d53ae10
                                                                                                                • Opcode Fuzzy Hash: 96139b02f01ac1a12e8e8bbed336b4c2bf4c2c17f5e7323450708969746c16ee
                                                                                                                • Instruction Fuzzy Hash: 72F0E752A0DA07D1FA54AB95A8523F012909F18398F850439C91CCA390FF3EA9A9C31A
                                                                                                                Function 00007FF6EC4E921C Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 28COMMON
                                                                                                                Download Yara Rule
                                                                                                                APIs
                                                                                                                • try_get_function.LIBVCRUNTIME ref: 00007FF6EC4E924C
                                                                                                                • try_get_function.LIBVCRUNTIME ref: 00007FF6EC4E926E
                                                                                                                  • Part of subcall function 00007FF6EC4E81A8: GetProcAddress.KERNEL32(?,?,00000006,00007FF6EC4E8A2A,?,?,00000000,00007FF6EC4E77AE,?,?,00000000,00007FF6EC4E6B85), ref: 00007FF6EC4E8300
                                                                                                                Strings
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 0000000C.00000002.2574093388.00007FF6EC4B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF6EC4B0000, based on PE: true
                                                                                                                • Associated: 0000000C.00000002.2574070380.00007FF6EC4B0000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                • Associated: 0000000C.00000002.2574132408.00007FF6EC504000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                • Associated: 0000000C.00000002.2574154940.00007FF6EC517000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                • Associated: 0000000C.00000002.2574176551.00007FF6EC51A000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_12_2_7ff6ec4b0000_tapinstall.jbxd
                                                                                                                Similarity
                                                                                                                • API ID: try_get_function$AddressProc
                                                                                                                • String ID: MessageBoxA$MessageBoxW
                                                                                                                • API String ID: 1640347226-1053882329
                                                                                                                • Opcode ID: d25e26e93fbc0f399955a4174ee145feb3741ebe1ff497b5d2ef8bac74c6ea03
                                                                                                                • Instruction ID: e0aa4183415067c253ea973a8f70cb31270a70a55ef4b04279d9ce32ba737bca
                                                                                                                • Opcode Fuzzy Hash: d25e26e93fbc0f399955a4174ee145feb3741ebe1ff497b5d2ef8bac74c6ea03
                                                                                                                • Instruction Fuzzy Hash: C7F0AF23A0864795EF04DF60E8826F423A0EF5438CB84003AD10DC61A1EF7DE95DC389
                                                                                                                Function 00007FF6EC4FE2A8 Relevance: 6.1, APIs: 4, Instructions: 64COMMON
                                                                                                                Download Yara Rule
                                                                                                                APIs
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 0000000C.00000002.2574093388.00007FF6EC4B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF6EC4B0000, based on PE: true
                                                                                                                • Associated: 0000000C.00000002.2574070380.00007FF6EC4B0000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                • Associated: 0000000C.00000002.2574132408.00007FF6EC504000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                • Associated: 0000000C.00000002.2574154940.00007FF6EC517000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                • Associated: 0000000C.00000002.2574176551.00007FF6EC51A000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_12_2_7ff6ec4b0000_tapinstall.jbxd
                                                                                                                Similarity
                                                                                                                • API ID: FilePointer$ErrorLast
                                                                                                                • String ID:
                                                                                                                • API String ID: 142388799-0
                                                                                                                • Opcode ID: 62e83ff613cf7e0c6914a0449e0ad6475a81f3d2e6a598e7b544edde691620a4
                                                                                                                • Instruction ID: b342fca986b10982609e9d7bda841271936fa36956a35f3cdc6ebc943912a993
                                                                                                                • Opcode Fuzzy Hash: 62e83ff613cf7e0c6914a0449e0ad6475a81f3d2e6a598e7b544edde691620a4
                                                                                                                • Instruction Fuzzy Hash: 32212623A08A92C5E7109B24B8052BD7761AB44BF8F545731EA2DC7BE4DF7DD448C309
                                                                                                                Function 00007FF6EC4B77B0 Relevance: 6.1, APIs: 4, Instructions: 63COMMON
                                                                                                                Download Yara Rule
                                                                                                                APIs
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 0000000C.00000002.2574093388.00007FF6EC4B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF6EC4B0000, based on PE: true
                                                                                                                • Associated: 0000000C.00000002.2574070380.00007FF6EC4B0000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                • Associated: 0000000C.00000002.2574132408.00007FF6EC504000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                • Associated: 0000000C.00000002.2574154940.00007FF6EC517000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                • Associated: 0000000C.00000002.2574176551.00007FF6EC51A000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_12_2_7ff6ec4b0000_tapinstall.jbxd
                                                                                                                Similarity
                                                                                                                • API ID: Initialize__scrt_fastfail__scrt_initialize_default_local_stdio_options_invalid_parameter_noinfo_onexit_set_fmode
                                                                                                                • String ID:
                                                                                                                • API String ID: 2724578021-0
                                                                                                                • Opcode ID: 59f558a869d8c5a2891d93cde5f61cf3a556da39cfb7dd89c65c92046b5ebcbe
                                                                                                                • Instruction ID: 96b3bba4ea1bea883738770c39390ac48706849577f6776a73db5746989d5443
                                                                                                                • Opcode Fuzzy Hash: 59f558a869d8c5a2891d93cde5f61cf3a556da39cfb7dd89c65c92046b5ebcbe
                                                                                                                • Instruction Fuzzy Hash: CE116653E08207C5FB64B7B149223BD56954F6034DF450834E50DC62CBEE6EA949CB2B
                                                                                                                Function 00007FF6EC4B2BD0 Relevance: 6.1, APIs: 4, Instructions: 52COMMON
                                                                                                                Download Yara Rule
                                                                                                                APIs
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 0000000C.00000002.2574093388.00007FF6EC4B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF6EC4B0000, based on PE: true
                                                                                                                • Associated: 0000000C.00000002.2574070380.00007FF6EC4B0000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                • Associated: 0000000C.00000002.2574132408.00007FF6EC504000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                • Associated: 0000000C.00000002.2574154940.00007FF6EC517000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                • Associated: 0000000C.00000002.2574176551.00007FF6EC51A000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_12_2_7ff6ec4b0000_tapinstall.jbxd
                                                                                                                Similarity
                                                                                                                • API ID: MachineNode_$Connect_Disconnect_Locate_Reenumerate_
                                                                                                                • String ID:
                                                                                                                • API String ID: 218754429-0
                                                                                                                • Opcode ID: 51e3b3903d85c558772266e626df222a9037cd96535ea5ab3710ae0d24f20ba0
                                                                                                                • Instruction ID: 25c65d105488a854a18c70d9bba93a577bfdfb6170e3f09f2bd429991be98401
                                                                                                                • Opcode Fuzzy Hash: 51e3b3903d85c558772266e626df222a9037cd96535ea5ab3710ae0d24f20ba0
                                                                                                                • Instruction Fuzzy Hash: 0611A523A0864282F7249B21E44167E63A1FFC8B88F458131DE8DC7A58EF3ED909CB05
                                                                                                                Function 00007FF6EC4BAF10 Relevance: 6.0, APIs: 4, Instructions: 45COMMONLIBRARYCODE
                                                                                                                Download Yara Rule
                                                                                                                APIs
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 0000000C.00000002.2574093388.00007FF6EC4B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF6EC4B0000, based on PE: true
                                                                                                                • Associated: 0000000C.00000002.2574070380.00007FF6EC4B0000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                • Associated: 0000000C.00000002.2574132408.00007FF6EC504000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                • Associated: 0000000C.00000002.2574154940.00007FF6EC517000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                • Associated: 0000000C.00000002.2574176551.00007FF6EC51A000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_12_2_7ff6ec4b0000_tapinstall.jbxd
                                                                                                                Similarity
                                                                                                                • API ID: HeapManager::getMemoryName::operator+=Name::operator=
                                                                                                                • String ID:
                                                                                                                • API String ID: 2929307750-0
                                                                                                                • Opcode ID: fce481929f355538a9b42238b523bc7f3f2660cc8b7c85b8c5e9693f606264b3
                                                                                                                • Instruction ID: 7c7f348a4f38711d707e2040edc7c262d5c616c4f75a95abc3be01c0acb565ea
                                                                                                                • Opcode Fuzzy Hash: fce481929f355538a9b42238b523bc7f3f2660cc8b7c85b8c5e9693f606264b3
                                                                                                                • Instruction Fuzzy Hash: 7211C673A1D682C1FA119710D4093BD67D1AB54BC8F588431DA5C8368ADE2EE8AAC31A
                                                                                                                Function 00007FF6EC4FE438 Relevance: 6.0, APIs: 4, Instructions: 43COMMON
                                                                                                                Download Yara Rule
                                                                                                                APIs
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 0000000C.00000002.2574093388.00007FF6EC4B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF6EC4B0000, based on PE: true
                                                                                                                • Associated: 0000000C.00000002.2574070380.00007FF6EC4B0000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                • Associated: 0000000C.00000002.2574132408.00007FF6EC504000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                • Associated: 0000000C.00000002.2574154940.00007FF6EC517000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                • Associated: 0000000C.00000002.2574176551.00007FF6EC51A000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_12_2_7ff6ec4b0000_tapinstall.jbxd
                                                                                                                Similarity
                                                                                                                • API ID: FilePointer$ErrorLast
                                                                                                                • String ID:
                                                                                                                • API String ID: 142388799-0
                                                                                                                • Opcode ID: 5218c0f678f2c40fbbdda99fcc7e3f762700fa66660efab7cd38c83b84687fb8
                                                                                                                • Instruction ID: 77154eccd4a1fa2597da691ab062d501a69473812b2b67030b6a4ef71bb49157
                                                                                                                • Opcode Fuzzy Hash: 5218c0f678f2c40fbbdda99fcc7e3f762700fa66660efab7cd38c83b84687fb8
                                                                                                                • Instruction Fuzzy Hash: BD11A323A08681C5E7108B65B80126AB7A0FF84B99F144235DA9DC3BA4CF3DD444C709
                                                                                                                Function 00007FF6EC4D0C54 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 176COMMON
                                                                                                                Download Yara Rule
                                                                                                                APIs
                                                                                                                Strings
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 0000000C.00000002.2574093388.00007FF6EC4B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF6EC4B0000, based on PE: true
                                                                                                                • Associated: 0000000C.00000002.2574070380.00007FF6EC4B0000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                • Associated: 0000000C.00000002.2574132408.00007FF6EC504000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                • Associated: 0000000C.00000002.2574154940.00007FF6EC517000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                • Associated: 0000000C.00000002.2574176551.00007FF6EC51A000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_12_2_7ff6ec4b0000_tapinstall.jbxd
                                                                                                                Similarity
                                                                                                                • API ID: _invalid_parameter_noinfo
                                                                                                                • String ID: *
                                                                                                                • API String ID: 3215553584-163128923
                                                                                                                • Opcode ID: c702a447af3feb003120d3a589a2401bc16d95218c9ee08842c12031ba723851
                                                                                                                • Instruction ID: 3e358eee4319a6fceca0177aa361e25e2223a91d7cff3f6aa6d0688d3164be33
                                                                                                                • Opcode Fuzzy Hash: c702a447af3feb003120d3a589a2401bc16d95218c9ee08842c12031ba723851
                                                                                                                • Instruction Fuzzy Hash: B1719673908612C6E76AAF28805437C3FA0EB55F5CF54053ACA5E83298DF3AD449CB5E
                                                                                                                Function 00007FF6EC4D04BC Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 174COMMON
                                                                                                                Download Yara Rule
                                                                                                                APIs
                                                                                                                Strings
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 0000000C.00000002.2574093388.00007FF6EC4B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF6EC4B0000, based on PE: true
                                                                                                                • Associated: 0000000C.00000002.2574070380.00007FF6EC4B0000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                • Associated: 0000000C.00000002.2574132408.00007FF6EC504000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                • Associated: 0000000C.00000002.2574154940.00007FF6EC517000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                • Associated: 0000000C.00000002.2574176551.00007FF6EC51A000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_12_2_7ff6ec4b0000_tapinstall.jbxd
                                                                                                                Similarity
                                                                                                                • API ID: _invalid_parameter_noinfo
                                                                                                                • String ID: *
                                                                                                                • API String ID: 3215553584-163128923
                                                                                                                • Opcode ID: 273e77a1793748d35078b520fc40068adaf46b422db4c706b51f3ef3c241a5fe
                                                                                                                • Instruction ID: 9c4c971e579d1d223493784c9d8bc85366cccc080c4e1ad98c99035542547e4e
                                                                                                                • Opcode Fuzzy Hash: 273e77a1793748d35078b520fc40068adaf46b422db4c706b51f3ef3c241a5fe
                                                                                                                • Instruction Fuzzy Hash: A571FB73909212C6E76AAF28805427C3FB0EB44B1CF141539EA5A87295DF3AD489CF1E
                                                                                                                Function 00007FF6EC4D1190 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 171COMMON
                                                                                                                Download Yara Rule
                                                                                                                APIs
                                                                                                                Strings
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 0000000C.00000002.2574093388.00007FF6EC4B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF6EC4B0000, based on PE: true
                                                                                                                • Associated: 0000000C.00000002.2574070380.00007FF6EC4B0000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                • Associated: 0000000C.00000002.2574132408.00007FF6EC504000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                • Associated: 0000000C.00000002.2574154940.00007FF6EC517000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                • Associated: 0000000C.00000002.2574176551.00007FF6EC51A000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_12_2_7ff6ec4b0000_tapinstall.jbxd
                                                                                                                Similarity
                                                                                                                • API ID: _invalid_parameter_noinfo
                                                                                                                • String ID: *
                                                                                                                • API String ID: 3215553584-163128923
                                                                                                                • Opcode ID: 44c1df76ee1ff000bf001b99eeb66820c451a0d8bf2018bec658e7c217c0f5f6
                                                                                                                • Instruction ID: b3efdbdd8a116d447cea77411d1cb21f6b82a4a2359b5a99f462e4400fe857c2
                                                                                                                • Opcode Fuzzy Hash: 44c1df76ee1ff000bf001b99eeb66820c451a0d8bf2018bec658e7c217c0f5f6
                                                                                                                • Instruction Fuzzy Hash: E07161F3908612C6E765AF29804427C3FB0FB45B6CF141236EE4AC2695DF3AD449CB5A
                                                                                                                Function 00007FF6EC4D09E8 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 169COMMON
                                                                                                                Download Yara Rule
                                                                                                                APIs
                                                                                                                Strings
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 0000000C.00000002.2574093388.00007FF6EC4B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF6EC4B0000, based on PE: true
                                                                                                                • Associated: 0000000C.00000002.2574070380.00007FF6EC4B0000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                • Associated: 0000000C.00000002.2574132408.00007FF6EC504000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                • Associated: 0000000C.00000002.2574154940.00007FF6EC517000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                • Associated: 0000000C.00000002.2574176551.00007FF6EC51A000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_12_2_7ff6ec4b0000_tapinstall.jbxd
                                                                                                                Similarity
                                                                                                                • API ID: _invalid_parameter_noinfo
                                                                                                                • String ID: *
                                                                                                                • API String ID: 3215553584-163128923
                                                                                                                • Opcode ID: 0377a43a123b46e862bf5f185707fa53883c6999a2b7e98940989a3650cad85b
                                                                                                                • Instruction ID: 832e1ceb36148e6e8609cfd8d0bb3a6a24b1a53a02856fc7db5781a0c8497ff7
                                                                                                                • Opcode Fuzzy Hash: 0377a43a123b46e862bf5f185707fa53883c6999a2b7e98940989a3650cad85b
                                                                                                                • Instruction Fuzzy Hash: B071857390C712C6E76AAF29804427D3FA0EB05B1CF14153ADA59C7299DF3BD489CB1A
                                                                                                                Function 00007FF6EC4E0610 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 111COMMON
                                                                                                                Download Yara Rule
                                                                                                                APIs
                                                                                                                • _invalid_parameter_noinfo.LIBCMT ref: 00007FF6EC4E0642
                                                                                                                  • Part of subcall function 00007FF6EC4E79F8: HeapFree.KERNEL32(?,?,?,00007FF6EC4F32DC,?,?,?,00007FF6EC4F36FF,?,?,00000000,00007FF6EC4F3F44,?,?,?,00007FF6EC4F3E77), ref: 00007FF6EC4E7A0E
                                                                                                                  • Part of subcall function 00007FF6EC4E79F8: GetLastError.KERNEL32(?,?,?,00007FF6EC4F32DC,?,?,?,00007FF6EC4F36FF,?,?,00000000,00007FF6EC4F3F44,?,?,?,00007FF6EC4F3E77), ref: 00007FF6EC4E7A20
                                                                                                                • GetModuleFileNameW.KERNEL32(?,?,?,?,?,00007FF6EC4B7805), ref: 00007FF6EC4E0660
                                                                                                                Strings
                                                                                                                • C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exe, xrefs: 00007FF6EC4E064E
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 0000000C.00000002.2574093388.00007FF6EC4B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF6EC4B0000, based on PE: true
                                                                                                                • Associated: 0000000C.00000002.2574070380.00007FF6EC4B0000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                • Associated: 0000000C.00000002.2574132408.00007FF6EC504000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                • Associated: 0000000C.00000002.2574154940.00007FF6EC517000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                • Associated: 0000000C.00000002.2574176551.00007FF6EC51A000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_12_2_7ff6ec4b0000_tapinstall.jbxd
                                                                                                                Similarity
                                                                                                                • API ID: ErrorFileFreeHeapLastModuleName_invalid_parameter_noinfo
                                                                                                                • String ID: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exe
                                                                                                                • API String ID: 3580290477-2985852448
                                                                                                                • Opcode ID: b063ccabdf4ae0fb810ec30d9af89ab26e9ed12f878b4f8ead2f3c050a887b6f
                                                                                                                • Instruction ID: bf28b15e2aeddb8a173545df8de92ea2e2840226f4dd6236b3b11dd084e4db37
                                                                                                                • Opcode Fuzzy Hash: b063ccabdf4ae0fb810ec30d9af89ab26e9ed12f878b4f8ead2f3c050a887b6f
                                                                                                                • Instruction Fuzzy Hash: 9941C033A08B02CEE755DF25A8402BC27A0EF447D8F560035E95D8BB85DE3EE488C705
                                                                                                                Function 00007FF6EC4DFD7C Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 109COMMON
                                                                                                                Download Yara Rule
                                                                                                                APIs
                                                                                                                Strings
                                                                                                                • C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exe, xrefs: 00007FF6EC4DFDBF
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 0000000C.00000002.2574093388.00007FF6EC4B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF6EC4B0000, based on PE: true
                                                                                                                • Associated: 0000000C.00000002.2574070380.00007FF6EC4B0000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                • Associated: 0000000C.00000002.2574132408.00007FF6EC504000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                • Associated: 0000000C.00000002.2574154940.00007FF6EC517000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                • Associated: 0000000C.00000002.2574176551.00007FF6EC51A000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_12_2_7ff6ec4b0000_tapinstall.jbxd
                                                                                                                Similarity
                                                                                                                • API ID: _invalid_parameter_noinfo
                                                                                                                • String ID: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exe
                                                                                                                • API String ID: 3215553584-2985852448
                                                                                                                • Opcode ID: e29d975727e9928f6db482a1ce53242b1b870c676fb5658a615ffb6c2a7e9428
                                                                                                                • Instruction ID: 16be8ea90dbbdb1e67d27f6c11dfd488ef8b0576555d9d8384ce394e2473dccf
                                                                                                                • Opcode Fuzzy Hash: e29d975727e9928f6db482a1ce53242b1b870c676fb5658a615ffb6c2a7e9428
                                                                                                                • Instruction Fuzzy Hash: 1C419F33A08B52C9F765EF29A8402A867A4EF447DCF554032E94DC7B95DE3EE488C705
                                                                                                                Function 00007FF6EC4F6F00 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 100fileCOMMON
                                                                                                                Download Yara Rule
                                                                                                                APIs
                                                                                                                Strings
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 0000000C.00000002.2574093388.00007FF6EC4B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF6EC4B0000, based on PE: true
                                                                                                                • Associated: 0000000C.00000002.2574070380.00007FF6EC4B0000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                • Associated: 0000000C.00000002.2574132408.00007FF6EC504000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                • Associated: 0000000C.00000002.2574154940.00007FF6EC517000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                • Associated: 0000000C.00000002.2574176551.00007FF6EC51A000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_12_2_7ff6ec4b0000_tapinstall.jbxd
                                                                                                                Similarity
                                                                                                                • API ID: ErrorFileLastWrite
                                                                                                                • String ID: U
                                                                                                                • API String ID: 442123175-4171548499
                                                                                                                • Opcode ID: 1fe9f3420805e2f29ef7fd3f085adcd01cfbc63ee96cabacd67f80ead1b7df33
                                                                                                                • Instruction ID: f1b74074f05c5772cfcc025ed4be7f39c936bc9ae90a0db3061047545f20008a
                                                                                                                • Opcode Fuzzy Hash: 1fe9f3420805e2f29ef7fd3f085adcd01cfbc63ee96cabacd67f80ead1b7df33
                                                                                                                • Instruction Fuzzy Hash: 7541D423B28A82C9EB208F25E4443AA67A0FB88798F504131EE4DC7798DF3DD545C755
                                                                                                                Function 00007FF6EC4D63EC Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 92COMMON
                                                                                                                Download Yara Rule
                                                                                                                APIs
                                                                                                                Strings
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 0000000C.00000002.2574093388.00007FF6EC4B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF6EC4B0000, based on PE: true
                                                                                                                • Associated: 0000000C.00000002.2574070380.00007FF6EC4B0000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                • Associated: 0000000C.00000002.2574132408.00007FF6EC504000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                • Associated: 0000000C.00000002.2574154940.00007FF6EC517000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                • Associated: 0000000C.00000002.2574176551.00007FF6EC51A000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_12_2_7ff6ec4b0000_tapinstall.jbxd
                                                                                                                Similarity
                                                                                                                • API ID: _invalid_parameter_noinfo
                                                                                                                • String ID: (null)
                                                                                                                • API String ID: 3215553584-3941151225
                                                                                                                • Opcode ID: 6c3bdb81d6503200fbc9806bbd4de99d2cd9e2aec5a58b5ddbe94e3352eb6c76
                                                                                                                • Instruction ID: c36cf58f197315bd227ccb82bebd2d6ce92fb935dadade58246c46cbe20e0d90
                                                                                                                • Opcode Fuzzy Hash: 6c3bdb81d6503200fbc9806bbd4de99d2cd9e2aec5a58b5ddbe94e3352eb6c76
                                                                                                                • Instruction Fuzzy Hash: 0541C373918642C6EB54AF28D1503FC3BA0EB15B4CF144939CA4C8B359DF2BE489CB0A
                                                                                                                Function 00007FF6EC4D61AC Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 91COMMON
                                                                                                                Download Yara Rule
                                                                                                                APIs
                                                                                                                Strings
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 0000000C.00000002.2574093388.00007FF6EC4B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF6EC4B0000, based on PE: true
                                                                                                                • Associated: 0000000C.00000002.2574070380.00007FF6EC4B0000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                • Associated: 0000000C.00000002.2574132408.00007FF6EC504000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                • Associated: 0000000C.00000002.2574154940.00007FF6EC517000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                • Associated: 0000000C.00000002.2574176551.00007FF6EC51A000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_12_2_7ff6ec4b0000_tapinstall.jbxd
                                                                                                                Similarity
                                                                                                                • API ID: _invalid_parameter_noinfo
                                                                                                                • String ID: (null)
                                                                                                                • API String ID: 3215553584-3941151225
                                                                                                                • Opcode ID: 86f5d118cb039ec818438e09ce49581f3b3a508989dcbeb2b4f251bb552b9fde
                                                                                                                • Instruction ID: 4e72f7854af5e8b60ddbbfa1e4db77e670b7de255d9bde0bf6adbcd11f202a47
                                                                                                                • Opcode Fuzzy Hash: 86f5d118cb039ec818438e09ce49581f3b3a508989dcbeb2b4f251bb552b9fde
                                                                                                                • Instruction Fuzzy Hash: B0417F77908642C6EB54BF2981443FC2BA0EB15B4CF14483ACA4E8B295DF2BD45DDB1A
                                                                                                                Function 00007FF6EC4D6634 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 80COMMON
                                                                                                                Download Yara Rule
                                                                                                                APIs
                                                                                                                Strings
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 0000000C.00000002.2574093388.00007FF6EC4B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF6EC4B0000, based on PE: true
                                                                                                                • Associated: 0000000C.00000002.2574070380.00007FF6EC4B0000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                • Associated: 0000000C.00000002.2574132408.00007FF6EC504000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                • Associated: 0000000C.00000002.2574154940.00007FF6EC517000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                • Associated: 0000000C.00000002.2574176551.00007FF6EC51A000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_12_2_7ff6ec4b0000_tapinstall.jbxd
                                                                                                                Similarity
                                                                                                                • API ID: _invalid_parameter_noinfo
                                                                                                                • String ID: (null)
                                                                                                                • API String ID: 3215553584-3941151225
                                                                                                                • Opcode ID: 8d16575f416e964c397b675debac7c57f087c1fd9fd9ac565c228dc38de02ea8
                                                                                                                • Instruction ID: fed958c59745ea8ce1600a18c97c3b32761e7e0900d2f7861a8d4d3ac8d8f4b3
                                                                                                                • Opcode Fuzzy Hash: 8d16575f416e964c397b675debac7c57f087c1fd9fd9ac565c228dc38de02ea8
                                                                                                                • Instruction Fuzzy Hash: 83318773908655C6EB54AF19D1443BC2BA0EB14B8CF10443ACA5C8B395DF3BE45ACB1A
                                                                                                                Function 00007FF6EC4D686C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 80COMMON
                                                                                                                Download Yara Rule
                                                                                                                APIs
                                                                                                                Strings
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 0000000C.00000002.2574093388.00007FF6EC4B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF6EC4B0000, based on PE: true
                                                                                                                • Associated: 0000000C.00000002.2574070380.00007FF6EC4B0000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                • Associated: 0000000C.00000002.2574132408.00007FF6EC504000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                • Associated: 0000000C.00000002.2574154940.00007FF6EC517000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                • Associated: 0000000C.00000002.2574176551.00007FF6EC51A000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_12_2_7ff6ec4b0000_tapinstall.jbxd
                                                                                                                Similarity
                                                                                                                • API ID: _invalid_parameter_noinfo
                                                                                                                • String ID: (null)
                                                                                                                • API String ID: 3215553584-3941151225
                                                                                                                • Opcode ID: cc2c6a8b0e55809a46d0f9a000170ec88b53eaf67deeeed0a9ebb9cf96cbfb4a
                                                                                                                • Instruction ID: f863a60a4fbed19218b572d23d4d842a93344116c04d132f905b685270dd105d
                                                                                                                • Opcode Fuzzy Hash: cc2c6a8b0e55809a46d0f9a000170ec88b53eaf67deeeed0a9ebb9cf96cbfb4a
                                                                                                                • Instruction Fuzzy Hash: F6316B73908652C6EB54AF15D1403BC7BA0EB15B8CF14447ACA8C4B395DF3BE45ACB1A
                                                                                                                Function 00007FF6EC4B93B8 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 80COMMON
                                                                                                                Download Yara Rule
                                                                                                                APIs
                                                                                                                Strings
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 0000000C.00000002.2574093388.00007FF6EC4B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF6EC4B0000, based on PE: true
                                                                                                                • Associated: 0000000C.00000002.2574070380.00007FF6EC4B0000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                • Associated: 0000000C.00000002.2574132408.00007FF6EC504000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                • Associated: 0000000C.00000002.2574154940.00007FF6EC517000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                • Associated: 0000000C.00000002.2574176551.00007FF6EC51A000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_12_2_7ff6ec4b0000_tapinstall.jbxd
                                                                                                                Similarity
                                                                                                                • API ID: EntryInterlockedListNamePush__un
                                                                                                                • String ID:
                                                                                                                • API String ID: 524438517-3916222277
                                                                                                                • Opcode ID: 417fdae7254f6f5144bd35c4e94cf888892e231184d73a789330c72b6a667246
                                                                                                                • Instruction ID: 878977cae5daf59b38d278afd41b23d661d66ec50ba8fdee830fabdda2cd8afc
                                                                                                                • Opcode Fuzzy Hash: 417fdae7254f6f5144bd35c4e94cf888892e231184d73a789330c72b6a667246
                                                                                                                • Instruction Fuzzy Hash: 0F312413B29B8284EA09CB2694046AD73A0FB58FE8F594635DD2D83384DE3AD846C309
                                                                                                                Function 00007FF6EC502648 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 54COMMON
                                                                                                                Download Yara Rule
                                                                                                                APIs
                                                                                                                Strings
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 0000000C.00000002.2574093388.00007FF6EC4B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF6EC4B0000, based on PE: true
                                                                                                                • Associated: 0000000C.00000002.2574070380.00007FF6EC4B0000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                • Associated: 0000000C.00000002.2574132408.00007FF6EC504000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                • Associated: 0000000C.00000002.2574154940.00007FF6EC517000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                • Associated: 0000000C.00000002.2574176551.00007FF6EC51A000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_12_2_7ff6ec4b0000_tapinstall.jbxd
                                                                                                                Similarity
                                                                                                                • API ID: _set_errno_from_matherr
                                                                                                                • String ID: exp
                                                                                                                • API String ID: 1187470696-113136155
                                                                                                                • Opcode ID: d5f934b609bcad54c18539aeaafe18b7f7d4df74e02c91daf66fb3b3797701d8
                                                                                                                • Instruction ID: e7823cd44f9069a39ccc74b7432ba1e086fd367abc5356629f26d17f04718c23
                                                                                                                • Opcode Fuzzy Hash: d5f934b609bcad54c18539aeaafe18b7f7d4df74e02c91daf66fb3b3797701d8
                                                                                                                • Instruction Fuzzy Hash: 61210C37A19685CBE760DF28A84126AB6A0FB89704F504A35F68DC2B56EF3DE410CF05
                                                                                                                Function 00007FF6EC4E8EA0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 50COMMONLIBRARYCODE
                                                                                                                Download Yara Rule
                                                                                                                APIs
                                                                                                                Strings
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 0000000C.00000002.2574093388.00007FF6EC4B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF6EC4B0000, based on PE: true
                                                                                                                • Associated: 0000000C.00000002.2574070380.00007FF6EC4B0000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                • Associated: 0000000C.00000002.2574132408.00007FF6EC504000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                • Associated: 0000000C.00000002.2574154940.00007FF6EC517000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                • Associated: 0000000C.00000002.2574176551.00007FF6EC51A000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_12_2_7ff6ec4b0000_tapinstall.jbxd
                                                                                                                Similarity
                                                                                                                • API ID: Stringtry_get_function
                                                                                                                • String ID: LCMapStringEx
                                                                                                                • API String ID: 2588686239-3893581201
                                                                                                                • Opcode ID: cb295809db890668f8262a5fe3d3b6ddd0daf1558d4252fdccb92730558150a5
                                                                                                                • Instruction ID: a85147403aa5b502e8d21aa5778f4e5d521412a3bd96538b33c685e5b51222d4
                                                                                                                • Opcode Fuzzy Hash: cb295809db890668f8262a5fe3d3b6ddd0daf1558d4252fdccb92730558150a5
                                                                                                                • Instruction Fuzzy Hash: 27111832A08B8186DB60CB05B4403AAB7A1FBC8B94F54413AEE8D83B19DF3CD454CB44
                                                                                                                Function 00007FF6EC4E87B0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 50COMMON
                                                                                                                Download Yara Rule
                                                                                                                APIs
                                                                                                                Strings
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 0000000C.00000002.2574093388.00007FF6EC4B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF6EC4B0000, based on PE: true
                                                                                                                • Associated: 0000000C.00000002.2574070380.00007FF6EC4B0000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                • Associated: 0000000C.00000002.2574132408.00007FF6EC504000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                • Associated: 0000000C.00000002.2574154940.00007FF6EC517000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                • Associated: 0000000C.00000002.2574176551.00007FF6EC51A000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_12_2_7ff6ec4b0000_tapinstall.jbxd
                                                                                                                Similarity
                                                                                                                • API ID: CompareStringtry_get_function
                                                                                                                • String ID: CompareStringEx
                                                                                                                • API String ID: 3328479835-2590796910
                                                                                                                • Opcode ID: b4cbd51ef5490bc2d2e272553a4ec6addf4d60e5b84b1302dc18e736ddf69fb6
                                                                                                                • Instruction ID: e2134ce5c71c8c6eadf0daa1a36d3f04395a25f09a065a25cff4125f529aee08
                                                                                                                • Opcode Fuzzy Hash: b4cbd51ef5490bc2d2e272553a4ec6addf4d60e5b84b1302dc18e736ddf69fb6
                                                                                                                • Instruction Fuzzy Hash: 79113B36A08B8186D760CB06F4402AAB7A0FB88BD4F54413AEECD83B19DF3DD454CB04
                                                                                                                Function 00007FF6EC4E8A50 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 46COMMON
                                                                                                                Download Yara Rule
                                                                                                                APIs
                                                                                                                Strings
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 0000000C.00000002.2574093388.00007FF6EC4B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF6EC4B0000, based on PE: true
                                                                                                                • Associated: 0000000C.00000002.2574070380.00007FF6EC4B0000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                • Associated: 0000000C.00000002.2574132408.00007FF6EC504000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                • Associated: 0000000C.00000002.2574154940.00007FF6EC517000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                • Associated: 0000000C.00000002.2574176551.00007FF6EC51A000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_12_2_7ff6ec4b0000_tapinstall.jbxd
                                                                                                                Similarity
                                                                                                                • API ID: DateFormattry_get_function
                                                                                                                • String ID: GetDateFormatEx
                                                                                                                • API String ID: 595753042-159735388
                                                                                                                • Opcode ID: 10ba63a0d18b04a583d40d43b30d9b9fca51ff14bda4a48675f954ae51532e04
                                                                                                                • Instruction ID: 84a9a960683853bd0fd0dab946bde27d74033a98f15e4b8c9419e9bc670d3dcc
                                                                                                                • Opcode Fuzzy Hash: 10ba63a0d18b04a583d40d43b30d9b9fca51ff14bda4a48675f954ae51532e04
                                                                                                                • Instruction Fuzzy Hash: 0F115E32A08B81C6E710CB59B4402AAB7A0FB88BD4F184135EE8D87B29DF3CD554CB44
                                                                                                                Function 00007FF6EC4E8C10 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44timeCOMMON
                                                                                                                Download Yara Rule
                                                                                                                APIs
                                                                                                                Strings
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 0000000C.00000002.2574093388.00007FF6EC4B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF6EC4B0000, based on PE: true
                                                                                                                • Associated: 0000000C.00000002.2574070380.00007FF6EC4B0000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                • Associated: 0000000C.00000002.2574132408.00007FF6EC504000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                • Associated: 0000000C.00000002.2574154940.00007FF6EC517000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                • Associated: 0000000C.00000002.2574176551.00007FF6EC51A000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_12_2_7ff6ec4b0000_tapinstall.jbxd
                                                                                                                Similarity
                                                                                                                • API ID: FormatTimetry_get_function
                                                                                                                • String ID: GetTimeFormatEx
                                                                                                                • API String ID: 3261793192-1692793031
                                                                                                                • Opcode ID: aeeeb5d1137ef8777056a49e071640647c3087b2b7666cf388f882a4f27613d1
                                                                                                                • Instruction ID: a9db33377de202ba1d90c31a7dfd0d3971b7551ea17fc21613eeffdfd0c021fa
                                                                                                                • Opcode Fuzzy Hash: aeeeb5d1137ef8777056a49e071640647c3087b2b7666cf388f882a4f27613d1
                                                                                                                • Instruction Fuzzy Hash: 22114F26A08781C6EB10CB5AB40016AB7A0FB88BD4F194135EE8D97B69DF3DD554CB05
                                                                                                                Function 00007FF6EC4E8CBC Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 26COMMON
                                                                                                                Download Yara Rule
                                                                                                                APIs
                                                                                                                Strings
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 0000000C.00000002.2574093388.00007FF6EC4B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF6EC4B0000, based on PE: true
                                                                                                                • Associated: 0000000C.00000002.2574070380.00007FF6EC4B0000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                • Associated: 0000000C.00000002.2574132408.00007FF6EC504000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                • Associated: 0000000C.00000002.2574154940.00007FF6EC517000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                • Associated: 0000000C.00000002.2574176551.00007FF6EC51A000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_12_2_7ff6ec4b0000_tapinstall.jbxd
                                                                                                                Similarity
                                                                                                                • API ID: DefaultUsertry_get_function
                                                                                                                • String ID: GetUserDefaultLocaleName
                                                                                                                • API String ID: 3217810228-151340334
                                                                                                                • Opcode ID: 40f2b170c37b226c28a728e1fb59e4eb6a38f080f95f7a64a26471c64eab7d17
                                                                                                                • Instruction ID: 9e0a2218a09217d685b6165ef2121ea24cf2898b35e2894879e78ba1ab3b97e7
                                                                                                                • Opcode Fuzzy Hash: 40f2b170c37b226c28a728e1fb59e4eb6a38f080f95f7a64a26471c64eab7d17
                                                                                                                • Instruction Fuzzy Hash: 7CF0E212B18242C1FF049B69B6827B82391BF487C8F464039C90DCBB51DE3ED859C30A
                                                                                                                Function 00007FF6EC4E8D74 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 25COMMON
                                                                                                                Download Yara Rule
                                                                                                                APIs
                                                                                                                Strings
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 0000000C.00000002.2574093388.00007FF6EC4B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF6EC4B0000, based on PE: true
                                                                                                                • Associated: 0000000C.00000002.2574070380.00007FF6EC4B0000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                • Associated: 0000000C.00000002.2574132408.00007FF6EC504000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                • Associated: 0000000C.00000002.2574154940.00007FF6EC517000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                • Associated: 0000000C.00000002.2574176551.00007FF6EC51A000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_12_2_7ff6ec4b0000_tapinstall.jbxd
                                                                                                                Similarity
                                                                                                                • API ID: CountCriticalInitializeSectionSpintry_get_function
                                                                                                                • String ID: InitializeCriticalSectionEx
                                                                                                                • API String ID: 539475747-3084827643
                                                                                                                • Opcode ID: 036a1433a8a1f8b3f241dbe4fb9b563d765e8a3562a01f57a6fbde3195910b39
                                                                                                                • Instruction ID: f146549c2034b12ac66f7e576d112d9898451ca304cbafd83df74ddf689feb09
                                                                                                                • Opcode Fuzzy Hash: 036a1433a8a1f8b3f241dbe4fb9b563d765e8a3562a01f57a6fbde3195910b39
                                                                                                                • Instruction Fuzzy Hash: 79F0E223B18B42C1EB04AB45F4016B96320BF88BC4F8A4035DE1D87B54DF3ED8A9C74A
                                                                                                                Function 00007FF6EC4B8A74 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 23COMMON
                                                                                                                Download Yara Rule
                                                                                                                APIs
                                                                                                                • std::bad_alloc::bad_alloc.LIBCMT ref: 00007FF6EC4B8A7D
                                                                                                                • _CxxThrowException.LIBVCRUNTIME ref: 00007FF6EC4B8A8E
                                                                                                                  • Part of subcall function 00007FF6EC4B95E8: RtlPcToFileHeader.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00007FF6EC4B8A93), ref: 00007FF6EC4B965D
                                                                                                                  • Part of subcall function 00007FF6EC4B95E8: RaiseException.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00007FF6EC4B8A93), ref: 00007FF6EC4B968F
                                                                                                                Strings
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 0000000C.00000002.2574093388.00007FF6EC4B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF6EC4B0000, based on PE: true
                                                                                                                • Associated: 0000000C.00000002.2574070380.00007FF6EC4B0000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                • Associated: 0000000C.00000002.2574132408.00007FF6EC504000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                • Associated: 0000000C.00000002.2574154940.00007FF6EC517000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                • Associated: 0000000C.00000002.2574176551.00007FF6EC51A000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_12_2_7ff6ec4b0000_tapinstall.jbxd
                                                                                                                Similarity
                                                                                                                • API ID: Exception$FileHeaderRaiseThrowstd::bad_alloc::bad_alloc
                                                                                                                • String ID: Unknown exception
                                                                                                                • API String ID: 3561508498-410509341
                                                                                                                • Opcode ID: c34982857cb7bf4f7b9c185461aa535e310ed63d4d8e15e87b28d440cdfdae32
                                                                                                                • Instruction ID: 9c85c198c3823f498d486889d947abd066e5da62b3d47dcbe2d7c3210f59d7e5
                                                                                                                • Opcode Fuzzy Hash: c34982857cb7bf4f7b9c185461aa535e310ed63d4d8e15e87b28d440cdfdae32
                                                                                                                • Instruction Fuzzy Hash: AFD01723A18A86D1EE10EB04D8853E86330FBD0308FA04431D24CC25B5DF6EDA4AC745
                                                                                                                Function 00007FF6EC4E89FC Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 21COMMONLIBRARYCODE
                                                                                                                Download Yara Rule
                                                                                                                APIs
                                                                                                                • try_get_function.LIBVCRUNTIME ref: 00007FF6EC4E8A25
                                                                                                                • TlsSetValue.KERNEL32(?,?,00000000,00007FF6EC4E77AE,?,?,00000000,00007FF6EC4E6B85,?,?,?,?,00007FF6EC4C6CA8), ref: 00007FF6EC4E8A3C
                                                                                                                Strings
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 0000000C.00000002.2574093388.00007FF6EC4B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF6EC4B0000, based on PE: true
                                                                                                                • Associated: 0000000C.00000002.2574070380.00007FF6EC4B0000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                • Associated: 0000000C.00000002.2574132408.00007FF6EC504000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                • Associated: 0000000C.00000002.2574154940.00007FF6EC517000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                • Associated: 0000000C.00000002.2574176551.00007FF6EC51A000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_12_2_7ff6ec4b0000_tapinstall.jbxd
                                                                                                                Similarity
                                                                                                                • API ID: Valuetry_get_function
                                                                                                                • String ID: FlsSetValue
                                                                                                                • API String ID: 738293619-3750699315
                                                                                                                • Opcode ID: f6d5dd2663f4e630c5fdec50bbb7cd7a8c87450e82d038accba4aa9b3675ea98
                                                                                                                • Instruction ID: f0e77b9b6e40767db1a9424f53eba24252a4a9c7ba26ce0fba8db63820eaeac1
                                                                                                                • Opcode Fuzzy Hash: f6d5dd2663f4e630c5fdec50bbb7cd7a8c87450e82d038accba4aa9b3675ea98
                                                                                                                • Instruction Fuzzy Hash: 0CE06563A08743C5FF049B54F8022B82222AF88788F494136DD1DCA354EF3ED8A8C30A
                                                                                                                Function 00007FF6EC4BA544 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 21COMMONLIBRARYCODE
                                                                                                                Download Yara Rule
                                                                                                                APIs
                                                                                                                • try_get_function.LIBVCRUNTIME ref: 00007FF6EC4BA56D
                                                                                                                • TlsSetValue.KERNEL32(?,?,?,00007FF6EC4B9CC5,?,?,?,?,00007FF6EC4B91A4,?,?,?,?,00007FF6EC4B814B), ref: 00007FF6EC4BA584
                                                                                                                Strings
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 0000000C.00000002.2574093388.00007FF6EC4B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF6EC4B0000, based on PE: true
                                                                                                                • Associated: 0000000C.00000002.2574070380.00007FF6EC4B0000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                • Associated: 0000000C.00000002.2574132408.00007FF6EC504000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                • Associated: 0000000C.00000002.2574154940.00007FF6EC517000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                • Associated: 0000000C.00000002.2574176551.00007FF6EC51A000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_12_2_7ff6ec4b0000_tapinstall.jbxd
                                                                                                                Similarity
                                                                                                                • API ID: Valuetry_get_function
                                                                                                                • String ID: FlsSetValue
                                                                                                                • API String ID: 738293619-3750699315
                                                                                                                • Opcode ID: 620ae2d36bd9a72b075ae6d885032ef81b4224fd675c2c0689d5fc8c746a91d4
                                                                                                                • Instruction ID: 2593fe854acb711e3b0e6da38e6159eaa2883d66692fec6f805506d4abd22111
                                                                                                                • Opcode Fuzzy Hash: 620ae2d36bd9a72b075ae6d885032ef81b4224fd675c2c0689d5fc8c746a91d4
                                                                                                                • Instruction Fuzzy Hash: 64E03963A0864381EA056B50F4067BC2361AF88798F4A4032DD1DC6398DF3EEDA9C30A

                                                                                                                Execution Graph

                                                                                                                Execution Coverage:10.2%
                                                                                                                Dynamic/Decrypted Code Coverage:100%
                                                                                                                Signature Coverage:4.5%
                                                                                                                Total number of Nodes:66
                                                                                                                Total number of Limit Nodes:4
                                                                                                                execution_graph 67481 5e022c0 67482 5e022d2 67481->67482 67485 5e03241 67482->67485 67486 5e02339 67485->67486 67488 5e0324e 67485->67488 67487 5e03297 67488->67487 67494 5e03341 67488->67494 67498 5e03350 67488->67498 67489 5e032bc 67489->67487 67492 5e03587 Shell_NotifyIconW 67489->67492 67493 5e03598 Shell_NotifyIconW 67489->67493 67492->67487 67493->67487 67495 5e0334a 67494->67495 67502 5e02634 67495->67502 67499 5e03383 67498->67499 67500 5e02634 Shell_NotifyIconW 67499->67500 67501 5e0339e 67500->67501 67501->67501 67503 5e033f0 Shell_NotifyIconW 67502->67503 67505 5e034ef 67503->67505 67505->67505 67522 c40fe20 67524 c40fe44 67522->67524 67523 c40fe72 67523->67523 67524->67523 67527 bdc0007 67524->67527 67532 bdc0040 67524->67532 67528 bdc005c 67527->67528 67529 bdc007d 67527->67529 67537 bdc01f8 67528->67537 67541 bdc01ec 67528->67541 67529->67524 67533 bdc005c 67532->67533 67534 bdc007d 67532->67534 67535 bdc01ec LoadLibraryA 67533->67535 67536 bdc01f8 LoadLibraryA 67533->67536 67534->67524 67535->67534 67536->67534 67538 bdc024b LoadLibraryA 67537->67538 67540 bdc02de 67538->67540 67542 bdc024b LoadLibraryA 67541->67542 67544 bdc02de 67542->67544 67553 5e02d10 67554 5e02d5b CreateWindowExW 67553->67554 67556 5e02dc5 67554->67556 67461 cf23ce 67462 cf23cf 67461->67462 67463 cf24b1 67462->67463 67466 cf2a01 67462->67466 67470 cf2a08 67462->67470 67467 cf2a08 67466->67467 67473 cf1fd8 67467->67473 67471 cf1fd8 ConnectNamedPipe 67470->67471 67472 cf2a15 67471->67472 67472->67462 67474 cf2a48 ConnectNamedPipe 67473->67474 67476 cf2ae8 67474->67476 67506 cf239d 67507 cf23aa 67506->67507 67509 cf23b5 67506->67509 67510 cf2a08 ConnectNamedPipe 67507->67510 67511 cf2a01 ConnectNamedPipe 67507->67511 67508 cf24b1 67509->67508 67512 cf2a08 ConnectNamedPipe 67509->67512 67513 cf2a01 ConnectNamedPipe 67509->67513 67510->67509 67511->67509 67512->67509 67513->67509 67477 cf27c8 67478 cf2829 CreateNamedPipeA 67477->67478 67480 cf290b 67478->67480 67514 5e0b3b8 67515 5e0b3d7 67514->67515 67518 5e0ce1f 67515->67518 67519 5e0ce41 67518->67519 67520 5e03350 Shell_NotifyIconW 67519->67520 67521 5e0b432 67520->67521

                                                                                                                Executed Functions

                                                                                                                Function 0C409C98 Relevance: 1.7, Strings: 1, Instructions: 422COMMON
                                                                                                                Download Yara Rule

                                                                                                                Control-flow Graph

                                                                                                                • Executed
                                                                                                                • Not Executed
                                                                                                                control_flow_graph 1109 c409c98-c409cc1 1110 c409cc3 1109->1110 1111 c409cc6-c409cdf 1109->1111 1110->1111 1112 c409ce7-c409cf6 1111->1112 1114 c409d53-c409d62 1112->1114 1115 c409cf8-c409d07 1112->1115 1118 c409d64-c409d79 1114->1118 1119 c409d7b-c409d8e 1114->1119 1120 c409d09-c409d19 1115->1120 1121 c409d3c-c409d51 1115->1121 1127 c409d90-c409dce 1118->1127 1119->1127 1120->1121 1122 c409d1b-c409d3a 1120->1122 1121->1127 1122->1114 1122->1121 1130 c409dd0-c409dd8 1127->1130 1131 c409dda-c409de0 1127->1131 1132 c409de3-c409de5 1130->1132 1131->1132 1133 c409de7-c409dec 1132->1133 1134 c409dee-c409e13 1132->1134 1135 c409e2a-c409e2c 1133->1135 1152 c409e15-c409e25 1134->1152 1153 c409e27 1134->1153 1137 c409e74-c409e7b 1135->1137 1138 c409e2e-c409e32 1135->1138 1140 c409e81-c409e8b 1137->1140 1141 c40a0f3-c40a124 1137->1141 1138->1137 1139 c409e34-c409e5d 1138->1139 1146 c409e69-c409e6f 1139->1146 1147 c409e5f-c409e61 1139->1147 1149 c409f01-c409f08 1140->1149 1150 c409e8d-c409e91 1140->1150 1161 c40a130-c40a137 1141->1161 1162 c40a126-c40a128 1141->1162 1151 c40a1b3-c40a1ba 1146->1151 1147->1146 1156 c409f96-c409f9f 1149->1156 1157 c409f0e-c409f20 1149->1157 1154 c409e93-c409eaa 1150->1154 1155 c409eaf-c409efc 1150->1155 1152->1135 1153->1135 1154->1151 1155->1141 1159 c409fa1-c409fa7 1156->1159 1160 c409faa-c409ff0 1156->1160 1157->1156 1172 c409f22-c409f26 1157->1172 1159->1160 1160->1141 1205 c409ff6-c409ffa 1160->1205 1167 c40a139-c40a13d 1161->1167 1168 c40a13f-c40a145 1161->1168 1162->1161 1169 c40a14f-c40a153 1167->1169 1168->1169 1170 c40a147-c40a149 1168->1170 1175 c40a155-c40a15e 1169->1175 1176 c40a178-c40a182 1169->1176 1170->1169 1174 c40a14b 1170->1174 1178 c409f44-c409f91 1172->1178 1179 c409f28-c409f3f 1172->1179 1174->1169 1180 c40a160-c40a166 1175->1180 1181 c40a168-c40a16f 1175->1181 1189 c40a1a4-c40a1a8 1176->1189 1190 c40a184-c40a19b 1176->1190 1178->1141 1179->1151 1186 c40a172 1180->1186 1181->1186 1186->1176 1192 c40a1b1 1189->1192 1193 c40a1aa 1189->1193 1190->1189 1202 c40a19d 1190->1202 1192->1151 1193->1192 1202->1189 1206 c40a018-c40a01b 1205->1206 1207 c409ffc-c40a013 1205->1207 1208 c40a021-c40a0a4 1206->1208 1209 c40a0a6-c40a0e8 1206->1209 1207->1151 1208->1141 1209->1141
                                                                                                                Strings
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000016.00000002.4103457864.000000000C400000.00000040.00000800.00020000.00000000.sdmp, Offset: 0C400000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_22_2_c400000_FastestVPN.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID: @
                                                                                                                • API String ID: 0-2766056989
                                                                                                                • Opcode ID: 6810a1661c28644a4c7a3d13d95f18a45329ada052b03c54e7eb6935ef1d6fc0
                                                                                                                • Instruction ID: c5bd3bb25bb9aaa2a88eaf6b19b0f3514e0d7d496611567301eca2e9b678f7b8
                                                                                                                • Opcode Fuzzy Hash: 6810a1661c28644a4c7a3d13d95f18a45329ada052b03c54e7eb6935ef1d6fc0
                                                                                                                • Instruction Fuzzy Hash: A2024B30A00205DFDB19DFA4C594AAEBBB6FF89301F248479E5069B392DB35DD46CB90
                                                                                                                Function 00CF27C8 Relevance: 1.6, APIs: 1, Instructions: 121pipeCOMMON
                                                                                                                Download Yara Rule

                                                                                                                Control-flow Graph

                                                                                                                • Executed
                                                                                                                • Not Executed
                                                                                                                control_flow_graph 1255 cf27c8-cf2827 1256 cf287b-cf28a1 1255->1256 1257 cf2829-cf284e 1255->1257 1260 cf28a6-cf2909 CreateNamedPipeA 1256->1260 1261 cf28a3 1256->1261 1257->1256 1262 cf2850-cf2852 1257->1262 1268 cf290b-cf2911 1260->1268 1269 cf2912-cf2950 1260->1269 1261->1260 1263 cf2875-cf2878 1262->1263 1264 cf2854-cf285e 1262->1264 1263->1256 1266 cf2862-cf2871 1264->1266 1267 cf2860 1264->1267 1266->1266 1270 cf2873 1266->1270 1267->1266 1268->1269 1274 cf2952-cf2956 1269->1274 1275 cf2960 1269->1275 1270->1263 1274->1275 1276 cf2958-cf295b call cf19d0 1274->1276 1278 cf2961 1275->1278 1276->1275 1278->1278
                                                                                                                APIs
                                                                                                                • CreateNamedPipeA.KERNEL32(?,?,?,?,?,?,?,?), ref: 00CF28F9
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000016.00000002.4016306281.0000000000CF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00CF0000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_22_2_cf0000_FastestVPN.jbxd
                                                                                                                Similarity
                                                                                                                • API ID: CreateNamedPipe
                                                                                                                • String ID:
                                                                                                                • API String ID: 2489174969-0
                                                                                                                • Opcode ID: a1f23f1778f5b34f254d85b5f69d19d3a5578313bcd02e5442f2d25360c6f258
                                                                                                                • Instruction ID: a814c56157ef57fc90e0a8f1311bdfbecfed81f241e7345840b5377ca4bae49f
                                                                                                                • Opcode Fuzzy Hash: a1f23f1778f5b34f254d85b5f69d19d3a5578313bcd02e5442f2d25360c6f258
                                                                                                                • Instruction Fuzzy Hash: B55123B1D003599FDB50CFA9C884B9EBFF1BB08714F148129E918AB391D7B59940CF91
                                                                                                                Function 0C409360 Relevance: .6, Instructions: 617COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000016.00000002.4103457864.000000000C400000.00000040.00000800.00020000.00000000.sdmp, Offset: 0C400000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_22_2_c400000_FastestVPN.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: d2dcd19fa7734af18bdc04b51b777880126472b9aebb702bd34d53addf3c495a
                                                                                                                • Instruction ID: a65e2a57c1869bff1449f328114bf8eed735515f64dbe756ff47b246da630bb1
                                                                                                                • Opcode Fuzzy Hash: d2dcd19fa7734af18bdc04b51b777880126472b9aebb702bd34d53addf3c495a
                                                                                                                • Instruction Fuzzy Hash: 79325935B006048FDB15DF69C584AAEBBF2BF88310F2585A9E506DB3A2CB75ED41CB50
                                                                                                                Function 0C55E960 Relevance: .5, Instructions: 500COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000016.00000002.4104243718.000000000C550000.00000040.00000800.00020000.00000000.sdmp, Offset: 0C550000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_22_2_c550000_FastestVPN.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: a690c6a1978fe3a01c0933f1d53d53960df3786d655bfbc6c069b461083bdb8d
                                                                                                                • Instruction ID: e178d02eb7b251be5b6021ed733d14eaea4b683fe357c61338cba93a00ddc12a
                                                                                                                • Opcode Fuzzy Hash: a690c6a1978fe3a01c0933f1d53d53960df3786d655bfbc6c069b461083bdb8d
                                                                                                                • Instruction Fuzzy Hash: D1226134E1071ACFDB14DF78C85469DBBB1FF89300F1186AAD846AB351EB74AA85CB50
                                                                                                                Function 0AA40040 Relevance: 3.1, Instructions: 3074COMMON
                                                                                                                Download Yara Rule

                                                                                                                Control-flow Graph

                                                                                                                • Executed
                                                                                                                • Not Executed
                                                                                                                control_flow_graph 0 aa40040-aa4354f 696 aa43599-aa435a0 0->696 697 aa43551-aa43568 696->697 698 aa435a2-aa435a7 696->698 699 aa435a8-aa435da 697->699 700 aa4356a-aa43596 697->700 700->696
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000016.00000002.4082922941.000000000AA40000.00000040.00000800.00020000.00000000.sdmp, Offset: 0AA40000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_22_2_aa40000_FastestVPN.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: fe82ee49944c7b3c9b48469dc9dd8f995dd5a73900228f2a44049bd9cb591f33
                                                                                                                • Instruction ID: d95f36036fb0e07fb9d60fada64f318266d570c1f5e34633dac17a0c8967d9ea
                                                                                                                • Opcode Fuzzy Hash: fe82ee49944c7b3c9b48469dc9dd8f995dd5a73900228f2a44049bd9cb591f33
                                                                                                                • Instruction Fuzzy Hash: 24532B71A00618EFEB259BA0CC55BEE7B76FB88340F1050D9E6496B2D1CFB16E809F15
                                                                                                                Function 0AA4A110 Relevance: 2.9, Strings: 2, Instructions: 415COMMON
                                                                                                                Download Yara Rule

                                                                                                                Control-flow Graph

                                                                                                                • Executed
                                                                                                                • Not Executed
                                                                                                                control_flow_graph 705 aa4a110-aa4a155 709 aa4a157-aa4a16f 705->709 710 aa4a1b8-aa4a1ba 705->710 715 aa4a1b0-aa4a1b3 709->715 716 aa4a171-aa4a187 709->716 711 aa4a1cc 710->711 712 aa4a1bc-aa4a1ca 710->712 714 aa4a1ce-aa4a1d0 711->714 712->714 717 aa4a1d2-aa4a1ea 714->717 718 aa4a233-aa4a235 714->718 719 aa4a52e-aa4a53c 715->719 730 aa4a190-aa4a1ae 716->730 731 aa4a189 716->731 727 aa4a1ec-aa4a202 717->727 728 aa4a22b-aa4a22e 717->728 720 aa4a247 718->720 721 aa4a237-aa4a245 718->721 732 aa4a545-aa4a571 719->732 733 aa4a53e 719->733 724 aa4a249-aa4a24b 720->724 721->724 725 aa4a24d-aa4a265 724->725 726 aa4a2ae-aa4a2b0 724->726 742 aa4a2a6-aa4a2a9 725->742 743 aa4a267-aa4a27d 725->743 734 aa4a2c2 726->734 735 aa4a2b2-aa4a2c0 726->735 744 aa4a204 727->744 745 aa4a20b-aa4a229 727->745 728->719 730->715 731->730 765 aa4a5f7-aa4a60a 732->765 766 aa4a577-aa4a595 732->766 733->732 736 aa4a2c4-aa4a2c6 734->736 735->736 740 aa4a2c8-aa4a2e0 736->740 741 aa4a329-aa4a32b 736->741 757 aa4a321-aa4a324 740->757 758 aa4a2e2-aa4a2f8 740->758 747 aa4a33d 741->747 748 aa4a32d-aa4a33b 741->748 742->719 759 aa4a286-aa4a2a4 743->759 760 aa4a27f 743->760 744->745 745->728 750 aa4a33f-aa4a341 747->750 748->750 755 aa4a3a4-aa4a3a6 750->755 756 aa4a343-aa4a35b 750->756 761 aa4a3b8 755->761 762 aa4a3a8-aa4a3b6 755->762 774 aa4a39c-aa4a39f 756->774 775 aa4a35d-aa4a373 756->775 757->719 776 aa4a301-aa4a31f 758->776 777 aa4a2fa 758->777 759->742 760->759 767 aa4a3ba-aa4a3bc 761->767 762->767 771 aa4a611-aa4a615 765->771 796 aa4a597-aa4a5d2 766->796 797 aa4a60c 766->797 772 aa4a3be-aa4a3d6 767->772 773 aa4a41f-aa4a421 767->773 781 aa4a617 771->781 782 aa4a620-aa4a621 771->782 791 aa4a417-aa4a41a 772->791 792 aa4a3d8-aa4a3ee 772->792 779 aa4a433 773->779 780 aa4a423-aa4a431 773->780 774->719 794 aa4a375 775->794 795 aa4a37c-aa4a39a 775->795 776->757 777->776 784 aa4a435-aa4a437 779->784 780->784 781->782 801 aa4a640-aa4a6b8 782->801 789 aa4a439-aa4a451 784->789 790 aa4a49a-aa4a49c 784->790 809 aa4a492-aa4a495 789->809 810 aa4a453-aa4a469 789->810 798 aa4a4ae 790->798 799 aa4a49e-aa4a4ac 790->799 791->719 811 aa4a3f7-aa4a415 792->811 812 aa4a3f0 792->812 794->795 795->774 846 aa4a5d5 call aa4a748 796->846 847 aa4a5d5 call aa4a758 796->847 797->771 802 aa4a4b0-aa4a4b2 798->802 799->802 807 aa4a4b4-aa4a4b6 802->807 808 aa4a4d2-aa4a4ea 802->808 815 aa4a4c8 807->815 816 aa4a4b8-aa4a4c6 807->816 822 aa4a4ec-aa4a502 808->822 823 aa4a52b 808->823 809->719 825 aa4a472-aa4a490 810->825 826 aa4a46b 810->826 811->791 812->811 820 aa4a4ca-aa4a4cc 815->820 816->820 820->801 820->808 832 aa4a504 822->832 833 aa4a50b-aa4a529 822->833 823->719 825->809 826->825 832->833 833->823 834 aa4a5d7-aa4a5f5 834->765 834->766 846->834 847->834
                                                                                                                Strings
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000016.00000002.4082922941.000000000AA40000.00000040.00000800.00020000.00000000.sdmp, Offset: 0AA40000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_22_2_aa40000_FastestVPN.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID: $hOh^
                                                                                                                • API String ID: 0-436425367
                                                                                                                • Opcode ID: 25db08858e6d3bd7dcd044248d5518174eed3dfe5df7dd12a49a30a214c2f2d0
                                                                                                                • Instruction ID: 4a767d88664251c9857e03ff19fa5440857457ba1b5f989629f02ca242ca5f81
                                                                                                                • Opcode Fuzzy Hash: 25db08858e6d3bd7dcd044248d5518174eed3dfe5df7dd12a49a30a214c2f2d0
                                                                                                                • Instruction Fuzzy Hash: 33E16C70B50A168BDB15DB68D55069FBBE2EFC4380F148529E916DB398EF74DC028F84
                                                                                                                Function 0C556DB0 Relevance: 1.8, Strings: 1, Instructions: 534COMMON
                                                                                                                Download Yara Rule

                                                                                                                Control-flow Graph

                                                                                                                • Executed
                                                                                                                • Not Executed
                                                                                                                control_flow_graph 993 c556db0-c556dc2 994 c556dc4-c556de5 993->994 995 c556dec-c556df0 993->995 994->995 996 c556df2-c556df4 995->996 997 c556dfc-c556e0b 995->997 996->997 999 c556e17-c556e43 997->999 1000 c556e0d 997->1000 1003 c557064-c5570af 999->1003 1004 c556e49-c556e4f 999->1004 1000->999 1033 c5570c5-c5570d1 1003->1033 1034 c5570b1 1003->1034 1005 c556e55-c556e5b 1004->1005 1006 c556f18-c556f1c 1004->1006 1005->1003 1009 c556e61-c556e70 1005->1009 1010 c556f41-c556f4a 1006->1010 1011 c556f1e-c556f27 1006->1011 1014 c556ef7-c556f00 1009->1014 1015 c556e76-c556e82 1009->1015 1012 c556f4c-c556f58 1010->1012 1013 c556f6f-c556f72 1010->1013 1011->1003 1016 c556f2d-c556f3f 1011->1016 1027 c556f60-c556f6c 1012->1027 1019 c556f75-c556f7b 1013->1019 1014->1003 1020 c556f06-c556f12 1014->1020 1015->1003 1018 c556e88-c556e9f 1015->1018 1016->1019 1022 c556ea1 1018->1022 1023 c556eab-c556ebd 1018->1023 1019->1003 1024 c556f81-c556f96 1019->1024 1020->1005 1020->1006 1022->1023 1023->1014 1031 c556ebf-c556ec5 1023->1031 1024->1003 1026 c556f9c-c556fae 1024->1026 1026->1003 1029 c556fb4-c556fc1 1026->1029 1027->1013 1029->1003 1032 c556fc7-c556fde 1029->1032 1035 c556ec7 1031->1035 1036 c556ed1-c556ed7 1031->1036 1032->1003 1044 c556fe4-c556ffc 1032->1044 1038 c5570d3 1033->1038 1039 c5570dd-c5570f9 1033->1039 1037 c5570b4-c5570b6 1034->1037 1035->1036 1036->1003 1041 c556edd-c556ef4 1036->1041 1042 c5570b8-c5570c3 1037->1042 1043 c5570fa-c557137 1037->1043 1038->1039 1042->1033 1042->1037 1054 c557153-c55715f 1043->1054 1055 c557139-c55713c 1043->1055 1044->1003 1045 c556ffe-c557009 1044->1045 1048 c55700b-c557015 1045->1048 1049 c55705a-c557061 1045->1049 1048->1049 1053 c557017-c55702d 1048->1053 1060 c55702f 1053->1060 1061 c557039-c557052 1053->1061 1057 c557161 1054->1057 1058 c55716b-c557190 1054->1058 1056 c55713f-c557151 1055->1056 1056->1054 1056->1056 1057->1058 1065 c557204-c55720a 1058->1065 1066 c557192-c557198 1058->1066 1060->1061 1061->1049 1069 c557257-c557271 1065->1069 1070 c55720c-c55720f 1065->1070 1066->1065 1067 c55719a-c55719d 1066->1067 1071 c557274-c557280 1067->1071 1072 c5571a3-c5571b0 1067->1072 1070->1071 1073 c557211-c55721e 1070->1073 1084 c5572a2-c5572b0 1071->1084 1085 c557282-c55728f 1071->1085 1075 c5571b2-c5571dc 1072->1075 1076 c5571fe-c557202 1072->1076 1077 c557251-c557255 1073->1077 1078 c557220-c557238 1073->1078 1079 c5571de 1075->1079 1080 c5571e8-c5571fb 1075->1080 1076->1065 1076->1067 1077->1069 1077->1070 1078->1071 1082 c55723a-c55724d 1078->1082 1079->1080 1080->1076 1082->1077 1087 c5572d5-c5572e6 1084->1087 1088 c5572b2-c5572d4 1084->1088 1085->1084 1090 c5572f6-c557302 1087->1090 1091 c5572e8-c5572f5 1087->1091 1088->1087 1093 c557304-c557327 1090->1093 1094 c557328-c557332 1090->1094 1097 c5573a4-c5573b3 1094->1097 1098 c557334-c55734a 1094->1098 1098->1097 1102 c55734c-c5573a3 1098->1102
                                                                                                                Strings
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000016.00000002.4104243718.000000000C550000.00000040.00000800.00020000.00000000.sdmp, Offset: 0C550000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_22_2_c550000_FastestVPN.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID: d
                                                                                                                • API String ID: 0-2564639436
                                                                                                                • Opcode ID: 56225f6dfe7803958ffc12b930296505d36afd084af63f8601c33efdc69c44db
                                                                                                                • Instruction ID: 7a94cd1918428777e0e036282c74562185604280e19ee2ebf16a0ee0ce9c14b6
                                                                                                                • Opcode Fuzzy Hash: 56225f6dfe7803958ffc12b930296505d36afd084af63f8601c33efdc69c44db
                                                                                                                • Instruction Fuzzy Hash: 1E128E34700605CFDB10CF59C494A6ABBF2FF88354B2586AAE959DB361DB30E946CB90
                                                                                                                Function 00CF27BD Relevance: 1.6, APIs: 1, Instructions: 124pipeCOMMON
                                                                                                                Download Yara Rule

                                                                                                                Control-flow Graph

                                                                                                                • Executed
                                                                                                                • Not Executed
                                                                                                                control_flow_graph 1230 cf27bd-cf2827 1232 cf287b-cf28a1 1230->1232 1233 cf2829-cf284e 1230->1233 1236 cf28a6-cf2909 CreateNamedPipeA 1232->1236 1237 cf28a3 1232->1237 1233->1232 1238 cf2850-cf2852 1233->1238 1244 cf290b-cf2911 1236->1244 1245 cf2912-cf2950 1236->1245 1237->1236 1239 cf2875-cf2878 1238->1239 1240 cf2854-cf285e 1238->1240 1239->1232 1242 cf2862-cf2871 1240->1242 1243 cf2860 1240->1243 1242->1242 1246 cf2873 1242->1246 1243->1242 1244->1245 1250 cf2952-cf2956 1245->1250 1251 cf2960 1245->1251 1246->1239 1250->1251 1252 cf2958-cf295b call cf19d0 1250->1252 1254 cf2961 1251->1254 1252->1251 1254->1254
                                                                                                                APIs
                                                                                                                • CreateNamedPipeA.KERNEL32(?,?,?,?,?,?,?,?), ref: 00CF28F9
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000016.00000002.4016306281.0000000000CF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00CF0000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_22_2_cf0000_FastestVPN.jbxd
                                                                                                                Similarity
                                                                                                                • API ID: CreateNamedPipe
                                                                                                                • String ID:
                                                                                                                • API String ID: 2489174969-0
                                                                                                                • Opcode ID: ffa4042969fed9c1975e8cd2addee34989f04db4fedcca0b7dbe0689844ee676
                                                                                                                • Instruction ID: dcb944fbcad843e4e446ae3e8fd2937c219e7cecd86e2e00479b85131874a017
                                                                                                                • Opcode Fuzzy Hash: ffa4042969fed9c1975e8cd2addee34989f04db4fedcca0b7dbe0689844ee676
                                                                                                                • Instruction Fuzzy Hash: E35134B1D003599FDB50CFA9C884B9EBFF1FB48310F148129E928AB291D7B59941CF81
                                                                                                                Function 05E033DD Relevance: 1.6, APIs: 1, Instructions: 105windowCOMMON
                                                                                                                Download Yara Rule

                                                                                                                Control-flow Graph

                                                                                                                • Executed
                                                                                                                • Not Executed
                                                                                                                control_flow_graph 1279 5e033dd-5e03494 1282 5e0349c-5e034ed Shell_NotifyIconW 1279->1282 1283 5e034f6-5e03538 1282->1283 1284 5e034ef-5e034f5 1282->1284 1287 5e0354a-5e03551 1283->1287 1288 5e0353a-5e03540 1283->1288 1284->1283 1289 5e03553-5e03562 1287->1289 1290 5e03568 1287->1290 1288->1287 1289->1290 1292 5e03569 1290->1292 1292->1292
                                                                                                                APIs
                                                                                                                • Shell_NotifyIconW.SHELL32(?,-00000428), ref: 05E034DA
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000016.00000002.4067761578.0000000005E00000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E00000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_22_2_5e00000_FastestVPN.jbxd
                                                                                                                Similarity
                                                                                                                • API ID: IconNotifyShell_
                                                                                                                • String ID:
                                                                                                                • API String ID: 1144537725-0
                                                                                                                • Opcode ID: 332874e81e13178536530ddf5dd6ac38323bef3bfb911f50d8b39d4bbfebedab
                                                                                                                • Instruction ID: 613825290e6690a1857431c40e835cdfc4d9fdd722594043b5086438c927c6f5
                                                                                                                • Opcode Fuzzy Hash: 332874e81e13178536530ddf5dd6ac38323bef3bfb911f50d8b39d4bbfebedab
                                                                                                                • Instruction Fuzzy Hash: 394113B0D053698FDB20CF69C9847DDBBF4AB48208F5090DAD64CA7251D7745A88CF19
                                                                                                                Function 05E02634 Relevance: 1.6, APIs: 1, Instructions: 100windowCOMMON
                                                                                                                Download Yara Rule

                                                                                                                Control-flow Graph

                                                                                                                • Executed
                                                                                                                • Not Executed
                                                                                                                control_flow_graph 1293 5e02634-5e034ed Shell_NotifyIconW 1297 5e034f6-5e03538 1293->1297 1298 5e034ef-5e034f5 1293->1298 1301 5e0354a-5e03551 1297->1301 1302 5e0353a-5e03540 1297->1302 1298->1297 1303 5e03553-5e03562 1301->1303 1304 5e03568 1301->1304 1302->1301 1303->1304 1306 5e03569 1304->1306 1306->1306
                                                                                                                APIs
                                                                                                                • Shell_NotifyIconW.SHELL32(?,-00000428), ref: 05E034DA
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000016.00000002.4067761578.0000000005E00000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E00000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_22_2_5e00000_FastestVPN.jbxd
                                                                                                                Similarity
                                                                                                                • API ID: IconNotifyShell_
                                                                                                                • String ID:
                                                                                                                • API String ID: 1144537725-0
                                                                                                                • Opcode ID: 14fa89cd6b3744846bb36ba1adb5784dcea79a8004207a4cd5367808e9049c00
                                                                                                                • Instruction ID: 237ed1a05794f67371f2e086b2872e4aa08dd9e66291700a9c9b2d91f10def7a
                                                                                                                • Opcode Fuzzy Hash: 14fa89cd6b3744846bb36ba1adb5784dcea79a8004207a4cd5367808e9049c00
                                                                                                                • Instruction Fuzzy Hash: F941F5B0D012288FDB60CF59C9847DDFBF8AB48304F9090D9D64CA7251D7745A88CF59
                                                                                                                Function 0BDC01EC Relevance: 1.6, APIs: 1, Instructions: 93libraryCOMMON
                                                                                                                Download Yara Rule

                                                                                                                Control-flow Graph

                                                                                                                • Executed
                                                                                                                • Not Executed
                                                                                                                control_flow_graph 1307 bdc01ec-bdc0257 1309 bdc0259-bdc0263 1307->1309 1310 bdc0290-bdc02dc LoadLibraryA 1307->1310 1309->1310 1311 bdc0265-bdc0267 1309->1311 1317 bdc02de-bdc02e4 1310->1317 1318 bdc02e5-bdc031d 1310->1318 1313 bdc0269-bdc0273 1311->1313 1314 bdc028a-bdc028d 1311->1314 1315 bdc0275 1313->1315 1316 bdc0277-bdc0286 1313->1316 1314->1310 1315->1316 1316->1316 1319 bdc0288 1316->1319 1317->1318 1323 bdc032d 1318->1323 1324 bdc031f-bdc0323 1318->1324 1319->1314 1326 bdc032e 1323->1326 1324->1323 1325 bdc0325 1324->1325 1325->1323 1326->1326
                                                                                                                APIs
                                                                                                                • LoadLibraryA.KERNELBASE(?), ref: 0BDC02CC
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000016.00000002.4100677275.000000000BDC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0BDC0000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_22_2_bdc0000_FastestVPN.jbxd
                                                                                                                Similarity
                                                                                                                • API ID: LibraryLoad
                                                                                                                • String ID:
                                                                                                                • API String ID: 1029625771-0
                                                                                                                • Opcode ID: dc266915cfdaff4b4f47018668fdb87db834dbe2fb40eeed18a8c43eee6d45d0
                                                                                                                • Instruction ID: 8e3bf9f2a3f7f29c8bcfc5d446ab621074690b96a6df0486ef1e5388f4299fd6
                                                                                                                • Opcode Fuzzy Hash: dc266915cfdaff4b4f47018668fdb87db834dbe2fb40eeed18a8c43eee6d45d0
                                                                                                                • Instruction Fuzzy Hash: 304153B0C1065ACFDB21CFA9C88579EFBF1BB48324F14862AE814A7244D7B49845CF91
                                                                                                                Function 0BDC01F8 Relevance: 1.6, APIs: 1, Instructions: 91libraryCOMMON
                                                                                                                Download Yara Rule

                                                                                                                Control-flow Graph

                                                                                                                • Executed
                                                                                                                • Not Executed
                                                                                                                control_flow_graph 1872 bdc01f8-bdc0257 1874 bdc0259-bdc0263 1872->1874 1875 bdc0290-bdc02dc LoadLibraryA 1872->1875 1874->1875 1876 bdc0265-bdc0267 1874->1876 1882 bdc02de-bdc02e4 1875->1882 1883 bdc02e5-bdc031d 1875->1883 1878 bdc0269-bdc0273 1876->1878 1879 bdc028a-bdc028d 1876->1879 1880 bdc0275 1878->1880 1881 bdc0277-bdc0286 1878->1881 1879->1875 1880->1881 1881->1881 1884 bdc0288 1881->1884 1882->1883 1888 bdc032d 1883->1888 1889 bdc031f-bdc0323 1883->1889 1884->1879 1891 bdc032e 1888->1891 1889->1888 1890 bdc0325 1889->1890 1890->1888 1891->1891
                                                                                                                APIs
                                                                                                                • LoadLibraryA.KERNELBASE(?), ref: 0BDC02CC
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000016.00000002.4100677275.000000000BDC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0BDC0000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_22_2_bdc0000_FastestVPN.jbxd
                                                                                                                Similarity
                                                                                                                • API ID: LibraryLoad
                                                                                                                • String ID:
                                                                                                                • API String ID: 1029625771-0
                                                                                                                • Opcode ID: 37c45de5b0b6287dc0da981ff1740b1e344dfce24869655268503aef6931bf86
                                                                                                                • Instruction ID: aeb971a09d90e131302b22b4287c70f7a7279485fa73362a9ed50372224ffe08
                                                                                                                • Opcode Fuzzy Hash: 37c45de5b0b6287dc0da981ff1740b1e344dfce24869655268503aef6931bf86
                                                                                                                • Instruction Fuzzy Hash: 913130B0D1065ACFDB21CFA9C885B9EFBF1AB48724F14852AE814A7340D7B99845CF91
                                                                                                                Function 05E02D08 Relevance: 1.6, APIs: 1, Instructions: 74COMMON
                                                                                                                Download Yara Rule

                                                                                                                Control-flow Graph

                                                                                                                • Executed
                                                                                                                • Not Executed
                                                                                                                control_flow_graph 1892 5e02d08-5e02d5f 1894 5e02d61-5e02d64 1892->1894 1895 5e02d67-5e02d6d 1892->1895 1894->1895 1896 5e02d7b-5e02dc3 CreateWindowExW 1895->1896 1897 5e02d6f-5e02d78 1895->1897 1898 5e02dc5-5e02dcb 1896->1898 1899 5e02dcc-5e02de9 1896->1899 1897->1896 1898->1899
                                                                                                                APIs
                                                                                                                • CreateWindowExW.USER32(?,00000000,00000000,?,?,00000000,?,?,?,?,?,?), ref: 05E02DB6
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000016.00000002.4067761578.0000000005E00000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E00000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_22_2_5e00000_FastestVPN.jbxd
                                                                                                                Similarity
                                                                                                                • API ID: CreateWindow
                                                                                                                • String ID:
                                                                                                                • API String ID: 716092398-0
                                                                                                                • Opcode ID: 0b51bdf709d92e0305f7c36da88c15b34acb20b05142b23ad4fa9016db143a99
                                                                                                                • Instruction ID: 25de1c9938c649b853134e9ab0803fab2edbf7baa0c29e6ce8af7a837be2535e
                                                                                                                • Opcode Fuzzy Hash: 0b51bdf709d92e0305f7c36da88c15b34acb20b05142b23ad4fa9016db143a99
                                                                                                                • Instruction Fuzzy Hash: 8E3105B690021A9FCF01CF99D844ADEBBF5FF08714F11821AEA18A3250C3759965CF90
                                                                                                                Function 05E02D10 Relevance: 1.6, APIs: 1, Instructions: 73COMMON
                                                                                                                Download Yara Rule

                                                                                                                Control-flow Graph

                                                                                                                • Executed
                                                                                                                • Not Executed
                                                                                                                control_flow_graph 1916 5e02d10-5e02d5f 1918 5e02d61-5e02d64 1916->1918 1919 5e02d67-5e02d6d 1916->1919 1918->1919 1920 5e02d7b-5e02dc3 CreateWindowExW 1919->1920 1921 5e02d6f-5e02d78 1919->1921 1922 5e02dc5-5e02dcb 1920->1922 1923 5e02dcc-5e02de9 1920->1923 1921->1920 1922->1923
                                                                                                                APIs
                                                                                                                • CreateWindowExW.USER32(?,00000000,00000000,?,?,00000000,?,?,?,?,?,?), ref: 05E02DB6
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000016.00000002.4067761578.0000000005E00000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E00000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_22_2_5e00000_FastestVPN.jbxd
                                                                                                                Similarity
                                                                                                                • API ID: CreateWindow
                                                                                                                • String ID:
                                                                                                                • API String ID: 716092398-0
                                                                                                                • Opcode ID: 9e59705632c6bce9064d4ab0f7336e805d8bb431e93dacda4cd2bb83ce52afd2
                                                                                                                • Instruction ID: 7d2b8d510767c2de2e2a15ed4e5a337b23955d7702ddc0a2758ed94f27c5bab3
                                                                                                                • Opcode Fuzzy Hash: 9e59705632c6bce9064d4ab0f7336e805d8bb431e93dacda4cd2bb83ce52afd2
                                                                                                                • Instruction Fuzzy Hash: 883108B6800219AFCF11CF99C844ADEFBB4FF0C314F118119EA18A7250C375A955CF90
                                                                                                                Function 00CF1FD8 Relevance: 1.6, APIs: 1, Instructions: 73pipeCOMMON
                                                                                                                Download Yara Rule

                                                                                                                Control-flow Graph

                                                                                                                • Executed
                                                                                                                • Not Executed
                                                                                                                control_flow_graph 1902 cf1fd8-cf2ae6 ConnectNamedPipe 1905 cf2aef-cf2b37 1902->1905 1906 cf2ae8-cf2aee 1902->1906 1911 cf2b39-cf2b3d 1905->1911 1912 cf2b47 1905->1912 1906->1905 1911->1912 1913 cf2b3f-cf2b42 call cf19e8 1911->1913 1914 cf2b48 1912->1914 1913->1912 1914->1914
                                                                                                                APIs
                                                                                                                • ConnectNamedPipe.KERNEL32(?,?), ref: 00CF2AD6
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000016.00000002.4016306281.0000000000CF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00CF0000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_22_2_cf0000_FastestVPN.jbxd
                                                                                                                Similarity
                                                                                                                • API ID: ConnectNamedPipe
                                                                                                                • String ID:
                                                                                                                • API String ID: 2191148154-0
                                                                                                                • Opcode ID: 52b990d4e4521264c5607a387042a93d38bf2e985ce24f6ae3526b9bd94175d7
                                                                                                                • Instruction ID: 95ad3f867200a45cd40edde38a53af6e0fe4d38a5f54c52098b8bd35089c6707
                                                                                                                • Opcode Fuzzy Hash: 52b990d4e4521264c5607a387042a93d38bf2e985ce24f6ae3526b9bd94175d7
                                                                                                                • Instruction Fuzzy Hash: D93102B0D0121CDFDB64CF99C589BAEBBF0BB08314F208019E505BB350C7B59944CB52
                                                                                                                Function 00CF2A3D Relevance: 1.6, APIs: 1, Instructions: 71pipeCOMMON
                                                                                                                Download Yara Rule

                                                                                                                Control-flow Graph

                                                                                                                • Executed
                                                                                                                • Not Executed
                                                                                                                control_flow_graph 1926 cf2a3d-cf2ae6 ConnectNamedPipe 1930 cf2aef-cf2b37 1926->1930 1931 cf2ae8-cf2aee 1926->1931 1936 cf2b39-cf2b3d 1930->1936 1937 cf2b47 1930->1937 1931->1930 1936->1937 1938 cf2b3f-cf2b42 call cf19e8 1936->1938 1939 cf2b48 1937->1939 1938->1937 1939->1939
                                                                                                                APIs
                                                                                                                • ConnectNamedPipe.KERNEL32(?,?), ref: 00CF2AD6
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000016.00000002.4016306281.0000000000CF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00CF0000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_22_2_cf0000_FastestVPN.jbxd
                                                                                                                Similarity
                                                                                                                • API ID: ConnectNamedPipe
                                                                                                                • String ID:
                                                                                                                • API String ID: 2191148154-0
                                                                                                                • Opcode ID: 209b4689ec3abdc5cd8bd1f034e6d6db09dece18389e19e36322244c39410047
                                                                                                                • Instruction ID: 773406f3b55a4e806f1824e3b6c12f04892f6551a77040e8d062d7725157e9e8
                                                                                                                • Opcode Fuzzy Hash: 209b4689ec3abdc5cd8bd1f034e6d6db09dece18389e19e36322244c39410047
                                                                                                                • Instruction Fuzzy Hash: 9731F1B0D01218DFDB64CF99C589BAEBBF1BF48314F248019E545BB390C7B59944CBA2
                                                                                                                Function 0AA459C9 Relevance: 1.5, Strings: 1, Instructions: 283COMMON
                                                                                                                Download Yara Rule
                                                                                                                Strings
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000016.00000002.4082922941.000000000AA40000.00000040.00000800.00020000.00000000.sdmp, Offset: 0AA40000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_22_2_aa40000_FastestVPN.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID: d
                                                                                                                • API String ID: 0-2564639436
                                                                                                                • Opcode ID: b330c0fbb7251d873a0be780866fac80de007158a30d2583ca092e9f81128045
                                                                                                                • Instruction ID: 394b87423ad2884be115455875f0b8ef868245ab0111b266afda5536526b5a82
                                                                                                                • Opcode Fuzzy Hash: b330c0fbb7251d873a0be780866fac80de007158a30d2583ca092e9f81128045
                                                                                                                • Instruction Fuzzy Hash: F1C13A35A00602DFCB25CF19C5849AABBF2FFC9310B55CA59E55A9B6A1D730FC46CB80
                                                                                                                Function 0C409C88 Relevance: 1.4, Strings: 1, Instructions: 134COMMON
                                                                                                                Download Yara Rule
                                                                                                                Strings
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000016.00000002.4103457864.000000000C400000.00000040.00000800.00020000.00000000.sdmp, Offset: 0C400000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_22_2_c400000_FastestVPN.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID: @
                                                                                                                • API String ID: 0-2766056989
                                                                                                                • Opcode ID: bf0f09bad4a4cffcc1b1ac01a59ffd578b125196b414ff214a16d2139e8c7b70
                                                                                                                • Instruction ID: 6a893077ce64d0d5eb6527666dac62ffd39a70961dee5c2389d9d14617ab78dd
                                                                                                                • Opcode Fuzzy Hash: bf0f09bad4a4cffcc1b1ac01a59ffd578b125196b414ff214a16d2139e8c7b70
                                                                                                                • Instruction Fuzzy Hash: 1D519D71A402459FDB11CF64C440EAEBFF2BF99201F298166E905AB3A2C734DD41CBA0
                                                                                                                Function 0AA4A0FF Relevance: 1.4, Strings: 1, Instructions: 126COMMON
                                                                                                                Download Yara Rule
                                                                                                                Strings
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000016.00000002.4082922941.000000000AA40000.00000040.00000800.00020000.00000000.sdmp, Offset: 0AA40000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_22_2_aa40000_FastestVPN.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID: 0-65463447
                                                                                                                • Opcode ID: e41f6ddc9a0849f39a4fd4a95952f249c7a893e9a5c8d39825dcc582c7adb837
                                                                                                                • Instruction ID: 8591b8c5894c4467533ad3701fcd911ae8daae20ac56911be206660d692eacad
                                                                                                                • Opcode Fuzzy Hash: e41f6ddc9a0849f39a4fd4a95952f249c7a893e9a5c8d39825dcc582c7adb837
                                                                                                                • Instruction Fuzzy Hash: DE414C70A106059FDB15DF68D994AAEBBF2EFC8340F14852DE516AB3A1DF74AD01CB80
                                                                                                                Function 0C55CD4B Relevance: 1.3, Strings: 1, Instructions: 41COMMON
                                                                                                                Download Yara Rule
                                                                                                                Strings
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000016.00000002.4104243718.000000000C550000.00000040.00000800.00020000.00000000.sdmp, Offset: 0C550000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_22_2_c550000_FastestVPN.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID: 6
                                                                                                                • API String ID: 0-3045116330
                                                                                                                • Opcode ID: f576602e6e555a1e4394aec9ba19193a3fae96d7f159abbc143c5dfaf100ed75
                                                                                                                • Instruction ID: 2615ae601837162ad84d6504ea64a4dbbc2246672ce69cf41d76c4940a0c6ea1
                                                                                                                • Opcode Fuzzy Hash: f576602e6e555a1e4394aec9ba19193a3fae96d7f159abbc143c5dfaf100ed75
                                                                                                                • Instruction Fuzzy Hash: CA01AD3A7003108BCB01AB5DE89136E77A3EBC8350F20C51AEA029B344DBB0BD0687D0
                                                                                                                Function 0C55CCCA Relevance: 1.3, Strings: 1, Instructions: 40COMMON
                                                                                                                Download Yara Rule
                                                                                                                Strings
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000016.00000002.4104243718.000000000C550000.00000040.00000800.00020000.00000000.sdmp, Offset: 0C550000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_22_2_c550000_FastestVPN.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID: 6
                                                                                                                • API String ID: 0-3045116330
                                                                                                                • Opcode ID: 0735a638bd872dbcdb3336a1aed59294ce0a22f40360141f08af6f4786a22d49
                                                                                                                • Instruction ID: ba3c3d5a9f2ff86c3eb1400f2864a4a5942eac0889e6548c67cf43a901ebc78c
                                                                                                                • Opcode Fuzzy Hash: 0735a638bd872dbcdb3336a1aed59294ce0a22f40360141f08af6f4786a22d49
                                                                                                                • Instruction Fuzzy Hash: 90F0A43A7003144BCB15A75DE85126E77A3FBC8760F14C51ADA029B344DFB0BD0687D0
                                                                                                                Function 0C555C6A Relevance: .9, Instructions: 895COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000016.00000002.4104243718.000000000C550000.00000040.00000800.00020000.00000000.sdmp, Offset: 0C550000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_22_2_c550000_FastestVPN.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: eedde06c9437560bf671737154af544ddc33acc99440ac3f7b91850d02051bbb
                                                                                                                • Instruction ID: 0d0fbb40f26d1ad61a517fec93ab9d85219714b5e852111ae65b18f8d0331160
                                                                                                                • Opcode Fuzzy Hash: eedde06c9437560bf671737154af544ddc33acc99440ac3f7b91850d02051bbb
                                                                                                                • Instruction Fuzzy Hash: A1A2F734A00218DFDB659F64C854AEEBBB6FF89300F1055EAD60A6B250DF719E85CF81
                                                                                                                Function 0C555CA8 Relevance: .9, Instructions: 867COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000016.00000002.4104243718.000000000C550000.00000040.00000800.00020000.00000000.sdmp, Offset: 0C550000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_22_2_c550000_FastestVPN.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: 3bc43473074139726e6b59b4f3b59a4d42cf3a12712114338bc98679d457d43d
                                                                                                                • Instruction ID: c874c6c6fbc5c4588fefe493b02b8d1e8c08a950b758876fbc3dfe9cd71d769b
                                                                                                                • Opcode Fuzzy Hash: 3bc43473074139726e6b59b4f3b59a4d42cf3a12712114338bc98679d457d43d
                                                                                                                • Instruction Fuzzy Hash: 3492E534A00218DFDB659F64C854AEEBBB6FF89300F1055E9D60A6B260DF719E81DF81
                                                                                                                Function 0AA448B2 Relevance: .5, Instructions: 496COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000016.00000002.4082922941.000000000AA40000.00000040.00000800.00020000.00000000.sdmp, Offset: 0AA40000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_22_2_aa40000_FastestVPN.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: 9da83072714611b8d0b1b37f49c5604b93b2d6413b0b5ec36c524780ff04fee7
                                                                                                                • Instruction ID: 8f9f6dbd7c1d68dff8b5fac017229a41dabeb5e779bcf1b00a256e6b3dbba221
                                                                                                                • Opcode Fuzzy Hash: 9da83072714611b8d0b1b37f49c5604b93b2d6413b0b5ec36c524780ff04fee7
                                                                                                                • Instruction Fuzzy Hash: 96122574700645CFDB14DF39C488AAABBF6BF89304B1584A9E906DB3A2DB71EC45CB50
                                                                                                                Function 0AA43F50 Relevance: .4, Instructions: 401COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000016.00000002.4082922941.000000000AA40000.00000040.00000800.00020000.00000000.sdmp, Offset: 0AA40000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_22_2_aa40000_FastestVPN.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: 944be244a67cef57e028f5c902360a4e74222773a62d882e9af803c989a47827
                                                                                                                • Instruction ID: fb85eec26b6eec016dd61d18fa4bffa8e70c3aad8629a6b71bf88881cfeca615
                                                                                                                • Opcode Fuzzy Hash: 944be244a67cef57e028f5c902360a4e74222773a62d882e9af803c989a47827
                                                                                                                • Instruction Fuzzy Hash: 78F11A34B102058FCB54DF69C894AAEBBF6BFCD610B158169E906EB3A5DB71DC01CB90
                                                                                                                Function 0AA4BB08 Relevance: .4, Instructions: 399COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000016.00000002.4082922941.000000000AA40000.00000040.00000800.00020000.00000000.sdmp, Offset: 0AA40000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_22_2_aa40000_FastestVPN.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: 65d55a136e185d003193d28a82e7415d2b8043ce94a92ad101ce17940e6d59ac
                                                                                                                • Instruction ID: f83d5a391f8601536a5b02e46303a2cba1658375055fd18b7b90b4cebfce130a
                                                                                                                • Opcode Fuzzy Hash: 65d55a136e185d003193d28a82e7415d2b8043ce94a92ad101ce17940e6d59ac
                                                                                                                • Instruction Fuzzy Hash: 8EF12875704600CFDB55DF2AC489AAABBF6FF85210F1984AAE546CB3A1CB74EC01CB51
                                                                                                                Function 0C5581A8 Relevance: .4, Instructions: 395COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000016.00000002.4104243718.000000000C550000.00000040.00000800.00020000.00000000.sdmp, Offset: 0C550000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_22_2_c550000_FastestVPN.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: abcf339b5d3ea00258f2fc81598d0fec985e4e8f11272172846ab0e7c0f615d2
                                                                                                                • Instruction ID: e4a135751049933457128da3d53bb6081b4ec56ed0b1a584b9951de4b6cde918
                                                                                                                • Opcode Fuzzy Hash: abcf339b5d3ea00258f2fc81598d0fec985e4e8f11272172846ab0e7c0f615d2
                                                                                                                • Instruction Fuzzy Hash: 33F15D34A003598FDB15DFA8C894A9DBBF2FF89300F258196D844AB3A5DB70ED46CB50
                                                                                                                Function 0C555408 Relevance: .4, Instructions: 388COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000016.00000002.4104243718.000000000C550000.00000040.00000800.00020000.00000000.sdmp, Offset: 0C550000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_22_2_c550000_FastestVPN.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: fb5a1b71a3f7c59140d9b53537f36bae28aaf393f3953e9c652fc62c25b90026
                                                                                                                • Instruction ID: 98898de7cca05c6995c2e027b28121a83eb0e0ab214954be74942447ac972a58
                                                                                                                • Opcode Fuzzy Hash: fb5a1b71a3f7c59140d9b53537f36bae28aaf393f3953e9c652fc62c25b90026
                                                                                                                • Instruction Fuzzy Hash: 67D1A3387002458FCB24DB69D864A6BBBEABFC5310764881AE5469B255EF30ED41CB91
                                                                                                                Function 0AA4AE48 Relevance: .4, Instructions: 362COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000016.00000002.4082922941.000000000AA40000.00000040.00000800.00020000.00000000.sdmp, Offset: 0AA40000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_22_2_aa40000_FastestVPN.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: ab93da7d8310ef009203063a8611dd6c64297c457cddd9defe37a174363c3b75
                                                                                                                • Instruction ID: edc1c525768d06ab50eb293c2eb34d5cfe8219dbeec07dd3e82745ad090a749c
                                                                                                                • Opcode Fuzzy Hash: ab93da7d8310ef009203063a8611dd6c64297c457cddd9defe37a174363c3b75
                                                                                                                • Instruction Fuzzy Hash: 56D19A30B05211DFDB259B68C5447AEBBF2AFC4B41F198569F8168B395CB71DC82CBA0
                                                                                                                Function 0C55CB50 Relevance: .3, Instructions: 322COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000016.00000002.4104243718.000000000C550000.00000040.00000800.00020000.00000000.sdmp, Offset: 0C550000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_22_2_c550000_FastestVPN.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: f09525c16b35b1bae563879046470c3296147f3cc45d168429e465ae6fae9535
                                                                                                                • Instruction ID: 726db10e0952d705164d301737d112fdebeb1f5cfad6fcdcea5e32505ac548e0
                                                                                                                • Opcode Fuzzy Hash: f09525c16b35b1bae563879046470c3296147f3cc45d168429e465ae6fae9535
                                                                                                                • Instruction Fuzzy Hash: 5FC15234B11219CFDB15DFA9D9646AEBBB6BF88300F24852AD802EB355DF74AC45CB40
                                                                                                                Function 0AA45E10 Relevance: .3, Instructions: 320COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000016.00000002.4082922941.000000000AA40000.00000040.00000800.00020000.00000000.sdmp, Offset: 0AA40000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_22_2_aa40000_FastestVPN.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: 45b195c7378c6d0e80215a90b85de60fb77a4f5bdfec3e56d7cd885f9af19b41
                                                                                                                • Instruction ID: db3c47d1ec086a067990a2f19a3d776511f90c23c6e356b79d5736a00172e7a4
                                                                                                                • Opcode Fuzzy Hash: 45b195c7378c6d0e80215a90b85de60fb77a4f5bdfec3e56d7cd885f9af19b41
                                                                                                                • Instruction Fuzzy Hash: 3EC17A31B046418FC754EF2DD4949AABBF2BFC9310B2585A9E506CB3A6DB71EC41CB90
                                                                                                                Function 0C553070 Relevance: .3, Instructions: 314COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000016.00000002.4104243718.000000000C550000.00000040.00000800.00020000.00000000.sdmp, Offset: 0C550000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_22_2_c550000_FastestVPN.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: 44d3a0bd9f258e894af30d87a4d62b16b2271d56cfe04178b915f026169006a5
                                                                                                                • Instruction ID: 9ea4fa80bfffc20f0940f7dfc71f46751dd5f17cf54ac598800aea9ed3ea805e
                                                                                                                • Opcode Fuzzy Hash: 44d3a0bd9f258e894af30d87a4d62b16b2271d56cfe04178b915f026169006a5
                                                                                                                • Instruction Fuzzy Hash: 27C1B034B002499FDB05EBB8D8556AE7BB2FFC5340F104459E605AB3A6DF349D06CBA1
                                                                                                                Function 0C553BC8 Relevance: .3, Instructions: 309COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000016.00000002.4104243718.000000000C550000.00000040.00000800.00020000.00000000.sdmp, Offset: 0C550000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_22_2_c550000_FastestVPN.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: 4aa304a389e18e90b6bbd69353c024a98eb982a258735ff54d5102f2b47ebfab
                                                                                                                • Instruction ID: 65ac60248c814eb9f119bf47c5fe5c480d6f34b3fed438e8f5bdf24ab56f1adb
                                                                                                                • Opcode Fuzzy Hash: 4aa304a389e18e90b6bbd69353c024a98eb982a258735ff54d5102f2b47ebfab
                                                                                                                • Instruction Fuzzy Hash: 34E11878A0024ACFCB05CF28C494BA97BB6BF45304F6981E5D9499F276D730ED86CB90
                                                                                                                Function 0C558198 Relevance: .3, Instructions: 298COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000016.00000002.4104243718.000000000C550000.00000040.00000800.00020000.00000000.sdmp, Offset: 0C550000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_22_2_c550000_FastestVPN.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: 9f176326912664ad78d5ba0994aa83011251085956f881d6c5c3bd48c7b40425
                                                                                                                • Instruction ID: 638a7f681912d0c3ec5c9e6217c3912151dfb659a40557fda23b02e5b0a9ee6c
                                                                                                                • Opcode Fuzzy Hash: 9f176326912664ad78d5ba0994aa83011251085956f881d6c5c3bd48c7b40425
                                                                                                                • Instruction Fuzzy Hash: 68D12A34A00359CFDB05DFA8C898A9DBBF2BF89304F258196D844AB3A5DB74ED45CB50
                                                                                                                Function 0AA4E3C0 Relevance: .3, Instructions: 296COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000016.00000002.4082922941.000000000AA40000.00000040.00000800.00020000.00000000.sdmp, Offset: 0AA40000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_22_2_aa40000_FastestVPN.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: 63de45c331cceb017723397fea02da1883531a6fb1ca85a900a686c78529d6d4
                                                                                                                • Instruction ID: 93e7506e654b1d8137e83297f63b1f46a2985e28d93eac433612f897c0a1f2f2
                                                                                                                • Opcode Fuzzy Hash: 63de45c331cceb017723397fea02da1883531a6fb1ca85a900a686c78529d6d4
                                                                                                                • Instruction Fuzzy Hash: 2DB18534714601DFD7308F29D444AEABBF6BFC4220B184969F94AC7A91DB75EC40CBA1
                                                                                                                Function 0C405DF8 Relevance: .3, Instructions: 295COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000016.00000002.4103457864.000000000C400000.00000040.00000800.00020000.00000000.sdmp, Offset: 0C400000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_22_2_c400000_FastestVPN.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: a8107a07efe9b81545067b167400768a4c27561e3b797522aee0b394f88a214e
                                                                                                                • Instruction ID: 8e6867194a03dc886465b66f39092a8302bd4c8adc1493595dbdfdc71a961da8
                                                                                                                • Opcode Fuzzy Hash: a8107a07efe9b81545067b167400768a4c27561e3b797522aee0b394f88a214e
                                                                                                                • Instruction Fuzzy Hash: 9551942225D360FA8F9876FC79144FA27E0EA437397107053D6ABCE152C72548A3A5F5
                                                                                                                Function 0AA4D8A0 Relevance: .3, Instructions: 294COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000016.00000002.4082922941.000000000AA40000.00000040.00000800.00020000.00000000.sdmp, Offset: 0AA40000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_22_2_aa40000_FastestVPN.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: f1890c7a9bfc4ad0cc4e698de0c5318290e70ab7fd2e7c8740ea2ea7dad1d240
                                                                                                                • Instruction ID: bfaf1f3910a5adbbdb4df68654ca543c2989e3607dc90f0b1ec40ab395d7a10d
                                                                                                                • Opcode Fuzzy Hash: f1890c7a9bfc4ad0cc4e698de0c5318290e70ab7fd2e7c8740ea2ea7dad1d240
                                                                                                                • Instruction Fuzzy Hash: 01C16B70A003019FDB19DF68C584A9ABBF2FFC9310B1585A9E4199F3A2DB70ED45CB90
                                                                                                                Function 0C55BD3A Relevance: .3, Instructions: 282COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000016.00000002.4104243718.000000000C550000.00000040.00000800.00020000.00000000.sdmp, Offset: 0C550000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_22_2_c550000_FastestVPN.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: ee52f4378da186e5664b836249c51827a2304cf6a5468fc478ba177c5edec33e
                                                                                                                • Instruction ID: ab5c6ea1cf93474346b6ee12e51f0f96ac6fea797646a5cc36ee891f0dc043ae
                                                                                                                • Opcode Fuzzy Hash: ee52f4378da186e5664b836249c51827a2304cf6a5468fc478ba177c5edec33e
                                                                                                                • Instruction Fuzzy Hash: 8BB1F774B0160A9FCB05DFA9D49499EBBF6FF89700B508469E906EB360DB31AD42CF50
                                                                                                                Function 0C55BD48 Relevance: .3, Instructions: 279COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000016.00000002.4104243718.000000000C550000.00000040.00000800.00020000.00000000.sdmp, Offset: 0C550000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_22_2_c550000_FastestVPN.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: 08f32970f17c8a7b05718c72b51d330a6328bcabf4a174118df2fc61617af4c4
                                                                                                                • Instruction ID: fe99bbd78e58bb0c4d402c4fada50fc15b82e1814c360a1cbd5df44a70fcc57e
                                                                                                                • Opcode Fuzzy Hash: 08f32970f17c8a7b05718c72b51d330a6328bcabf4a174118df2fc61617af4c4
                                                                                                                • Instruction Fuzzy Hash: 4DB10874B016099FCB05DFA9C49499EBBF6FF89700B508469E906EB360DB31AD41CF90
                                                                                                                Function 0C55A260 Relevance: .3, Instructions: 273COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000016.00000002.4104243718.000000000C550000.00000040.00000800.00020000.00000000.sdmp, Offset: 0C550000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_22_2_c550000_FastestVPN.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: a5ad6344950c0aef400e1d50249fd37c5dbb31f024ee11b1ee37785de8a1f337
                                                                                                                • Instruction ID: a9dddbcd1ab1f53500a23f71794a9619109804d2a1353b58f0908a064cc57c9f
                                                                                                                • Opcode Fuzzy Hash: a5ad6344950c0aef400e1d50249fd37c5dbb31f024ee11b1ee37785de8a1f337
                                                                                                                • Instruction Fuzzy Hash: D9B16838B006018FCB15DF39D59896ABBF2FFC8200B14866DE9468B365DB30EC46DB91
                                                                                                                Function 0AA4B6A0 Relevance: .2, Instructions: 249COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000016.00000002.4082922941.000000000AA40000.00000040.00000800.00020000.00000000.sdmp, Offset: 0AA40000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_22_2_aa40000_FastestVPN.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: acfc318836551c2eec38103e514275325a0059378e64dfa67028a35a97207140
                                                                                                                • Instruction ID: ac04d92e3cf3940ff387e9edce104e21203cd479e71dc596a07f0cf95ea5d229
                                                                                                                • Opcode Fuzzy Hash: acfc318836551c2eec38103e514275325a0059378e64dfa67028a35a97207140
                                                                                                                • Instruction Fuzzy Hash: 53A12D30A106059FDB14DFA5C954AAEBBF2FFC8710B158169E9069B3A5DF70ED02CB90
                                                                                                                Function 0AA4A833 Relevance: .2, Instructions: 247COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000016.00000002.4082922941.000000000AA40000.00000040.00000800.00020000.00000000.sdmp, Offset: 0AA40000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_22_2_aa40000_FastestVPN.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: 705021270f3ddbae584df7d97e92bdfd05b39a948c70840782b729f1b7536ca2
                                                                                                                • Instruction ID: 73ae4f3a1bed022256c600c9a33bd912c07fc08eed325f56a6110e77c9c4c06c
                                                                                                                • Opcode Fuzzy Hash: 705021270f3ddbae584df7d97e92bdfd05b39a948c70840782b729f1b7536ca2
                                                                                                                • Instruction Fuzzy Hash: 28819E31714200EFDB249B38C840ABA7BE6AFC5350B198469F646CB396DFB5DC42CB50
                                                                                                                Function 0AA4D460 Relevance: .2, Instructions: 246COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000016.00000002.4082922941.000000000AA40000.00000040.00000800.00020000.00000000.sdmp, Offset: 0AA40000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_22_2_aa40000_FastestVPN.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: 011c470d5039594ca8188734b25369859db4baa94c0d4142281b35d8fd605952
                                                                                                                • Instruction ID: 344749c032dddb2ce4e4273fc33c43f40b169761a6abb32ec5112907ff5635a6
                                                                                                                • Opcode Fuzzy Hash: 011c470d5039594ca8188734b25369859db4baa94c0d4142281b35d8fd605952
                                                                                                                • Instruction Fuzzy Hash: 16917E307002149FDF09EB68D8597AEBBA6EFC8300F149529E606DB3A1DF749D058BA5
                                                                                                                Function 0C552D3B Relevance: .2, Instructions: 234COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000016.00000002.4104243718.000000000C550000.00000040.00000800.00020000.00000000.sdmp, Offset: 0C550000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_22_2_c550000_FastestVPN.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: 50d59d0513dfeaf99cbbaac50ce4406608a77c03eb2ce05d9df337104f240533
                                                                                                                • Instruction ID: 0a2f7d29439413109103d23c4694c14a999e1c798a02c4b803bafd563f4f111f
                                                                                                                • Opcode Fuzzy Hash: 50d59d0513dfeaf99cbbaac50ce4406608a77c03eb2ce05d9df337104f240533
                                                                                                                • Instruction Fuzzy Hash: CC717338701609CFCB259A79C87463E7AD67FC8250B2445A7DD0ACB3B5EE75CC428761
                                                                                                                Function 0C553998 Relevance: .2, Instructions: 234COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000016.00000002.4104243718.000000000C550000.00000040.00000800.00020000.00000000.sdmp, Offset: 0C550000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_22_2_c550000_FastestVPN.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: 369f39394d4f70684e78a1292cad4bfedec37784afc4c49b2f3de4c76d85f397
                                                                                                                • Instruction ID: 2307c6b8d66bc29fb48f2a55a50e5532bd971f32d6f227d92a22c192ec9ab621
                                                                                                                • Opcode Fuzzy Hash: 369f39394d4f70684e78a1292cad4bfedec37784afc4c49b2f3de4c76d85f397
                                                                                                                • Instruction Fuzzy Hash: 34519F79A0E3C08FCB07CB7998784457FB5EE8314034A54EBC988CF5B3E569880AD766
                                                                                                                Function 0C4039F0 Relevance: .2, Instructions: 230COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000016.00000002.4103457864.000000000C400000.00000040.00000800.00020000.00000000.sdmp, Offset: 0C400000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_22_2_c400000_FastestVPN.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: 1725c463751908b8798613ee9b0ddb83e436413c25da54d326908581401f53f5
                                                                                                                • Instruction ID: 0a2ba3e2bcf3a3b8341da5375d8af51af5c64ee7c8a0701d623c503d71047ae2
                                                                                                                • Opcode Fuzzy Hash: 1725c463751908b8798613ee9b0ddb83e436413c25da54d326908581401f53f5
                                                                                                                • Instruction Fuzzy Hash: 12A1F935644645DFDB06CF68C584D6ABBB2FF45320B26C5AAE806CB3A2C771ED41CB90
                                                                                                                Function 0C4088C2 Relevance: .2, Instructions: 215COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000016.00000002.4103457864.000000000C400000.00000040.00000800.00020000.00000000.sdmp, Offset: 0C400000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_22_2_c400000_FastestVPN.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: ae2e3392f0602474b76de3f6e699550f699223c1ffa91bfbc1a0964fcf8a9fca
                                                                                                                • Instruction ID: 76ccaacf5df1ab6cdafc90ab223d0ddc810fb19e2b1e455f91f9e71d45d5706d
                                                                                                                • Opcode Fuzzy Hash: ae2e3392f0602474b76de3f6e699550f699223c1ffa91bfbc1a0964fcf8a9fca
                                                                                                                • Instruction Fuzzy Hash: D9819C75B08245DF8714AB24924593EBBF6BFC82503289A6AE816DB3C5DF74EC02C791
                                                                                                                Function 0C55D127 Relevance: .2, Instructions: 212COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000016.00000002.4104243718.000000000C550000.00000040.00000800.00020000.00000000.sdmp, Offset: 0C550000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_22_2_c550000_FastestVPN.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: 7b31fb5f306e54e0cc5c4f2514f095244fc8d8d4b8e7fb05bdb936ef97a8e82f
                                                                                                                • Instruction ID: 70ecf9c44adb0c5e94e8d51d780cfb1d6c57dd55926a6b167e0336691d73c221
                                                                                                                • Opcode Fuzzy Hash: 7b31fb5f306e54e0cc5c4f2514f095244fc8d8d4b8e7fb05bdb936ef97a8e82f
                                                                                                                • Instruction Fuzzy Hash: FF718F35B012098FDB14EB69DA6576EB7F6BF88700F20852AD802E7361DF74AC05CB90
                                                                                                                Function 0AA48FC0 Relevance: .2, Instructions: 209COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000016.00000002.4082922941.000000000AA40000.00000040.00000800.00020000.00000000.sdmp, Offset: 0AA40000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_22_2_aa40000_FastestVPN.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: c5cbc100a10268f3907715c180906f93247e485d1fa1aab491551e35f4764fbf
                                                                                                                • Instruction ID: c78b82055e634d518c943870b1bbbde0b18128214face48720fb9c9c08cc803d
                                                                                                                • Opcode Fuzzy Hash: c5cbc100a10268f3907715c180906f93247e485d1fa1aab491551e35f4764fbf
                                                                                                                • Instruction Fuzzy Hash: 0C718D71B002459FDB05DF68D854AAFBBB6AFC9210F15809AE505DB3A1DB70DD02CB91
                                                                                                                Function 0AA43F3F Relevance: .2, Instructions: 201COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000016.00000002.4082922941.000000000AA40000.00000040.00000800.00020000.00000000.sdmp, Offset: 0AA40000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_22_2_aa40000_FastestVPN.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: 43f5592601571a02147a457ed75bc8ed7345e9d9bd944fefd39cae21fdfabed2
                                                                                                                • Instruction ID: 611b7cbdae570d3161442da30e98bef26af5244a0886d9648debcdce3a814f2e
                                                                                                                • Opcode Fuzzy Hash: 43f5592601571a02147a457ed75bc8ed7345e9d9bd944fefd39cae21fdfabed2
                                                                                                                • Instruction Fuzzy Hash: EF712D31B102158FCB54DF69C854AAEBBF6BFCD600B158169E905EB3A5DBB4DC01CB90
                                                                                                                Function 0AA4FCF8 Relevance: .2, Instructions: 198COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000016.00000002.4082922941.000000000AA40000.00000040.00000800.00020000.00000000.sdmp, Offset: 0AA40000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_22_2_aa40000_FastestVPN.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: fca86d3207dde766fe0eb327a3b6144034716c6ab0cfd037c60cff78ff306dc7
                                                                                                                • Instruction ID: a1c4f4fe2c22d90ab41e545b6d76f85615df22889d065e14e48a03522fb6852e
                                                                                                                • Opcode Fuzzy Hash: fca86d3207dde766fe0eb327a3b6144034716c6ab0cfd037c60cff78ff306dc7
                                                                                                                • Instruction Fuzzy Hash: 75512331708A809FDB16ABBC94546AE7FB1DFC665071845EAE809DB3D2DF389C02C791
                                                                                                                Function 0C55DC38 Relevance: .2, Instructions: 194COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000016.00000002.4104243718.000000000C550000.00000040.00000800.00020000.00000000.sdmp, Offset: 0C550000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_22_2_c550000_FastestVPN.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: f512841a95c993dca69062e80bba6a947a998dc9e10c4de9d68df6629945f651
                                                                                                                • Instruction ID: 5bde5f6e0edc0f1c11e061c7832148a76b97d7ee4f457efca6927afe2c95124c
                                                                                                                • Opcode Fuzzy Hash: f512841a95c993dca69062e80bba6a947a998dc9e10c4de9d68df6629945f651
                                                                                                                • Instruction Fuzzy Hash: 1A617F357006058FDB14DF2AD99896EBBB2FFC5311B158669E916CB3A1DB30EC05CB90
                                                                                                                Function 0C55A250 Relevance: .2, Instructions: 192COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000016.00000002.4104243718.000000000C550000.00000040.00000800.00020000.00000000.sdmp, Offset: 0C550000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_22_2_c550000_FastestVPN.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: 01022e88eb7b0819f7bec6ef38a3ac59a5dfec3c1007df71c9f7f6554db232ad
                                                                                                                • Instruction ID: 63ecb1dbf6a6d3fe90e6ce5f3235384c7c33274f608864863a9e6d08593d3427
                                                                                                                • Opcode Fuzzy Hash: 01022e88eb7b0819f7bec6ef38a3ac59a5dfec3c1007df71c9f7f6554db232ad
                                                                                                                • Instruction Fuzzy Hash: 52715874B002058FCB05DF39D4A496EBBF2FFC9200B04CA6AE9469B356DB74E945CB91
                                                                                                                Function 0C551A70 Relevance: .2, Instructions: 191COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000016.00000002.4104243718.000000000C550000.00000040.00000800.00020000.00000000.sdmp, Offset: 0C550000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_22_2_c550000_FastestVPN.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: 910596561b48898229a5d6bb1f5222708d7fd8ac9621a8c077b5b75b47c833c2
                                                                                                                • Instruction ID: 65ffc36269bd31b79430b8da53da83e9b785ce8491c588d9f1430f02fa6424e8
                                                                                                                • Opcode Fuzzy Hash: 910596561b48898229a5d6bb1f5222708d7fd8ac9621a8c077b5b75b47c833c2
                                                                                                                • Instruction Fuzzy Hash: 2261E239B106549FCB05ABA9D854A5EBBF7FFC8300B15C56AE50A9B365DF319C028B80
                                                                                                                Function 0C554838 Relevance: .2, Instructions: 188COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000016.00000002.4104243718.000000000C550000.00000040.00000800.00020000.00000000.sdmp, Offset: 0C550000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_22_2_c550000_FastestVPN.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: d84f6aa875f7fe7fa024ed99cab225256765a802346c299c122c1f104129b237
                                                                                                                • Instruction ID: c7bfd26fdf0ff60138bedecc036349101d2ea593b8ecd8151e99ea7a0e970356
                                                                                                                • Opcode Fuzzy Hash: d84f6aa875f7fe7fa024ed99cab225256765a802346c299c122c1f104129b237
                                                                                                                • Instruction Fuzzy Hash: 2A714835E00609DFDB05DBE8C8546DEBFB2EF89350F104029D2066B3A1DE79AA46DF91
                                                                                                                Function 0C5593E0 Relevance: .2, Instructions: 186COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000016.00000002.4104243718.000000000C550000.00000040.00000800.00020000.00000000.sdmp, Offset: 0C550000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_22_2_c550000_FastestVPN.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: da2b9989cb925d026912ce95f50f3ee5516aa90ee2bc0793ed5273639908b935
                                                                                                                • Instruction ID: 289309c71d3e7ae424b670c90d0dcd6dda584664b202d244f82d559856a02fab
                                                                                                                • Opcode Fuzzy Hash: da2b9989cb925d026912ce95f50f3ee5516aa90ee2bc0793ed5273639908b935
                                                                                                                • Instruction Fuzzy Hash: B951F638311101CFCB589F2AD5A892A77F6BFC961072985AAE806CB375DF75DC068B50
                                                                                                                Function 0C5550D8 Relevance: .2, Instructions: 185COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000016.00000002.4104243718.000000000C550000.00000040.00000800.00020000.00000000.sdmp, Offset: 0C550000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_22_2_c550000_FastestVPN.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: d96f9785940b910c55be81cee1972ebe9ea694a2ed527d176265d4e706c54f83
                                                                                                                • Instruction ID: 6eebe6f32dda312635a17c1698da86190c74857051dc5e45b2caac6632f0f600
                                                                                                                • Opcode Fuzzy Hash: d96f9785940b910c55be81cee1972ebe9ea694a2ed527d176265d4e706c54f83
                                                                                                                • Instruction Fuzzy Hash: 9A616D39B002059FCB11CF99D880D9ABBF6FF8D310B5481A6E919DB321D731E915CB90
                                                                                                                Function 0AA4B68F Relevance: .2, Instructions: 184COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000016.00000002.4082922941.000000000AA40000.00000040.00000800.00020000.00000000.sdmp, Offset: 0AA40000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_22_2_aa40000_FastestVPN.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: 550a27767f4ed4dbab0d0fe4632d63cd170a48db25ae5581b7bea2766ffc53a6
                                                                                                                • Instruction ID: b1efbe6d9c4e61c851d037df5be3016180e828f2b6786537e5af36c6f9353bac
                                                                                                                • Opcode Fuzzy Hash: 550a27767f4ed4dbab0d0fe4632d63cd170a48db25ae5581b7bea2766ffc53a6
                                                                                                                • Instruction Fuzzy Hash: 23714C30A00605DFCB14DFA4C994A9EBBF2EFC8300B158569E916AB365DF70ED06CB90
                                                                                                                Function 0C559AC0 Relevance: .2, Instructions: 179COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000016.00000002.4104243718.000000000C550000.00000040.00000800.00020000.00000000.sdmp, Offset: 0C550000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_22_2_c550000_FastestVPN.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: 44c83340c1492947d941313ed4c8994d9bf2a4ce3195ce6276be5b30e600d99e
                                                                                                                • Instruction ID: 3ac830f843773dbaaf9bed9cb3d841f1d84ad288d5e114a85dba2ba41673c4d2
                                                                                                                • Opcode Fuzzy Hash: 44c83340c1492947d941313ed4c8994d9bf2a4ce3195ce6276be5b30e600d99e
                                                                                                                • Instruction Fuzzy Hash: F251B578F1411ACBDB14977B886067FBBE77FD4250B14842AD9029B388DE78DC038761
                                                                                                                Function 0AA4B2D0 Relevance: .2, Instructions: 177COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000016.00000002.4082922941.000000000AA40000.00000040.00000800.00020000.00000000.sdmp, Offset: 0AA40000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_22_2_aa40000_FastestVPN.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: 41a0baef40fae422440e8d918abd1331e56a70b972ea4bb8b7ef4567ad809a80
                                                                                                                • Instruction ID: d127e162897899ce98516d4ac5f585512bb44df56b3490755eb0bc84f30dc808
                                                                                                                • Opcode Fuzzy Hash: 41a0baef40fae422440e8d918abd1331e56a70b972ea4bb8b7ef4567ad809a80
                                                                                                                • Instruction Fuzzy Hash: 24612535A10504DFDB14DB69D858AAEBBB5FF88310F258169E916E73A0DB70EC41CFA0
                                                                                                                Function 0AA4AC0F Relevance: .2, Instructions: 172COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000016.00000002.4082922941.000000000AA40000.00000040.00000800.00020000.00000000.sdmp, Offset: 0AA40000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_22_2_aa40000_FastestVPN.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: e977c40efcaf22768d3108799d282b6d3701c6c24c419c7f1ebae1bafe184813
                                                                                                                • Instruction ID: 1c848f0baf25760196f241c90dd8d979cf35d7f5e39da0308983090aba8bb178
                                                                                                                • Opcode Fuzzy Hash: e977c40efcaf22768d3108799d282b6d3701c6c24c419c7f1ebae1bafe184813
                                                                                                                • Instruction Fuzzy Hash: AE51A131B446019FDB659F75C4443BB7BB2EBC8282F14896AF506CB2C5EB70C881CB95
                                                                                                                Function 0AA4D44F Relevance: .2, Instructions: 172COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000016.00000002.4082922941.000000000AA40000.00000040.00000800.00020000.00000000.sdmp, Offset: 0AA40000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_22_2_aa40000_FastestVPN.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: 98a6379b8146b97b968f57e08c057d02ffa55049b90ffd0bbf3b58065e9e618d
                                                                                                                • Instruction ID: ba98171f6b853e8e0aea2d0f176dc0ddbe2bb1c8b1d6b0976ac385ddb471d24e
                                                                                                                • Opcode Fuzzy Hash: 98a6379b8146b97b968f57e08c057d02ffa55049b90ffd0bbf3b58065e9e618d
                                                                                                                • Instruction Fuzzy Hash: 58512975B002149FDF04AFA5D858BAFBBB6EBC8300F148529E906D73A1DF749D019B91
                                                                                                                Function 0AA4DB00 Relevance: .2, Instructions: 168COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000016.00000002.4082922941.000000000AA40000.00000040.00000800.00020000.00000000.sdmp, Offset: 0AA40000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_22_2_aa40000_FastestVPN.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: 67d94dd71d48a829c62d7f4a6106a4d7a8dcba129a8bc6c98d6d22383745d5b0
                                                                                                                • Instruction ID: 86807da81940d837127c574c2f1789049a6111d7e84cecc484a51f734296d0cd
                                                                                                                • Opcode Fuzzy Hash: 67d94dd71d48a829c62d7f4a6106a4d7a8dcba129a8bc6c98d6d22383745d5b0
                                                                                                                • Instruction Fuzzy Hash: DD714870A00705DFDB15DF68C584A9ABBF1FF88300B24856DE4199B262DB70ED46CB90
                                                                                                                Function 0C55CAC6 Relevance: .2, Instructions: 161COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000016.00000002.4104243718.000000000C550000.00000040.00000800.00020000.00000000.sdmp, Offset: 0C550000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_22_2_c550000_FastestVPN.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: 0d8fc570ee66fc87ef1436d7f9c291b770a125d3028202f5493af06a6a79d709
                                                                                                                • Instruction ID: a4cd84d43dd2aa1f281ab35b5da10328577452554cc74fa3863f3347a9c5e6aa
                                                                                                                • Opcode Fuzzy Hash: 0d8fc570ee66fc87ef1436d7f9c291b770a125d3028202f5493af06a6a79d709
                                                                                                                • Instruction Fuzzy Hash: 2051A135A153958FCB05CFB8D9A49CDBFB1FF86310B25419AD441AF362CB70A94ACB50
                                                                                                                Function 0C5553E0 Relevance: .2, Instructions: 159COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000016.00000002.4104243718.000000000C550000.00000040.00000800.00020000.00000000.sdmp, Offset: 0C550000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_22_2_c550000_FastestVPN.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: b4588f56d6499dcfeb7990442f2f69fb633f4769ca6abb8ebf099907797728df
                                                                                                                • Instruction ID: 233b988723b84b637d16465d7c034ad15a4b3453373e0c18a6794c5b37bfda5a
                                                                                                                • Opcode Fuzzy Hash: b4588f56d6499dcfeb7990442f2f69fb633f4769ca6abb8ebf099907797728df
                                                                                                                • Instruction Fuzzy Hash: D951C274B002068FCB05DF69D854A6EBBF2FF84310B658569E905DB396EB30ED01CB91
                                                                                                                Function 0C55D6C0 Relevance: .2, Instructions: 154COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000016.00000002.4104243718.000000000C550000.00000040.00000800.00020000.00000000.sdmp, Offset: 0C550000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_22_2_c550000_FastestVPN.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: c2ada595c2a68f2f6873a1b34f9723b859a91f8e82ed439d336d6cd684ac5178
                                                                                                                • Instruction ID: aa37f9d7c096dd7c0afccb86e60aa65e7962ee7907845a304e079a700f90d7e6
                                                                                                                • Opcode Fuzzy Hash: c2ada595c2a68f2f6873a1b34f9723b859a91f8e82ed439d336d6cd684ac5178
                                                                                                                • Instruction Fuzzy Hash: CF51C4397052458FC715DF68C9A4A6EBBB2FFC5300B2580AAD945DB362DB70EC02CB61
                                                                                                                Function 0C40C768 Relevance: .1, Instructions: 147COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000016.00000002.4103457864.000000000C400000.00000040.00000800.00020000.00000000.sdmp, Offset: 0C400000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_22_2_c400000_FastestVPN.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: 1f6ded587c184e8d08262e1f7d83c3c8287e7f7c2214ce5bf351ba230d6f48b6
                                                                                                                • Instruction ID: 5d915839010950cfa75299753bf2303b423f1f3db981845e664ca7a0687cd05c
                                                                                                                • Opcode Fuzzy Hash: 1f6ded587c184e8d08262e1f7d83c3c8287e7f7c2214ce5bf351ba230d6f48b6
                                                                                                                • Instruction Fuzzy Hash: D0515B71640605DFC714DB68C889A6EBBA2FFC8210B248729E5169B790EF74ED05CF81
                                                                                                                Function 0AA4D1B9 Relevance: .1, Instructions: 145COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000016.00000002.4082922941.000000000AA40000.00000040.00000800.00020000.00000000.sdmp, Offset: 0AA40000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_22_2_aa40000_FastestVPN.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: b9880b786567dd95e6c882fd5923df902c31de982bc4d6a76301626a693ba0cc
                                                                                                                • Instruction ID: c654aeb2cc8927244481c1d51b351c94581d7677ec395d0c847707de3e1ea276
                                                                                                                • Opcode Fuzzy Hash: b9880b786567dd95e6c882fd5923df902c31de982bc4d6a76301626a693ba0cc
                                                                                                                • Instruction Fuzzy Hash: E7512775A00245DFCB45CF64D488A9DBBF2BF89310F1985A9E805AB3A2DB31EC81CF50
                                                                                                                Function 0AA4D1C8 Relevance: .1, Instructions: 145COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000016.00000002.4082922941.000000000AA40000.00000040.00000800.00020000.00000000.sdmp, Offset: 0AA40000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_22_2_aa40000_FastestVPN.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: 15c52781c77a00321a6b06c595fb621655497d99a36d9f900c320ae5e31e1690
                                                                                                                • Instruction ID: e4520418f4eb40ac83321c1128a5855e115c9342a828e204934b22193f879e6e
                                                                                                                • Opcode Fuzzy Hash: 15c52781c77a00321a6b06c595fb621655497d99a36d9f900c320ae5e31e1690
                                                                                                                • Instruction Fuzzy Hash: FF510875A00245DFDB55CF64D488A9DBBF2BF89310F1585A9E805AB3A6DB30EC81CF50
                                                                                                                Function 0C404016 Relevance: .1, Instructions: 141COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000016.00000002.4103457864.000000000C400000.00000040.00000800.00020000.00000000.sdmp, Offset: 0C400000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_22_2_c400000_FastestVPN.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: ebd612e2bd82bfd422f443c9d01a724cd7513b5e45657ced5fed1192fbaf92cd
                                                                                                                • Instruction ID: 1c1daae4497f5e69b08f40f0e012723aa183d2253fa6a7bcefa547fb468f34bc
                                                                                                                • Opcode Fuzzy Hash: ebd612e2bd82bfd422f443c9d01a724cd7513b5e45657ced5fed1192fbaf92cd
                                                                                                                • Instruction Fuzzy Hash: 63517F31B042459FCB11CF69C884EAABBF2FF55321F24866AE955DB392C730E940DB50
                                                                                                                Function 0C55E5F1 Relevance: .1, Instructions: 140COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000016.00000002.4104243718.000000000C550000.00000040.00000800.00020000.00000000.sdmp, Offset: 0C550000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_22_2_c550000_FastestVPN.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: e48c8e09087be1713816386dd93ee9a1b1da76e5fed7894df927505ac71d3494
                                                                                                                • Instruction ID: 0d0671b115967ee8d4a20b5391320b2ca0ef2f991a11e960fabaf825a1fa84b3
                                                                                                                • Opcode Fuzzy Hash: e48c8e09087be1713816386dd93ee9a1b1da76e5fed7894df927505ac71d3494
                                                                                                                • Instruction Fuzzy Hash: B241F1347002558FCB14DB69D8949AEBFFAFFC9300B04456AE546D7362DB74EA06CB60
                                                                                                                Function 0C40D740 Relevance: .1, Instructions: 140COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000016.00000002.4103457864.000000000C400000.00000040.00000800.00020000.00000000.sdmp, Offset: 0C400000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_22_2_c400000_FastestVPN.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: df08d61af94b1eba1f08b3f82fc634a52132790d9a962758a6b52bf98d94ada9
                                                                                                                • Instruction ID: 24072fdb5f00c4c24d63fd2e5e9a87d1ed16179dd8ac463d7c043c5910afc061
                                                                                                                • Opcode Fuzzy Hash: df08d61af94b1eba1f08b3f82fc634a52132790d9a962758a6b52bf98d94ada9
                                                                                                                • Instruction Fuzzy Hash: BF512871E012488FCB15DFA8C484ADEBBF5BF89210B2581AAD415AB3A5D734ED49CF60
                                                                                                                Function 0C55A8F8 Relevance: .1, Instructions: 139COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000016.00000002.4104243718.000000000C550000.00000040.00000800.00020000.00000000.sdmp, Offset: 0C550000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_22_2_c550000_FastestVPN.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: fabea21cd1dd32c196aa35a927f00e5ceff8eb64c8b20d83d378babb2c131e99
                                                                                                                • Instruction ID: da0bd863716bf14653a0ab548c10708f1c82511d49aed1942603dc297a5df81c
                                                                                                                • Opcode Fuzzy Hash: fabea21cd1dd32c196aa35a927f00e5ceff8eb64c8b20d83d378babb2c131e99
                                                                                                                • Instruction Fuzzy Hash: CA51B4383047418FD725DB29D464A66BBF6FFC5300B19CA6ED54A8B766CA30EC06CB90
                                                                                                                Function 0C553268 Relevance: .1, Instructions: 136COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000016.00000002.4104243718.000000000C550000.00000040.00000800.00020000.00000000.sdmp, Offset: 0C550000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_22_2_c550000_FastestVPN.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: ff6141db7c1ef29e2d47fe26bd994a3ade0dfb5f3cb19256947078980e0d1c5a
                                                                                                                • Instruction ID: 29179164262cfd55c4f8795a426022b92ffba5e01690c96155ca15569c52d438
                                                                                                                • Opcode Fuzzy Hash: ff6141db7c1ef29e2d47fe26bd994a3ade0dfb5f3cb19256947078980e0d1c5a
                                                                                                                • Instruction Fuzzy Hash: BB51E434E10209EBDB04EBE8D859AAEBB76FF88300F105818E60667395CF756D06DB61
                                                                                                                Function 0C55E490 Relevance: .1, Instructions: 135COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000016.00000002.4104243718.000000000C550000.00000040.00000800.00020000.00000000.sdmp, Offset: 0C550000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_22_2_c550000_FastestVPN.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: 24dbb19f9b87015ad0d45d608d2663b7b8a0ee8760c3938501026a658019bc19
                                                                                                                • Instruction ID: b54d716d5b068aeb75336ccbf66808f1e76ed921023ed53fd68fb3821e8c69a6
                                                                                                                • Opcode Fuzzy Hash: 24dbb19f9b87015ad0d45d608d2663b7b8a0ee8760c3938501026a658019bc19
                                                                                                                • Instruction Fuzzy Hash: 30418B79B001168FCB14DB69D9919AEF7F6FF88210B108266DE09D7355EB70ED42CBA0
                                                                                                                Function 0C550770 Relevance: .1, Instructions: 135COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000016.00000002.4104243718.000000000C550000.00000040.00000800.00020000.00000000.sdmp, Offset: 0C550000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_22_2_c550000_FastestVPN.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: be81ab3564b780761ebca7e4d633af16945fa14783872a8935ae06d4008dc24a
                                                                                                                • Instruction ID: c3613048ba4192a7d1bf46d6cd55f374f82ef6a443062377f5023c8d518d3eca
                                                                                                                • Opcode Fuzzy Hash: be81ab3564b780761ebca7e4d633af16945fa14783872a8935ae06d4008dc24a
                                                                                                                • Instruction Fuzzy Hash: 86519474B00605DFEB04EBA5D464BAE7BF2FB88350F18915AE801A7399DB719C42DB90
                                                                                                                Function 0C40E108 Relevance: .1, Instructions: 134COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000016.00000002.4103457864.000000000C400000.00000040.00000800.00020000.00000000.sdmp, Offset: 0C400000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_22_2_c400000_FastestVPN.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: 61b26984247ec1a78c0dbfcad4d4e4ad030aa2a0448460c36b6de0fe45c51c00
                                                                                                                • Instruction ID: 2ce7a859a24edf364a4de3dd1c8772b1780ad1c4c212f3230d149d5276637ff0
                                                                                                                • Opcode Fuzzy Hash: 61b26984247ec1a78c0dbfcad4d4e4ad030aa2a0448460c36b6de0fe45c51c00
                                                                                                                • Instruction Fuzzy Hash: EA518F31700A009FDB25AF64E849B6E7BB2FBC8301F244A2DE54697690DB70AC16CB90
                                                                                                                Function 0AA4B520 Relevance: .1, Instructions: 134COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000016.00000002.4082922941.000000000AA40000.00000040.00000800.00020000.00000000.sdmp, Offset: 0AA40000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_22_2_aa40000_FastestVPN.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: 8f73579cace84956140ba48a18d2b1126dc4cd067a964ad508e63b6bf470d4a6
                                                                                                                • Instruction ID: cb5475dc5ca0124d2101dc79bdd8fc1118c909bf3cb9bce843cde0ff72186efd
                                                                                                                • Opcode Fuzzy Hash: 8f73579cace84956140ba48a18d2b1126dc4cd067a964ad508e63b6bf470d4a6
                                                                                                                • Instruction Fuzzy Hash: AE415E317002059FDB18EF39D8949AEBBA6BFC965071585A9E506DB3A5DF30DC01CBA0
                                                                                                                Function 0C40ECA0 Relevance: .1, Instructions: 130COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000016.00000002.4103457864.000000000C400000.00000040.00000800.00020000.00000000.sdmp, Offset: 0C400000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_22_2_c400000_FastestVPN.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: 032304d2012910f7b4293ce6e04c1cda59a03df73cb4c1c6be411e1ef582993a
                                                                                                                • Instruction ID: 286d274666ed668f30bc984c65873641f32195b96662fab8069505605f0e9f1c
                                                                                                                • Opcode Fuzzy Hash: 032304d2012910f7b4293ce6e04c1cda59a03df73cb4c1c6be411e1ef582993a
                                                                                                                • Instruction Fuzzy Hash: 9B41E431A0024ACFCB01EF78D81499EBFB1FF85300F1549AAD084AB155DF71AD49CBA1
                                                                                                                Function 0C55CD8A Relevance: .1, Instructions: 129COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000016.00000002.4104243718.000000000C550000.00000040.00000800.00020000.00000000.sdmp, Offset: 0C550000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_22_2_c550000_FastestVPN.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: 1f35dd8d5250d0257e2c351830fb4571e93c4919103fca9c026fbd29f954e041
                                                                                                                • Instruction ID: c82b8b15eca962901c2132fa060edebeae9b26af2bf340d3a597d94273bf597f
                                                                                                                • Opcode Fuzzy Hash: 1f35dd8d5250d0257e2c351830fb4571e93c4919103fca9c026fbd29f954e041
                                                                                                                • Instruction Fuzzy Hash: A3413E34B11215DFDB15DFA9D8646AEBBB2BF88310F10852AE816EB351DF74AC05CB90
                                                                                                                Function 0C55CD98 Relevance: .1, Instructions: 125COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000016.00000002.4104243718.000000000C550000.00000040.00000800.00020000.00000000.sdmp, Offset: 0C550000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_22_2_c550000_FastestVPN.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: 383f5585e561b76c71975d19321affbedfbc459e60b8a5e29562da448ad5701c
                                                                                                                • Instruction ID: b8d681f3c78df365bee7623da168af3f858316185a7fab7fb093b2e7a1a8fdd7
                                                                                                                • Opcode Fuzzy Hash: 383f5585e561b76c71975d19321affbedfbc459e60b8a5e29562da448ad5701c
                                                                                                                • Instruction Fuzzy Hash: EC413D34B012199FDB15DFA9D86466EBBF2BF88350F10852AE806EB350DF74AC05CB90
                                                                                                                Function 0C40D0E0 Relevance: .1, Instructions: 124COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000016.00000002.4103457864.000000000C400000.00000040.00000800.00020000.00000000.sdmp, Offset: 0C400000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_22_2_c400000_FastestVPN.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: 44d96b267465a86f0455b1e9ca1e7a4bad2e3360bb78f76a43ba5c60a4914e5a
                                                                                                                • Instruction ID: f363373b84f010663b5c80bab4dd51e23fdff8154fd40ba8f01a9dda5ac07a20
                                                                                                                • Opcode Fuzzy Hash: 44d96b267465a86f0455b1e9ca1e7a4bad2e3360bb78f76a43ba5c60a4914e5a
                                                                                                                • Instruction Fuzzy Hash: 0D517131D00B5A9ADF11DFB8C8106DDFBB2FF85300F25865AD45877252EB70AA89CB80
                                                                                                                Function 0AA4CCD8 Relevance: .1, Instructions: 120COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000016.00000002.4082922941.000000000AA40000.00000040.00000800.00020000.00000000.sdmp, Offset: 0AA40000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_22_2_aa40000_FastestVPN.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: 53b9af9f1bef32fd9a8f982ca1f3fbdf4be97194da168926662e0e9f7f97f469
                                                                                                                • Instruction ID: a38838c1ab47a08726c7fe55d5ab5528b61b0abeaac878583cfdffc4597255f3
                                                                                                                • Opcode Fuzzy Hash: 53b9af9f1bef32fd9a8f982ca1f3fbdf4be97194da168926662e0e9f7f97f469
                                                                                                                • Instruction Fuzzy Hash: 13419435701A148FCB14DF29C594AAABBF5FFC9320B1580AAE909CB3A5DB30DC51CB60
                                                                                                                Function 0C55D558 Relevance: .1, Instructions: 119COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000016.00000002.4104243718.000000000C550000.00000040.00000800.00020000.00000000.sdmp, Offset: 0C550000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_22_2_c550000_FastestVPN.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: 9a154e6f22454e6d553ca3b1d9bd55546d939e52e178e24587a3f76e06eb0742
                                                                                                                • Instruction ID: 822162ab30cf4ef63ff8f03116a4fd59bff7c3ada690b9099370799c184352f4
                                                                                                                • Opcode Fuzzy Hash: 9a154e6f22454e6d553ca3b1d9bd55546d939e52e178e24587a3f76e06eb0742
                                                                                                                • Instruction Fuzzy Hash: FA31E736B002048FDB14DF69C964AAEBBF5EF89350F14456AD806E73A1CB31DC05CB50
                                                                                                                Function 0C40BB08 Relevance: .1, Instructions: 119COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000016.00000002.4103457864.000000000C400000.00000040.00000800.00020000.00000000.sdmp, Offset: 0C400000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_22_2_c400000_FastestVPN.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: cf5e0a9bd65f8e5294e4a5d746a24f41d4996bf480fec2ae7cd9cb0308c46bd3
                                                                                                                • Instruction ID: 8067479456e9322aa84e4ebf24dccda6aa73c7cf9b132fa11669a9c99e414184
                                                                                                                • Opcode Fuzzy Hash: cf5e0a9bd65f8e5294e4a5d746a24f41d4996bf480fec2ae7cd9cb0308c46bd3
                                                                                                                • Instruction Fuzzy Hash: FA415D74B446059FDB04EF68D954E6E7BF2FB89700F2040A9E905AB3A5DB709C01DB94
                                                                                                                Function 0AA4AAF0 Relevance: .1, Instructions: 119COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000016.00000002.4082922941.000000000AA40000.00000040.00000800.00020000.00000000.sdmp, Offset: 0AA40000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_22_2_aa40000_FastestVPN.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: a0007d4a49494fa5fe35c65d21896aedfb753a63e337d3c74d82e52f3951010c
                                                                                                                • Instruction ID: bb162f1ad281fee3641d1990b4d114804a778591889d9c398f8fa8b886e69dcb
                                                                                                                • Opcode Fuzzy Hash: a0007d4a49494fa5fe35c65d21896aedfb753a63e337d3c74d82e52f3951010c
                                                                                                                • Instruction Fuzzy Hash: 08312C333441109FDB259BADA4846EBB7E7EBC43B1B458176F60ACB251C662DC43CB90
                                                                                                                Function 0C40D0F0 Relevance: .1, Instructions: 118COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000016.00000002.4103457864.000000000C400000.00000040.00000800.00020000.00000000.sdmp, Offset: 0C400000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_22_2_c400000_FastestVPN.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: 2b88c4aa1225a715028fdcbec134d9d0739afc8b4fdd417362db4b0190fa76b9
                                                                                                                • Instruction ID: 0757ee7d618c49bfe190418cc99cd543c465c7b8277537ed2bfa337571706df3
                                                                                                                • Opcode Fuzzy Hash: 2b88c4aa1225a715028fdcbec134d9d0739afc8b4fdd417362db4b0190fa76b9
                                                                                                                • Instruction Fuzzy Hash: 1D515F31D00B5A9ADF11EFA9C8146DDF7B2FF85300F218B59D45877251EB70AA89CB80
                                                                                                                Function 0AA45E00 Relevance: .1, Instructions: 116COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000016.00000002.4082922941.000000000AA40000.00000040.00000800.00020000.00000000.sdmp, Offset: 0AA40000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_22_2_aa40000_FastestVPN.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: 878fa541a13c6c77f167fb082dec9b6ca338bf48a949d95da4bb06e3f7242359
                                                                                                                • Instruction ID: 8914fa06f2791e2e3b8dc84369e0503ae108ffe4e619d82da968c68f83ad6b4a
                                                                                                                • Opcode Fuzzy Hash: 878fa541a13c6c77f167fb082dec9b6ca338bf48a949d95da4bb06e3f7242359
                                                                                                                • Instruction Fuzzy Hash: 5E413634B04601DFC368EB39D45496A7BE3AFC931472589A8F607CB3AADE71DC018B95
                                                                                                                Function 0C556D9F Relevance: .1, Instructions: 115COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000016.00000002.4104243718.000000000C550000.00000040.00000800.00020000.00000000.sdmp, Offset: 0C550000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_22_2_c550000_FastestVPN.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: 1fec57e8a64afae31016f4a2504b5f2afcc04f2addd7f16c153f202d8b75ff1b
                                                                                                                • Instruction ID: 6555ab2e0fd2f463b199c7cedecbabcba31091789c0f7b78e75d2f56b1a72c54
                                                                                                                • Opcode Fuzzy Hash: 1fec57e8a64afae31016f4a2504b5f2afcc04f2addd7f16c153f202d8b75ff1b
                                                                                                                • Instruction Fuzzy Hash: A4418C34B00249CFDB14DF59C49496AF7F2FF89310B65866AE85AAB761DB30E841CF50
                                                                                                                Function 0C55BBD2 Relevance: .1, Instructions: 115COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000016.00000002.4104243718.000000000C550000.00000040.00000800.00020000.00000000.sdmp, Offset: 0C550000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_22_2_c550000_FastestVPN.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: 384eead84631632afa9649e8f51084e64ff603e63cc83e9f5eba7c2bc6670ba4
                                                                                                                • Instruction ID: bc2804d838054f9f21b81a20a6f47d9704e98881b7dc8e0a5f878d30fa7b5fc8
                                                                                                                • Opcode Fuzzy Hash: 384eead84631632afa9649e8f51084e64ff603e63cc83e9f5eba7c2bc6670ba4
                                                                                                                • Instruction Fuzzy Hash: BF41BF31A00249DBDB25DB65D859BAFB7F2FBC0302F508A2AD51257190CFB0AA49CBD1
                                                                                                                Function 0C407199 Relevance: .1, Instructions: 114COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000016.00000002.4103457864.000000000C400000.00000040.00000800.00020000.00000000.sdmp, Offset: 0C400000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_22_2_c400000_FastestVPN.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: d318e50a68e356be4735b27c7c107ada392c6bf5a31952ef8743fd7e3e711f5d
                                                                                                                • Instruction ID: 5eefd850bda91a391a1aa76de74441088e617cd9fef95f89fbcaef75dcba1797
                                                                                                                • Opcode Fuzzy Hash: d318e50a68e356be4735b27c7c107ada392c6bf5a31952ef8743fd7e3e711f5d
                                                                                                                • Instruction Fuzzy Hash: B0418870B006099FDB05DFA9D8909EEBBF6EF88310B10956EE905AB351DF71AD05CB90
                                                                                                                Function 0AA48828 Relevance: .1, Instructions: 114COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000016.00000002.4082922941.000000000AA40000.00000040.00000800.00020000.00000000.sdmp, Offset: 0AA40000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_22_2_aa40000_FastestVPN.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: 2ac5dcbdce29985c57f4e18d2149ffea0757144d06cb5a1a2e38c3f6b76d8c8f
                                                                                                                • Instruction ID: 8fdf705d9f197782ffce4392dc0c0e70a73163607206aef802e5cffe886ef355
                                                                                                                • Opcode Fuzzy Hash: 2ac5dcbdce29985c57f4e18d2149ffea0757144d06cb5a1a2e38c3f6b76d8c8f
                                                                                                                • Instruction Fuzzy Hash: A2415E35B002189FCB15EB64D9596AEB7F3EFC8310F284029E9069B3A5DE75AC02CB41
                                                                                                                Function 0C556D8E Relevance: .1, Instructions: 112COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000016.00000002.4104243718.000000000C550000.00000040.00000800.00020000.00000000.sdmp, Offset: 0C550000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_22_2_c550000_FastestVPN.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: 02df141ff9c7b80a446c6363c43c808dd85cecd37899a7831223cc582c5aaad3
                                                                                                                • Instruction ID: 681786831c8dd224d7badaead9bf216833fb45018cd98b0cb554d04a692085eb
                                                                                                                • Opcode Fuzzy Hash: 02df141ff9c7b80a446c6363c43c808dd85cecd37899a7831223cc582c5aaad3
                                                                                                                • Instruction Fuzzy Hash: DF416A39B006498FCB14CF59C09096AF7F2FF89314B65CA6AE81A9B760DB30E841CF54
                                                                                                                Function 0C55D6B1 Relevance: .1, Instructions: 112COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000016.00000002.4104243718.000000000C550000.00000040.00000800.00020000.00000000.sdmp, Offset: 0C550000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_22_2_c550000_FastestVPN.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: b3969c79c1b596e47c97f373f7b6813d87d7bc9aaeed55bc76040d1fc11cba5a
                                                                                                                • Instruction ID: ab47dc102dee16926fdf6f41005952e0077c8f0f4c9b02eba5b6b2ff85b5dc16
                                                                                                                • Opcode Fuzzy Hash: b3969c79c1b596e47c97f373f7b6813d87d7bc9aaeed55bc76040d1fc11cba5a
                                                                                                                • Instruction Fuzzy Hash: 164173397116058FCB14DF68C994E6EB7B2FFC8305B218169D9169B365EB31EC02CB61
                                                                                                                Function 0C406048 Relevance: .1, Instructions: 112COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000016.00000002.4103457864.000000000C400000.00000040.00000800.00020000.00000000.sdmp, Offset: 0C400000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_22_2_c400000_FastestVPN.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: d3b6ccc1a52bc5cdd61582b4b0110e41d0fcfea9b788e7e9ff973124e91de1dc
                                                                                                                • Instruction ID: 0e964ab11ba94397327064517340ca4f9583e78e1b110143490935ed425fafb8
                                                                                                                • Opcode Fuzzy Hash: d3b6ccc1a52bc5cdd61582b4b0110e41d0fcfea9b788e7e9ff973124e91de1dc
                                                                                                                • Instruction Fuzzy Hash: 0D318931B502058FCB08EFB5D9549BE7AF2BFC8201B21453AE916DB392DE349D01CB94
                                                                                                                Function 0C4071A8 Relevance: .1, Instructions: 110COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000016.00000002.4103457864.000000000C400000.00000040.00000800.00020000.00000000.sdmp, Offset: 0C400000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_22_2_c400000_FastestVPN.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: f6308058830a6e987b495d8805f9b520ed132bfad9512f2a7305fbc55d7f5cff
                                                                                                                • Instruction ID: 0ccd9576b7be4c9d1a6758761bcae6d49445255a62550e3851377598516645c7
                                                                                                                • Opcode Fuzzy Hash: f6308058830a6e987b495d8805f9b520ed132bfad9512f2a7305fbc55d7f5cff
                                                                                                                • Instruction Fuzzy Hash: E9419670B006099FDB05DFA9D8909DEBBF6EF88310B10916EE905AB350EF70ED058B90
                                                                                                                Function 0C554F00 Relevance: .1, Instructions: 109COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000016.00000002.4104243718.000000000C550000.00000040.00000800.00020000.00000000.sdmp, Offset: 0C550000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_22_2_c550000_FastestVPN.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: ae61f945cbec25eb494afe6e5cc9a7f643d4b5abb1938244a9e9932313327a56
                                                                                                                • Instruction ID: 228d0fc3e06310cc7572ae0ce8acfcf2209221c3349ad29df4ffadfce4212ffb
                                                                                                                • Opcode Fuzzy Hash: ae61f945cbec25eb494afe6e5cc9a7f643d4b5abb1938244a9e9932313327a56
                                                                                                                • Instruction Fuzzy Hash: 3E41BF74B11205EFCB00DBA8D955A9DBBB5FF89300F5086AAE5059B344DB31EE85CB90
                                                                                                                Function 0C5592B0 Relevance: .1, Instructions: 107COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000016.00000002.4104243718.000000000C550000.00000040.00000800.00020000.00000000.sdmp, Offset: 0C550000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_22_2_c550000_FastestVPN.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: e9320a2ea236b65fa259bf9ca06f70666dfb19c19269b077820a5ff91584dfe6
                                                                                                                • Instruction ID: a0cdb3cf9cb47ea858a06fad97f4c2688547c053f296edf406950f9016a9ae66
                                                                                                                • Opcode Fuzzy Hash: e9320a2ea236b65fa259bf9ca06f70666dfb19c19269b077820a5ff91584dfe6
                                                                                                                • Instruction Fuzzy Hash: F7414A31909389CFCB02DBA8C4A599D7FB0EF4A214B0505DBC481AB3A2DA74A949DB52
                                                                                                                Function 0C40B010 Relevance: .1, Instructions: 106COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000016.00000002.4103457864.000000000C400000.00000040.00000800.00020000.00000000.sdmp, Offset: 0C400000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_22_2_c400000_FastestVPN.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: b937bb0204441df05e0fc864750bbf3d4abb487270df857744ce7707dcba6ef2
                                                                                                                • Instruction ID: 60ba0695f8f8de5474af5b80c233420af5bf1cc77782b9aae831698ee7b92135
                                                                                                                • Opcode Fuzzy Hash: b937bb0204441df05e0fc864750bbf3d4abb487270df857744ce7707dcba6ef2
                                                                                                                • Instruction Fuzzy Hash: 2B417C71F016099FDB09DF94E940A9EBBF6FF89310F2041AAE805AB345DB70AD45CB84
                                                                                                                Function 0C551A60 Relevance: .1, Instructions: 105COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000016.00000002.4104243718.000000000C550000.00000040.00000800.00020000.00000000.sdmp, Offset: 0C550000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_22_2_c550000_FastestVPN.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: a530ddf23e2fdaccbfbd6febf68a7b362c6a462456549eadb9b9b966c4031d97
                                                                                                                • Instruction ID: 0d4fcadadfacfb24fd88424f2048af5f82b238715b8ad84db0ade313b19aa196
                                                                                                                • Opcode Fuzzy Hash: a530ddf23e2fdaccbfbd6febf68a7b362c6a462456549eadb9b9b966c4031d97
                                                                                                                • Instruction Fuzzy Hash: 72317239B005548FDB05DBA9D854B6EBFB7FBC8310F15816AE909DB366CE759C028B80
                                                                                                                Function 0C5502D0 Relevance: .1, Instructions: 105COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000016.00000002.4104243718.000000000C550000.00000040.00000800.00020000.00000000.sdmp, Offset: 0C550000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_22_2_c550000_FastestVPN.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: c86cbb99a9d898f30c42a8157098327cd28b5967eaa51f4a9616de9b4990afa5
                                                                                                                • Instruction ID: fa185369b27deb8137b52f39a66168ad9093aa74b79ea8e043084521190f7444
                                                                                                                • Opcode Fuzzy Hash: c86cbb99a9d898f30c42a8157098327cd28b5967eaa51f4a9616de9b4990afa5
                                                                                                                • Instruction Fuzzy Hash: A941F138701549CFEB11DFA9D4A4BAE7BE2BFC4300F1581AAD904AB2D5DB70C941D7A0
                                                                                                                Function 0C40B4A0 Relevance: .1, Instructions: 104COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000016.00000002.4103457864.000000000C400000.00000040.00000800.00020000.00000000.sdmp, Offset: 0C400000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_22_2_c400000_FastestVPN.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: 9dbcb0ebffdfdd7fdf2e8032642ce0bce43b19f67bff00f141e5a1f76eda0a52
                                                                                                                • Instruction ID: bacd9179bc238ed738341b16880c380322d47247cab03a286e8ff38bfe3a4d06
                                                                                                                • Opcode Fuzzy Hash: 9dbcb0ebffdfdd7fdf2e8032642ce0bce43b19f67bff00f141e5a1f76eda0a52
                                                                                                                • Instruction Fuzzy Hash: 2441CE30B002449FDB2AAB75E454AAE7BB2FF89304F2444BED402AB380DF759D41CB91
                                                                                                                Function 0C5598C0 Relevance: .1, Instructions: 103COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000016.00000002.4104243718.000000000C550000.00000040.00000800.00020000.00000000.sdmp, Offset: 0C550000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_22_2_c550000_FastestVPN.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: 3151491b06f7d5a9deb548a0d4f8aa12ca73ddbe5bdb45c544909384ff5e5409
                                                                                                                • Instruction ID: 98ba36c86ce02af96331d75c7f60c1a74299e90b09fec855ae462aa490b9a2ab
                                                                                                                • Opcode Fuzzy Hash: 3151491b06f7d5a9deb548a0d4f8aa12ca73ddbe5bdb45c544909384ff5e5409
                                                                                                                • Instruction Fuzzy Hash: 3131907A701105CFCB10DFA9D850AAAF7FAFF84250B14C27AD919D7305DB34E8068791
                                                                                                                Function 0C55E620 Relevance: .1, Instructions: 103COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000016.00000002.4104243718.000000000C550000.00000040.00000800.00020000.00000000.sdmp, Offset: 0C550000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_22_2_c550000_FastestVPN.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: b8085157255303e5dbd65d1b4471ce1613f5c0aeb771a99c62cc7d309c45f39a
                                                                                                                • Instruction ID: 5311d57184d7baee29d7df1ff7c51aa40fa3d608ce6630b76672b84a6eb54e4c
                                                                                                                • Opcode Fuzzy Hash: b8085157255303e5dbd65d1b4471ce1613f5c0aeb771a99c62cc7d309c45f39a
                                                                                                                • Instruction Fuzzy Hash: F7418D307042558FCB55DB29D898A6EBBFAAF89300B04496DE546C7361DB74E905CB50
                                                                                                                Function 0C558A6A Relevance: .1, Instructions: 102COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000016.00000002.4104243718.000000000C550000.00000040.00000800.00020000.00000000.sdmp, Offset: 0C550000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_22_2_c550000_FastestVPN.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: f641184aa4e58e68ff77bd2ad52757feb4b58dffdaf15640d2b01afd3e10bacb
                                                                                                                • Instruction ID: eb2f1fb5669da0b09b5f090caef9209c755f8adac8e7edeb8bb287cb1f2c5444
                                                                                                                • Opcode Fuzzy Hash: f641184aa4e58e68ff77bd2ad52757feb4b58dffdaf15640d2b01afd3e10bacb
                                                                                                                • Instruction Fuzzy Hash: 37316F38B402059BDB55CB55C894B9EBBF6EF88720F248059E805BB391CA719D02CB90
                                                                                                                Function 0AA45578 Relevance: .1, Instructions: 100COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000016.00000002.4082922941.000000000AA40000.00000040.00000800.00020000.00000000.sdmp, Offset: 0AA40000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_22_2_aa40000_FastestVPN.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: 7ed4a0c310f37c0315b1d845c8fdf749d73315e03d7d5c6ec4d7d1904817e3a3
                                                                                                                • Instruction ID: 13ca86d6875b4aaca17b4d0c9abbfe73d3175386774a82adc37793a942d10e03
                                                                                                                • Opcode Fuzzy Hash: 7ed4a0c310f37c0315b1d845c8fdf749d73315e03d7d5c6ec4d7d1904817e3a3
                                                                                                                • Instruction Fuzzy Hash: C3315935B012019FDB55DF38D484AAEBBB6BF89300B148569E906CB395DB71ED06CB90
                                                                                                                Function 0C4038F0 Relevance: .1, Instructions: 99COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000016.00000002.4103457864.000000000C400000.00000040.00000800.00020000.00000000.sdmp, Offset: 0C400000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_22_2_c400000_FastestVPN.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: 6b8ec307e7918db1a7a1817c11a0cd64c0edeed883b33a32a995e05c41cb5145
                                                                                                                • Instruction ID: 7b7979497f11b892f0869f37f35055f58361a637c294b3667045432ee69e5fed
                                                                                                                • Opcode Fuzzy Hash: 6b8ec307e7918db1a7a1817c11a0cd64c0edeed883b33a32a995e05c41cb5145
                                                                                                                • Instruction Fuzzy Hash: 4D313E76B0010AAF8F11DFA5E8408EFBFBAFB89251B148026F915D3251D731DA25DBA0
                                                                                                                Function 0C55B8CA Relevance: .1, Instructions: 98COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000016.00000002.4104243718.000000000C550000.00000040.00000800.00020000.00000000.sdmp, Offset: 0C550000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_22_2_c550000_FastestVPN.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: c7a7145ace3ade2180731ef5866352d5c6ac8626cdb26b7615e2713003792343
                                                                                                                • Instruction ID: 50530d3cdddad27294c727f86d0717288ba9807577e008e04fc99b0f3d6c5ae4
                                                                                                                • Opcode Fuzzy Hash: c7a7145ace3ade2180731ef5866352d5c6ac8626cdb26b7615e2713003792343
                                                                                                                • Instruction Fuzzy Hash: 09315D79B01105CFCB14DF69D4A4AAEBBB2FFC8310B1485AAE9059B355DB31EC01CB91
                                                                                                                Function 0C4039E2 Relevance: .1, Instructions: 96COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000016.00000002.4103457864.000000000C400000.00000040.00000800.00020000.00000000.sdmp, Offset: 0C400000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_22_2_c400000_FastestVPN.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: 2ee54d259643bf3282d3dc3465d823f2e71dac7b25e527fd1358cc1b4741551c
                                                                                                                • Instruction ID: 8fee058734730ecb58d77cf5312ac33843088cae6aa21bd32141fd0d83dc3113
                                                                                                                • Opcode Fuzzy Hash: 2ee54d259643bf3282d3dc3465d823f2e71dac7b25e527fd1358cc1b4741551c
                                                                                                                • Instruction Fuzzy Hash: 75310439744505EFDB05CF58C584C69BBB2FB89320B25C5AAEC16CB3A6C731E951CB80
                                                                                                                Function 0AA45588 Relevance: .1, Instructions: 96COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000016.00000002.4082922941.000000000AA40000.00000040.00000800.00020000.00000000.sdmp, Offset: 0AA40000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_22_2_aa40000_FastestVPN.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: 01589046b4b4b51d406b8fac7cbe9c6ecdbaed7f65f6a58a778480a30d5000cf
                                                                                                                • Instruction ID: 427fce1cf9e159443120386b1ae69b69437cde63c7855f16d92c5243012d080c
                                                                                                                • Opcode Fuzzy Hash: 01589046b4b4b51d406b8fac7cbe9c6ecdbaed7f65f6a58a778480a30d5000cf
                                                                                                                • Instruction Fuzzy Hash: 92318835B01201DFDB09DF38D8849AEBBB6BF89300B108068E906CB395DB71ED01CB90
                                                                                                                Function 0C40B48A Relevance: .1, Instructions: 92COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000016.00000002.4103457864.000000000C400000.00000040.00000800.00020000.00000000.sdmp, Offset: 0C400000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_22_2_c400000_FastestVPN.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: 75efcc5a858bac4e961c03b692bc262247e171fddbc740eb5ab047981bcb542f
                                                                                                                • Instruction ID: 139eeb313a7f7c04da2515def21dfded1acbdf6c104d86671b2cb29049150c19
                                                                                                                • Opcode Fuzzy Hash: 75efcc5a858bac4e961c03b692bc262247e171fddbc740eb5ab047981bcb542f
                                                                                                                • Instruction Fuzzy Hash: 3B31C030B053848FDB2ADB79D450AAE7BB2AF99304F2484BEC4029B781CF359D45CB65
                                                                                                                Function 0C5527B0 Relevance: .1, Instructions: 91COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000016.00000002.4104243718.000000000C550000.00000040.00000800.00020000.00000000.sdmp, Offset: 0C550000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_22_2_c550000_FastestVPN.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: 5c65fe8b71cb69a94c3238f85e839c59e677c14c3dcc9e9f4f0d90f188b2e3eb
                                                                                                                • Instruction ID: 54ca999c1b387620fc69be44a49f7fd62c7110d07e3538b7d904f55db53171b1
                                                                                                                • Opcode Fuzzy Hash: 5c65fe8b71cb69a94c3238f85e839c59e677c14c3dcc9e9f4f0d90f188b2e3eb
                                                                                                                • Instruction Fuzzy Hash: FF21E2393042048FDB18DB6DE85492A3BE6BFCA310B5845AAE64ACB751DF31DC02D790
                                                                                                                Function 0C40C758 Relevance: .1, Instructions: 86COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000016.00000002.4103457864.000000000C400000.00000040.00000800.00020000.00000000.sdmp, Offset: 0C400000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_22_2_c400000_FastestVPN.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: a3f8aeed9308a6d77da9eac9fdd396cb73f38f62f3262feaf0902e8974cd3c02
                                                                                                                • Instruction ID: 869cba9c84c6da55ecd50489b9413d7221eef8463d8d0f219c21d673815936a1
                                                                                                                • Opcode Fuzzy Hash: a3f8aeed9308a6d77da9eac9fdd396cb73f38f62f3262feaf0902e8974cd3c02
                                                                                                                • Instruction Fuzzy Hash: EC318071A40605DFCB05DB68C845AAEBBF2FFC8210F24862AD4169B391EF74AD05CF91
                                                                                                                Function 0AA4B510 Relevance: .1, Instructions: 85COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000016.00000002.4082922941.000000000AA40000.00000040.00000800.00020000.00000000.sdmp, Offset: 0AA40000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_22_2_aa40000_FastestVPN.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: f52b0f93811254bb0f9abbf07e987c55ba93325609727e7acab3d8047526bd4c
                                                                                                                • Instruction ID: 1b8bb705d28e49e27e91fee68af878b068cfc66a5bca6751968cce5ef9a74776
                                                                                                                • Opcode Fuzzy Hash: f52b0f93811254bb0f9abbf07e987c55ba93325609727e7acab3d8047526bd4c
                                                                                                                • Instruction Fuzzy Hash: 53216D357006558FCB14EF39D8504AEBBF6AFC965071581A9E906DB3A5DB30DC01CBA1
                                                                                                                Function 0C55B8D8 Relevance: .1, Instructions: 83COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000016.00000002.4104243718.000000000C550000.00000040.00000800.00020000.00000000.sdmp, Offset: 0C550000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_22_2_c550000_FastestVPN.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: ded23ad18c674e973491b0710887195bf984cdce8a6ef187c2b922e16cb6208e
                                                                                                                • Instruction ID: 66e382ef57be8d9771729be563287331cb235e3085c219afc2d239e7cf0d10a1
                                                                                                                • Opcode Fuzzy Hash: ded23ad18c674e973491b0710887195bf984cdce8a6ef187c2b922e16cb6208e
                                                                                                                • Instruction Fuzzy Hash: 63314878B001058FCB14DF69C4A4A6EBBB6FFC8310B1485AAED459B354DB31EC01CBA0
                                                                                                                Function 00CAECD0 Relevance: .1, Instructions: 83COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000016.00000002.4015189538.0000000000CAD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00CAD000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_22_2_cad000_FastestVPN.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: f3c0cf242da0457e52ba76ec4ecb6d8c7e284971c8f288b9bf04f4aa06eabf3b
                                                                                                                • Instruction ID: 1cf43bc1c2e40ff9559de7d4500045ecaa6851c8333ff00ed4240b4bb256676c
                                                                                                                • Opcode Fuzzy Hash: f3c0cf242da0457e52ba76ec4ecb6d8c7e284971c8f288b9bf04f4aa06eabf3b
                                                                                                                • Instruction Fuzzy Hash: B4310772500241EFDF069F54D9C0F26BF66FB88328F248598ED090E266C336D866DBA1
                                                                                                                Function 00CAE1FC Relevance: .1, Instructions: 83COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000016.00000002.4015189538.0000000000CAD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00CAD000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_22_2_cad000_FastestVPN.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: 93fe164fe00044657358b3e8efecdf5a170e3cbe389fc7616e968c240bb892e1
                                                                                                                • Instruction ID: 243cf8e4d75e04c8f344610e895a9e4627a3ab80bfac203e75dea6fd4320dd55
                                                                                                                • Opcode Fuzzy Hash: 93fe164fe00044657358b3e8efecdf5a170e3cbe389fc7616e968c240bb892e1
                                                                                                                • Instruction Fuzzy Hash: 6931D776100240EFDF059F54D9C0F267F6AFB89318F248698EE094E266C337D866DB91
                                                                                                                Function 0C40BCE8 Relevance: .1, Instructions: 81COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000016.00000002.4103457864.000000000C400000.00000040.00000800.00020000.00000000.sdmp, Offset: 0C400000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_22_2_c400000_FastestVPN.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: a72f51137eefd375bfef45781705972d73d6bba8bdd06a69aa55a1845a5a4066
                                                                                                                • Instruction ID: c46bffe4fd26db5ba2401f279f2c6ba56f7541f385083dc1d9ac405d74b7422d
                                                                                                                • Opcode Fuzzy Hash: a72f51137eefd375bfef45781705972d73d6bba8bdd06a69aa55a1845a5a4066
                                                                                                                • Instruction Fuzzy Hash: 6D316C31B406158BDB28DF25C818BAEBBF2FF88301F24457AD452A7791DB74AD04CB95
                                                                                                                Function 0C550760 Relevance: .1, Instructions: 80COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000016.00000002.4104243718.000000000C550000.00000040.00000800.00020000.00000000.sdmp, Offset: 0C550000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_22_2_c550000_FastestVPN.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: c7272a69f88c8e4fca22ae20083e30c1158283004cf32c4de6f5d8973c0dafe2
                                                                                                                • Instruction ID: 24e62a6efa62a22a242ab483bc8804fb4b6d64e60630109c8582aa1dce2c4dff
                                                                                                                • Opcode Fuzzy Hash: c7272a69f88c8e4fca22ae20083e30c1158283004cf32c4de6f5d8973c0dafe2
                                                                                                                • Instruction Fuzzy Hash: 10319335A01608DFDB05ABA8D864BAEBFB2FBC8350F144069E801A7399CB715C42DB90
                                                                                                                Function 00CAEBD4 Relevance: .1, Instructions: 80COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000016.00000002.4015189538.0000000000CAD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00CAD000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_22_2_cad000_FastestVPN.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: 64989e6ef90f7211737f35dbdb2073c6d59683dd6d566a2172a0f1d04ab4e865
                                                                                                                • Instruction ID: 6e57dc59c22109987cc53a9cd0400759aac0309882863c2239e6aa8af65e6bb1
                                                                                                                • Opcode Fuzzy Hash: 64989e6ef90f7211737f35dbdb2073c6d59683dd6d566a2172a0f1d04ab4e865
                                                                                                                • Instruction Fuzzy Hash: D221E7B2504241EFCF059F55D9C4B26BF65FB8832CF248599ED090A256C336D816DBA1
                                                                                                                Function 0C40D731 Relevance: .1, Instructions: 78COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000016.00000002.4103457864.000000000C400000.00000040.00000800.00020000.00000000.sdmp, Offset: 0C400000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_22_2_c400000_FastestVPN.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: 65a41a1792004fbc7307dcdee409df6de5bef8757322ef65c52f21b84155235f
                                                                                                                • Instruction ID: e6eeb0029efa3c25b35d7ca24ddbc9460b245aef52dab94cc73d6639e630b4da
                                                                                                                • Opcode Fuzzy Hash: 65a41a1792004fbc7307dcdee409df6de5bef8757322ef65c52f21b84155235f
                                                                                                                • Instruction Fuzzy Hash: 7B216B31F012448FCB16DFADD490ADEBBF5FF89300B2481AAD515AB355DB35AD098BA0
                                                                                                                Function 0AA4A758 Relevance: .1, Instructions: 78COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000016.00000002.4082922941.000000000AA40000.00000040.00000800.00020000.00000000.sdmp, Offset: 0AA40000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_22_2_aa40000_FastestVPN.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: 9ad00fcb8a1c4e5805d89c88c62c4bc6a55e9416b6d5f20faa365668b2d84245
                                                                                                                • Instruction ID: 64c4262a0192ba9a3a9346a4d53cf02f75b1dfee6d5ebf939fd40f0b7dba887e
                                                                                                                • Opcode Fuzzy Hash: 9ad00fcb8a1c4e5805d89c88c62c4bc6a55e9416b6d5f20faa365668b2d84245
                                                                                                                • Instruction Fuzzy Hash: 6C315E75601205DFC724CF64D584AAA77F5FF89354B258469F806DB3A1DB30ED41CBA0
                                                                                                                Function 00C9D6B0 Relevance: .1, Instructions: 77COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000016.00000002.4014918783.0000000000C9D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C9D000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_22_2_c9d000_FastestVPN.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: 3281e64d6d6cfa5bec23807d5a9e81307c677d7beea7fc66650fa8538db046ee
                                                                                                                • Instruction ID: 451ce8221790c36c3ce0875cb631aa90253de89d7cd202003ee91eb6c10eb884
                                                                                                                • Opcode Fuzzy Hash: 3281e64d6d6cfa5bec23807d5a9e81307c677d7beea7fc66650fa8538db046ee
                                                                                                                • Instruction Fuzzy Hash: 08213A76504244EFCF05DF50D9C4F26BFA6FB88314F24C669E90A1B25AC336D856CBA1
                                                                                                                Function 0C406038 Relevance: .1, Instructions: 77COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000016.00000002.4103457864.000000000C400000.00000040.00000800.00020000.00000000.sdmp, Offset: 0C400000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_22_2_c400000_FastestVPN.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: 7fafccec466fbfb17d77b6af937038b97b801742b6e6c6fb7c7aeac35c9bc923
                                                                                                                • Instruction ID: 0bfb8e95a07d8fefc91e8cb2d94cf6f50998ebae47b846320aeca017f11fef86
                                                                                                                • Opcode Fuzzy Hash: 7fafccec466fbfb17d77b6af937038b97b801742b6e6c6fb7c7aeac35c9bc923
                                                                                                                • Instruction Fuzzy Hash: 0C218D75B502158FCB08EF65D9949BEBBB6FF88300B21857AD916D73A1DB309D01CB90
                                                                                                                Function 0C5599D0 Relevance: .1, Instructions: 75COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000016.00000002.4104243718.000000000C550000.00000040.00000800.00020000.00000000.sdmp, Offset: 0C550000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_22_2_c550000_FastestVPN.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: 56c50e13b690a5f3c83ba458d45b36fb5bdc55bc4a9d8ebe8b8af197b8db8336
                                                                                                                • Instruction ID: 94dbcafff216750c2de5a39a0105bb850593149ade526c0276f72ce5ca2fe855
                                                                                                                • Opcode Fuzzy Hash: 56c50e13b690a5f3c83ba458d45b36fb5bdc55bc4a9d8ebe8b8af197b8db8336
                                                                                                                • Instruction Fuzzy Hash: 67210739B0110ACFEB04EB76D8446BE77A6FFC4340F1081B6E90587245EB70E802C791
                                                                                                                Function 0C554728 Relevance: .1, Instructions: 75COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000016.00000002.4104243718.000000000C550000.00000040.00000800.00020000.00000000.sdmp, Offset: 0C550000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_22_2_c550000_FastestVPN.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: f4c9c8b451acd63f6521d6e2c686cf5f18300ff829503822ad35dd407b15e3e4
                                                                                                                • Instruction ID: 78504af46ba465e730048df4d61345da590eb8a3c0364a4844f32cc556249fcd
                                                                                                                • Opcode Fuzzy Hash: f4c9c8b451acd63f6521d6e2c686cf5f18300ff829503822ad35dd407b15e3e4
                                                                                                                • Instruction Fuzzy Hash: BC21A734B10104DFDB049B69C469AAE7BF6FF89740F20845AE906A7394CB715D42CF94
                                                                                                                Function 00C9D524 Relevance: .1, Instructions: 75COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000016.00000002.4014918783.0000000000C9D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C9D000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_22_2_c9d000_FastestVPN.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: 1d74a9a826747937edd007cf16aded7137cef567aa35ee643c7324a3990d0254
                                                                                                                • Instruction ID: 6e7d2b30dabb112bf9084dea4402569c9681de9a5e6ec9f36eed7fae86fe1539
                                                                                                                • Opcode Fuzzy Hash: 1d74a9a826747937edd007cf16aded7137cef567aa35ee643c7324a3990d0254
                                                                                                                • Instruction Fuzzy Hash: 482145F2504244EFCF05DF14D9C4B2ABF65FB88318F20C569E90A1B256C336D916CBA1
                                                                                                                Function 0C550448 Relevance: .1, Instructions: 74COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000016.00000002.4104243718.000000000C550000.00000040.00000800.00020000.00000000.sdmp, Offset: 0C550000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_22_2_c550000_FastestVPN.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: 32c0dc7b6d158cd6e1b2d6aba0224633164866c049d77c5b00824620e4dc533f
                                                                                                                • Instruction ID: 26cb4efabceeb70280a62b66e1e0f111266b37f5c015bd6894701887e234b53e
                                                                                                                • Opcode Fuzzy Hash: 32c0dc7b6d158cd6e1b2d6aba0224633164866c049d77c5b00824620e4dc533f
                                                                                                                • Instruction Fuzzy Hash: 2B21B034B006498FDB04EBB5D8646AE7BF6AFC8300F145869D902EB395DFB49D048BA0
                                                                                                                Function 0C559D90 Relevance: .1, Instructions: 72COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000016.00000002.4104243718.000000000C550000.00000040.00000800.00020000.00000000.sdmp, Offset: 0C550000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_22_2_c550000_FastestVPN.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: e5eebf8b2a7282bf534088c8cec9ab05dc91eeaebdbb14201549b53fc72ef901
                                                                                                                • Instruction ID: eb44e08c19641653a85e8c6b52caa05d67c2bb250366df7d62dd6dda9cee156f
                                                                                                                • Opcode Fuzzy Hash: e5eebf8b2a7282bf534088c8cec9ab05dc91eeaebdbb14201549b53fc72ef901
                                                                                                                • Instruction Fuzzy Hash: CE113339714204CFDB14DA6DD890A6BB7DAEFC8260754853BEE0ACB745EE75EC028790
                                                                                                                Function 00CAD01C Relevance: .1, Instructions: 72COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000016.00000002.4015189538.0000000000CAD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00CAD000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_22_2_cad000_FastestVPN.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: ce80d6669402d1f74492d430a3e9ffde4751510be511d59a98ac3db3046a38c6
                                                                                                                • Instruction ID: 2270b801153fe77ba21ed0700fc779e0e4499f7e8c90dfdc5348f11db5c80fc4
                                                                                                                • Opcode Fuzzy Hash: ce80d6669402d1f74492d430a3e9ffde4751510be511d59a98ac3db3046a38c6
                                                                                                                • Instruction Fuzzy Hash: 13213475604305EFCB14DF24D9C0B26BB61FB89318F20C56DE90B4B692C77AD807CA61
                                                                                                                Function 00CAD320 Relevance: .1, Instructions: 72COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000016.00000002.4015189538.0000000000CAD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00CAD000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_22_2_cad000_FastestVPN.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: 07e3f2c996c34bddb9885cacba4401cfc0dcae1e28e167c92310156809dd05b7
                                                                                                                • Instruction ID: 8af13fcb58599811c624ab70fdec7c6c3cc74c56f2bfbe8dfadc6fa6662a5bbd
                                                                                                                • Opcode Fuzzy Hash: 07e3f2c996c34bddb9885cacba4401cfc0dcae1e28e167c92310156809dd05b7
                                                                                                                • Instruction Fuzzy Hash: 3A2149B5604205DFCF04DF14D5C0B26BB71FB85318F20C5ADE94B4B662C37AD846CA62
                                                                                                                Function 0C40BCD8 Relevance: .1, Instructions: 72COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000016.00000002.4103457864.000000000C400000.00000040.00000800.00020000.00000000.sdmp, Offset: 0C400000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_22_2_c400000_FastestVPN.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: f02852638b54434d9f9559a8451347c2fd4ca3f8c10400bdebcb4a0e55c354ec
                                                                                                                • Instruction ID: ecf8aea696d6f6cb0a6c67838f55381ad55ec9e780079ae3cc9d795a4ddff871
                                                                                                                • Opcode Fuzzy Hash: f02852638b54434d9f9559a8451347c2fd4ca3f8c10400bdebcb4a0e55c354ec
                                                                                                                • Instruction Fuzzy Hash: 8B21BF317006548FDB25DF28C818BAEBBF2BF88301F2445AAD442E77A2DB74AC04CB54
                                                                                                                Function 0AA46308 Relevance: .1, Instructions: 72COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000016.00000002.4082922941.000000000AA40000.00000040.00000800.00020000.00000000.sdmp, Offset: 0AA40000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_22_2_aa40000_FastestVPN.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: 5cd4b5d2b04386e143a6dcbaf4357e542b2f18c5d8f00a87ad145cb9bf987bf0
                                                                                                                • Instruction ID: 02f7c3737bd682a3ef21b261da8c0d4243c402ec84c0d52b6cd1052a3dffce29
                                                                                                                • Opcode Fuzzy Hash: 5cd4b5d2b04386e143a6dcbaf4357e542b2f18c5d8f00a87ad145cb9bf987bf0
                                                                                                                • Instruction Fuzzy Hash: A6218B32B001558FCB14EF68D5949AEBBE6EFC9300B1440A9E506DB3A2DB31DC02CB91
                                                                                                                Function 0AA45CA0 Relevance: .1, Instructions: 72COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000016.00000002.4082922941.000000000AA40000.00000040.00000800.00020000.00000000.sdmp, Offset: 0AA40000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_22_2_aa40000_FastestVPN.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: 68c3559a3cf7c30fb87809bc23ece439bf787d241dd49fa3349903691b597c16
                                                                                                                • Instruction ID: 2b67bf992c6ae99025c7cf654c88a3c343e5104c8ea6069c90dd4a90323f2695
                                                                                                                • Opcode Fuzzy Hash: 68c3559a3cf7c30fb87809bc23ece439bf787d241dd49fa3349903691b597c16
                                                                                                                • Instruction Fuzzy Hash: 5121A4317046419FC724DB2DD4909A67BD6EFC931432486ADE599CB3A2DB31EC02CB80
                                                                                                                Function 0AA4CCC8 Relevance: .1, Instructions: 72COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000016.00000002.4082922941.000000000AA40000.00000040.00000800.00020000.00000000.sdmp, Offset: 0AA40000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_22_2_aa40000_FastestVPN.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: aa3873c4a04ee9b28944a4def56b4bbf878431a345f2e342226a56c2c5f10239
                                                                                                                • Instruction ID: e39a13377af33c4fa528789fd206a1972fcfbf8dc30901f4689655dda5ca4fae
                                                                                                                • Opcode Fuzzy Hash: aa3873c4a04ee9b28944a4def56b4bbf878431a345f2e342226a56c2c5f10239
                                                                                                                • Instruction Fuzzy Hash: 44219234601914CFCB24CF28C594AAABBB4FFC8310F1580A9E8099B2A5D730EC51CF60
                                                                                                                Function 0C559750 Relevance: .1, Instructions: 70COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000016.00000002.4104243718.000000000C550000.00000040.00000800.00020000.00000000.sdmp, Offset: 0C550000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_22_2_c550000_FastestVPN.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: 34ec4f158fceb6b6ab7a17c57e93c42a3cc13892a71a16b2a07016942fb486bd
                                                                                                                • Instruction ID: 529df426ed4930228c99b44926b0a0e2a960bd02075f31fb22a9f577d3dfa6af
                                                                                                                • Opcode Fuzzy Hash: 34ec4f158fceb6b6ab7a17c57e93c42a3cc13892a71a16b2a07016942fb486bd
                                                                                                                • Instruction Fuzzy Hash: 2D11733A3052058F97149AAFA89496BF7DEEFC9274324823BE90DC7758EE61DC014790
                                                                                                                Function 0AA4E9F8 Relevance: .1, Instructions: 70COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000016.00000002.4082922941.000000000AA40000.00000040.00000800.00020000.00000000.sdmp, Offset: 0AA40000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_22_2_aa40000_FastestVPN.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: 27706a5e674e2a0e2d98ae984e83a5dc8f98aaf9d3d7b5f40b782dc65466e480
                                                                                                                • Instruction ID: 5c9a3fb94e1f91f90cbad88a5fc71f24615cf1d338198d61121c73f2faf5fdbd
                                                                                                                • Opcode Fuzzy Hash: 27706a5e674e2a0e2d98ae984e83a5dc8f98aaf9d3d7b5f40b782dc65466e480
                                                                                                                • Instruction Fuzzy Hash: D4114F323252108BD7246F7AB4486EEB7EEFBC1666314507AE10ACB285CF65DC42CB91
                                                                                                                Function 0AA4DD28 Relevance: .1, Instructions: 70COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000016.00000002.4082922941.000000000AA40000.00000040.00000800.00020000.00000000.sdmp, Offset: 0AA40000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_22_2_aa40000_FastestVPN.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: 4aae1fa6988f8969426fd555d1f92e7b6652c1e7b79c028cf7e7eeb28ec5abdf
                                                                                                                • Instruction ID: f62cf42b8778907ccae913b51c06fe925053970c8e416640bd4ad75a7b3ebd30
                                                                                                                • Opcode Fuzzy Hash: 4aae1fa6988f8969426fd555d1f92e7b6652c1e7b79c028cf7e7eeb28ec5abdf
                                                                                                                • Instruction Fuzzy Hash: C621AF317013409FD7259F34D854A5A7FB6EFC6314F1584AAE5468B3A2CBB0ED45CB90
                                                                                                                Function 0C5599BF Relevance: .1, Instructions: 68COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000016.00000002.4104243718.000000000C550000.00000040.00000800.00020000.00000000.sdmp, Offset: 0C550000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_22_2_c550000_FastestVPN.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: 49a9dc061f919a498588d0029cef80121112c188a84ad1c2eb4a5bef9c278a2b
                                                                                                                • Instruction ID: 58572d878c880ef2bbd49203710cef465fc095713792a3bd560da4bc409de7fd
                                                                                                                • Opcode Fuzzy Hash: 49a9dc061f919a498588d0029cef80121112c188a84ad1c2eb4a5bef9c278a2b
                                                                                                                • Instruction Fuzzy Hash: 7521D538701106DFEB14EF76D958BB93BA6FFC4340F1081AAE9019B255EB74E802C751
                                                                                                                Function 0C404AD0 Relevance: .1, Instructions: 67COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000016.00000002.4103457864.000000000C400000.00000040.00000800.00020000.00000000.sdmp, Offset: 0C400000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_22_2_c400000_FastestVPN.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: aea004bcebe75c33be24275578fbe991a2a5ed59608c2f8321fcd0cf4672c804
                                                                                                                • Instruction ID: e48d9fb9969eed79f725c25a4f22b0f1f515bbd2034d43a0a7e79dd49aa57aa0
                                                                                                                • Opcode Fuzzy Hash: aea004bcebe75c33be24275578fbe991a2a5ed59608c2f8321fcd0cf4672c804
                                                                                                                • Instruction Fuzzy Hash: 87215175A01216DFCB14CF65C544D6ABFF2FF88310B208169E908AB361D730ED41CB90
                                                                                                                Function 0AA4BFC8 Relevance: .1, Instructions: 67COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000016.00000002.4082922941.000000000AA40000.00000040.00000800.00020000.00000000.sdmp, Offset: 0AA40000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_22_2_aa40000_FastestVPN.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: d16d49934f95e7bd405e4eab2c970c4025a8b957f3d6082f7defe089ee4b5387
                                                                                                                • Instruction ID: 8be839166754840780501df51d2d6adf419a0dece459b5ab2990a22926c78011
                                                                                                                • Opcode Fuzzy Hash: d16d49934f95e7bd405e4eab2c970c4025a8b957f3d6082f7defe089ee4b5387
                                                                                                                • Instruction Fuzzy Hash: 3211C132B052104FC326DA689C50BABBBE6EBC9660F19417AEA05DB395DE70DC01C7A4
                                                                                                                Function 0AA4EB48 Relevance: .1, Instructions: 66COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000016.00000002.4082922941.000000000AA40000.00000040.00000800.00020000.00000000.sdmp, Offset: 0AA40000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_22_2_aa40000_FastestVPN.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: 359c07da6b2cee7edf40e8033807e93710cc0de7d74975e426b49a9306a8f653
                                                                                                                • Instruction ID: dedcf61dde13cb37d3db15b03387233b2b582d946d30100f06b4344774fdc205
                                                                                                                • Opcode Fuzzy Hash: 359c07da6b2cee7edf40e8033807e93710cc0de7d74975e426b49a9306a8f653
                                                                                                                • Instruction Fuzzy Hash: 271196317043409FD7358F65E480992BBA6FFC1225B1485AEE54A87752C771EC45CB50
                                                                                                                Function 0AA43EB8 Relevance: .1, Instructions: 65COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000016.00000002.4082922941.000000000AA40000.00000040.00000800.00020000.00000000.sdmp, Offset: 0AA40000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_22_2_aa40000_FastestVPN.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: 84d9a91619fe0f73d1ec05973750c903c7db3ca6980c521f4ce9a4093ac81889
                                                                                                                • Instruction ID: 19d34324eba56759d5ba6173cba374f9ab6b0223fa99d86680e16e044b4996de
                                                                                                                • Opcode Fuzzy Hash: 84d9a91619fe0f73d1ec05973750c903c7db3ca6980c521f4ce9a4093ac81889
                                                                                                                • Instruction Fuzzy Hash: CC1104317042418FC719AB38D0515AE7BA79FCA31031885AEE049CB756DFB5AC07C7E1
                                                                                                                Function 0C550040 Relevance: .1, Instructions: 64COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000016.00000002.4104243718.000000000C550000.00000040.00000800.00020000.00000000.sdmp, Offset: 0C550000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_22_2_c550000_FastestVPN.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: 34dd68f5f8575b2d334921ca89be6185febffcbd8c8c64c96559ff8378c86258
                                                                                                                • Instruction ID: 211d3620df7c8e9b7262cc4648803fd70fc1a66b07a5e7cb18697e9a866b7ce2
                                                                                                                • Opcode Fuzzy Hash: 34dd68f5f8575b2d334921ca89be6185febffcbd8c8c64c96559ff8378c86258
                                                                                                                • Instruction Fuzzy Hash: 2421C038B00518CBEF08EBA8D8146EE7BB2FBC8311F50416AE901B7394CB395905DBA0
                                                                                                                Function 00CAECCB Relevance: .1, Instructions: 64COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000016.00000002.4015189538.0000000000CAD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00CAD000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_22_2_cad000_FastestVPN.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: 2087b8d63eadebed767397e5388f447d8a1407dda94bbe0d24585625ae7399b3
                                                                                                                • Instruction ID: b7746aa5010707c5ddd2ff4930a0cb8598dff3da37d831322b94caa9adc20bd1
                                                                                                                • Opcode Fuzzy Hash: 2087b8d63eadebed767397e5388f447d8a1407dda94bbe0d24585625ae7399b3
                                                                                                                • Instruction Fuzzy Hash: 4121BE76400280EFCF02CF50D9C0B56BF72FF88324F248299ED090A66AC336D866DB91
                                                                                                                Function 0C404AC0 Relevance: .1, Instructions: 63COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000016.00000002.4103457864.000000000C400000.00000040.00000800.00020000.00000000.sdmp, Offset: 0C400000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_22_2_c400000_FastestVPN.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: f7c1a94dc71a398bf9df57783812b48422dd518eb931172b27ddfe502787c316
                                                                                                                • Instruction ID: 0e399b67be2a9c8602ff479d511c78f07d7b646d13f605c21b5d9b34ade03489
                                                                                                                • Opcode Fuzzy Hash: f7c1a94dc71a398bf9df57783812b48422dd518eb931172b27ddfe502787c316
                                                                                                                • Instruction Fuzzy Hash: C3216A75A01216DFCB14DFA5C544E6ABFF2FF88350B249269D908AB361C730EC05CB90
                                                                                                                Function 0AA4EBF0 Relevance: .1, Instructions: 63COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000016.00000002.4082922941.000000000AA40000.00000040.00000800.00020000.00000000.sdmp, Offset: 0AA40000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_22_2_aa40000_FastestVPN.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: 2fe4d70b8b10d94ca12b3120e4b14877244d749d36f71c104b982a7eac83bfda
                                                                                                                • Instruction ID: 0118f1a4bca6c17ad6c0862335655271d0416071edb60cc95e7a287804cea1d4
                                                                                                                • Opcode Fuzzy Hash: 2fe4d70b8b10d94ca12b3120e4b14877244d749d36f71c104b982a7eac83bfda
                                                                                                                • Instruction Fuzzy Hash: 6B11613171C241ABE73516AA98547FB6EDEBBC4710F19803AF50AC76C4DEA5CC4286E1
                                                                                                                Function 00CAE1FB Relevance: .1, Instructions: 62COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000016.00000002.4015189538.0000000000CAD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00CAD000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_22_2_cad000_FastestVPN.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: 545bc4a1e8e8af4fffe1e27e2b054ac3ba41b6c78fa149a98268901144a748e4
                                                                                                                • Instruction ID: 96f6ff99b0f47c7ad14ac44c564e57b08993a9b300146510eda971964c6e5d5a
                                                                                                                • Opcode Fuzzy Hash: 545bc4a1e8e8af4fffe1e27e2b054ac3ba41b6c78fa149a98268901144a748e4
                                                                                                                • Instruction Fuzzy Hash: F6213A76500240EFDF06CF94D9C0B55BF72FB48318F2486A9EE094A26AC336D866DB91
                                                                                                                Function 00CAD005 Relevance: .1, Instructions: 62COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000016.00000002.4015189538.0000000000CAD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00CAD000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_22_2_cad000_FastestVPN.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: 680a5b72e3e838f3293456342564a8a65f3751287558be64fe2014920599865a
                                                                                                                • Instruction ID: 59a0d96cded6b06de17b1c3bbe307c59121f735d317782255933e1abb23ec600
                                                                                                                • Opcode Fuzzy Hash: 680a5b72e3e838f3293456342564a8a65f3751287558be64fe2014920599865a
                                                                                                                • Instruction Fuzzy Hash: 522153755093C08FCB12CF24D594715BF71EB46318F28C5DAD84A8F6A7C33A990ACB62
                                                                                                                Function 0C405C60 Relevance: .1, Instructions: 62COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000016.00000002.4103457864.000000000C400000.00000040.00000800.00020000.00000000.sdmp, Offset: 0C400000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_22_2_c400000_FastestVPN.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: a7de28062053302264109a29da21a662fb8784b82cacc561f863709efcc69323
                                                                                                                • Instruction ID: 33b2fa57d623c096c1f61a801a84cb2d6eb6c9d8854ebc16579ccbe8e773004b
                                                                                                                • Opcode Fuzzy Hash: a7de28062053302264109a29da21a662fb8784b82cacc561f863709efcc69323
                                                                                                                • Instruction Fuzzy Hash: DE11E931B143558FDB14AB6DC580DABBAD6FBC4611B21863BD6058F394DEB4EC0187D4
                                                                                                                Function 0C40ED66 Relevance: .1, Instructions: 62COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000016.00000002.4103457864.000000000C400000.00000040.00000800.00020000.00000000.sdmp, Offset: 0C400000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_22_2_c400000_FastestVPN.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: 125feb5ccb5bccf9e06629aa8920b835b98b8e5bd690ff5d5502370d4f0a4f0f
                                                                                                                • Instruction ID: 79e68c430fd29428e8dac17db1d3a3f646aae2c2a012850e3a835c1acaadef68
                                                                                                                • Opcode Fuzzy Hash: 125feb5ccb5bccf9e06629aa8920b835b98b8e5bd690ff5d5502370d4f0a4f0f
                                                                                                                • Instruction Fuzzy Hash: C51127306053818FDB06A778A85554E7FA2EFC6340B0989AED145CF296DF749D0AC7A2
                                                                                                                Function 0C550439 Relevance: .1, Instructions: 61COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000016.00000002.4104243718.000000000C550000.00000040.00000800.00020000.00000000.sdmp, Offset: 0C550000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_22_2_c550000_FastestVPN.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: b664bcd0f0fb7e5bc0f29f54ca89d43b6c2954036fd0b5ef2a19582d9dd6679f
                                                                                                                • Instruction ID: 64bc8a37551a02647c7f66c78aa0cf1a6f5a76b5aa9cc4a2b3660dbd15a1db02
                                                                                                                • Opcode Fuzzy Hash: b664bcd0f0fb7e5bc0f29f54ca89d43b6c2954036fd0b5ef2a19582d9dd6679f
                                                                                                                • Instruction Fuzzy Hash: 6111D338B005498FDB04EBB9D4646AE7BF6AFC8300F1454ADD902DB395DFB49D018B91
                                                                                                                Function 00CAEBCF Relevance: .1, Instructions: 61COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000016.00000002.4015189538.0000000000CAD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00CAD000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_22_2_cad000_FastestVPN.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: 77be49aef49ee930d4cb325a3a42aabd1c78c1a3bab02eab1d672a5a2980ad8f
                                                                                                                • Instruction ID: 5e20daec2ee165be0f5a8472389485e6b9034e3e9ee23387a4f9bc6c7b632db5
                                                                                                                • Opcode Fuzzy Hash: 77be49aef49ee930d4cb325a3a42aabd1c78c1a3bab02eab1d672a5a2980ad8f
                                                                                                                • Instruction Fuzzy Hash: F6219FB6504240DFCF06CF50D9C4B56BF72FB88328F248699ED090A256C33AD926DF91
                                                                                                                Function 0C409BEB Relevance: .1, Instructions: 61COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000016.00000002.4103457864.000000000C400000.00000040.00000800.00020000.00000000.sdmp, Offset: 0C400000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_22_2_c400000_FastestVPN.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: 57367889a8a18f770ad63c717a5f9f70e39d87d971ff1f3ce4f27decf234e9ef
                                                                                                                • Instruction ID: 511b98261aa7345d5888386ddae121f1e75e21e33348eea5ad0a07ee4e8764cc
                                                                                                                • Opcode Fuzzy Hash: 57367889a8a18f770ad63c717a5f9f70e39d87d971ff1f3ce4f27decf234e9ef
                                                                                                                • Instruction Fuzzy Hash: 0411EF31708244AFDB258F799894FAA7FE6EF84320F24806AE5458B282CA71DC01CB60
                                                                                                                Function 0AA47EB8 Relevance: .1, Instructions: 60COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000016.00000002.4082922941.000000000AA40000.00000040.00000800.00020000.00000000.sdmp, Offset: 0AA40000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_22_2_aa40000_FastestVPN.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: 20884a2fd6516399beb61e8d87435ea2a8cdb577dc707c876fe56cb7a8c19d1b
                                                                                                                • Instruction ID: b6d6b1ebdb546136552bd0c8547179db54ab66ed4c4697174057fa2945f56448
                                                                                                                • Opcode Fuzzy Hash: 20884a2fd6516399beb61e8d87435ea2a8cdb577dc707c876fe56cb7a8c19d1b
                                                                                                                • Instruction Fuzzy Hash: C1116A35B101589FCB04EBA8E8549EEBBB2FFC9311B14816AE905D7394DB709D05CB91
                                                                                                                Function 0C5506AF Relevance: .1, Instructions: 58COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000016.00000002.4104243718.000000000C550000.00000040.00000800.00020000.00000000.sdmp, Offset: 0C550000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_22_2_c550000_FastestVPN.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: c33807bc21a89e04569ac005a599428d19144ebadb8b3dc22819b300979606e5
                                                                                                                • Instruction ID: 588feaabebd7416be37ed79ec97d3cc9ceb0972210d980448f67a162ebe26e8d
                                                                                                                • Opcode Fuzzy Hash: c33807bc21a89e04569ac005a599428d19144ebadb8b3dc22819b300979606e5
                                                                                                                • Instruction Fuzzy Hash: 31012834B196D40FDF22D73494247AE3FD42FC2558B1D45EAC848CB692EA25CC02C741
                                                                                                                Function 00C9D6AB Relevance: .1, Instructions: 58COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000016.00000002.4014918783.0000000000C9D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C9D000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_22_2_c9d000_FastestVPN.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: 83fb694dd1e91a6ea135483331fab76a04ef60c4faa8ae053019808facf22284
                                                                                                                • Instruction ID: 5f2009082f84dd880d78e997cf1ba1a68d591996d1c61745153b9cdc922e91ff
                                                                                                                • Opcode Fuzzy Hash: 83fb694dd1e91a6ea135483331fab76a04ef60c4faa8ae053019808facf22284
                                                                                                                • Instruction Fuzzy Hash: CA21AF76504280DFCF06CF50D9C4B16BF72FB88314F24C6A9E9491B25AC33AD966CB92
                                                                                                                Function 0C553878 Relevance: .1, Instructions: 57COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000016.00000002.4104243718.000000000C550000.00000040.00000800.00020000.00000000.sdmp, Offset: 0C550000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_22_2_c550000_FastestVPN.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: 2f0c9bbf4c8bf95694cc7d5f2e732f8a4624950bcfa38f846d87912310f87326
                                                                                                                • Instruction ID: 6a670a54db74aa98849f5d4fd560d23e691b0e32505629099266e1098d797b40
                                                                                                                • Opcode Fuzzy Hash: 2f0c9bbf4c8bf95694cc7d5f2e732f8a4624950bcfa38f846d87912310f87326
                                                                                                                • Instruction Fuzzy Hash: 881129302147805FD7129B68981519A7FB5DFC33107044DAED28ACB6A2DFB55D0BCBA1
                                                                                                                Function 0C405C50 Relevance: .1, Instructions: 57COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000016.00000002.4103457864.000000000C400000.00000040.00000800.00020000.00000000.sdmp, Offset: 0C400000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_22_2_c400000_FastestVPN.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: 982652b437171b0ea26e3fbc3b2076dd07f133c54ec957840e90250082d057b2
                                                                                                                • Instruction ID: 9c5807ffd0a3ebedba14952aa0aeb4e7284e32d84e1a03cace160c9954a25ce7
                                                                                                                • Opcode Fuzzy Hash: 982652b437171b0ea26e3fbc3b2076dd07f133c54ec957840e90250082d057b2
                                                                                                                • Instruction Fuzzy Hash: 0911E5317142518BDB14AB698990DAEBA96FFC8311B24863BD6059F394DE70DC018BD4
                                                                                                                Function 0C4050F8 Relevance: .1, Instructions: 57COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000016.00000002.4103457864.000000000C400000.00000040.00000800.00020000.00000000.sdmp, Offset: 0C400000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_22_2_c400000_FastestVPN.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: 691edafce52ba8c89ef8d73f14094c57d3f9fa3aa8f4a25456b10f900f426f11
                                                                                                                • Instruction ID: 4c9a4221e66fa33d94177fce45c7b478e8a4f35176baf5e8403fb25a63179d10
                                                                                                                • Opcode Fuzzy Hash: 691edafce52ba8c89ef8d73f14094c57d3f9fa3aa8f4a25456b10f900f426f11
                                                                                                                • Instruction Fuzzy Hash: E901A5257582058FDB146B74992492E37EAEBC965172844B7D809CF7C2DE34DC02CBA9
                                                                                                                Function 0AA4E270 Relevance: .1, Instructions: 57COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000016.00000002.4082922941.000000000AA40000.00000040.00000800.00020000.00000000.sdmp, Offset: 0AA40000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_22_2_aa40000_FastestVPN.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: 5880f16b94a52edc72a71412cbdc25dcbbf86d78a21a9e017855a58bb70dfecd
                                                                                                                • Instruction ID: 160e456a389db3a8ba13b52637c1b9c720406c7a19257ac858918a15b181643b
                                                                                                                • Opcode Fuzzy Hash: 5880f16b94a52edc72a71412cbdc25dcbbf86d78a21a9e017855a58bb70dfecd
                                                                                                                • Instruction Fuzzy Hash: D21182323102146FE714DFA8D844AAB7BA9FB88350F14452AE504DB281DBB1ED018BA0
                                                                                                                Function 0AA463D8 Relevance: .1, Instructions: 57COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000016.00000002.4082922941.000000000AA40000.00000040.00000800.00020000.00000000.sdmp, Offset: 0AA40000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_22_2_aa40000_FastestVPN.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: c7d77a129b608e072d78be33ef82615a9d06f2246cb7ca68dd9ed0502470e99d
                                                                                                                • Instruction ID: 98f1a3e8cb97de6f2f188e50062193dcb2217af68f778e3d7781316f74465016
                                                                                                                • Opcode Fuzzy Hash: c7d77a129b608e072d78be33ef82615a9d06f2246cb7ca68dd9ed0502470e99d
                                                                                                                • Instruction Fuzzy Hash: 6011C2323043009FDB21CB68D845F967FB4EB86320F1486AAF255CF6A2D7A5E8069751
                                                                                                                Function 0C550AC0 Relevance: .1, Instructions: 56COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000016.00000002.4104243718.000000000C550000.00000040.00000800.00020000.00000000.sdmp, Offset: 0C550000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_22_2_c550000_FastestVPN.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: 471e034e7c176630d8f7d5caf78cd208daf016217248e8b98aa11060810b8dd3
                                                                                                                • Instruction ID: e88ebb8b309de9e3e79e4392a1728e6fd9aaa07b38641699335831c10f47b8e0
                                                                                                                • Opcode Fuzzy Hash: 471e034e7c176630d8f7d5caf78cd208daf016217248e8b98aa11060810b8dd3
                                                                                                                • Instruction Fuzzy Hash: 33118E36D1060D9ACF168FB9D8500CDBFB6EFCA320F654626D601B7251E771248A8BA1
                                                                                                                Function 0C559320 Relevance: .1, Instructions: 56COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000016.00000002.4104243718.000000000C550000.00000040.00000800.00020000.00000000.sdmp, Offset: 0C550000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_22_2_c550000_FastestVPN.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: 790a697b2c1bc19f24c7159cfa09e801a0c2f357401e89f70d495b3ba8f0d676
                                                                                                                • Instruction ID: ed71ebfc34d653d709312f7c79271663e14d8bbb3f9ff9937fbc49306effa10b
                                                                                                                • Opcode Fuzzy Hash: 790a697b2c1bc19f24c7159cfa09e801a0c2f357401e89f70d495b3ba8f0d676
                                                                                                                • Instruction Fuzzy Hash: 2921C478E04209DFCB04EFA8C4A59AEBBF2FF89310F50459AD905A7350DB34AA45CB91
                                                                                                                Function 00C9D51F Relevance: .1, Instructions: 56COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000016.00000002.4014918783.0000000000C9D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C9D000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_22_2_c9d000_FastestVPN.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: fed46cca7f742b7caa711e8ed735342f41d2c2d3303e466d284e334843d61363
                                                                                                                • Instruction ID: 0cfb23d7d5307a33137f5fe0d83174e9589fe6e01bd4e428cdd91b9f045e7f61
                                                                                                                • Opcode Fuzzy Hash: fed46cca7f742b7caa711e8ed735342f41d2c2d3303e466d284e334843d61363
                                                                                                                • Instruction Fuzzy Hash: 341126B6404280CFCF02CF14D5C4B16BF71FB84314F24C5A9D8090B656C33AD956CBA2
                                                                                                                Function 0C40C450 Relevance: .1, Instructions: 56COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000016.00000002.4103457864.000000000C400000.00000040.00000800.00020000.00000000.sdmp, Offset: 0C400000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_22_2_c400000_FastestVPN.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: 7b2e6cc642ebfd19a1e52511a8fcd2e15bea284170d3b5b14f7d35449317e767
                                                                                                                • Instruction ID: 580698ef5247ff089f8a58056305238bdd74db3cd025a7ec0daebb02992dc98b
                                                                                                                • Opcode Fuzzy Hash: 7b2e6cc642ebfd19a1e52511a8fcd2e15bea284170d3b5b14f7d35449317e767
                                                                                                                • Instruction Fuzzy Hash: 0D116A71A042A48BDB19DB68D455AEEBFF1BF4D310F2482BAD442E7391CB309904CB65
                                                                                                                Function 0C40FE20 Relevance: .1, Instructions: 56COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000016.00000002.4103457864.000000000C400000.00000040.00000800.00020000.00000000.sdmp, Offset: 0C400000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_22_2_c400000_FastestVPN.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: 8c553f40a3fb43d6d2fe62157aa2e2a19470957d30bb760065aeb498fa4dc34b
                                                                                                                • Instruction ID: 718cb36f5aec5e6098f4b3788f7d2feb208a09def387f5b094be4e035fe462e2
                                                                                                                • Opcode Fuzzy Hash: 8c553f40a3fb43d6d2fe62157aa2e2a19470957d30bb760065aeb498fa4dc34b
                                                                                                                • Instruction Fuzzy Hash: DA113030A501099BEB24DFA5D898FEFBBB5BB88301F248136E811A7291DB745849CFD0
                                                                                                                Function 0C40B6E0 Relevance: .1, Instructions: 56COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000016.00000002.4103457864.000000000C400000.00000040.00000800.00020000.00000000.sdmp, Offset: 0C400000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_22_2_c400000_FastestVPN.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: 3cf8dc7c472c4038fdcdaaddc573d635335e1bd8061c27893e0ec9a696942416
                                                                                                                • Instruction ID: 21f8e357024effd9191ec40a08d202cfcf70a339addb8045089cc9aeaaaf3d39
                                                                                                                • Opcode Fuzzy Hash: 3cf8dc7c472c4038fdcdaaddc573d635335e1bd8061c27893e0ec9a696942416
                                                                                                                • Instruction Fuzzy Hash: 7A115CB1E041558BDB19DB68D455AEEBFF1BF8D300F24816AD481B7391CB309944CB64
                                                                                                                Function 0AA4E243 Relevance: .1, Instructions: 56COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000016.00000002.4082922941.000000000AA40000.00000040.00000800.00020000.00000000.sdmp, Offset: 0AA40000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_22_2_aa40000_FastestVPN.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: 7ea979ad07a81d172d0606cf9d7af28a68185632691a562e4912bd4e7548a4f0
                                                                                                                • Instruction ID: 2a3de06359038b0539f6cc80764d8f7174bce80f2f7210bfcec46a0ded23eb42
                                                                                                                • Opcode Fuzzy Hash: 7ea979ad07a81d172d0606cf9d7af28a68185632691a562e4912bd4e7548a4f0
                                                                                                                • Instruction Fuzzy Hash: BC113031710204AFE718CF58D844EAF7BA9FBC8750F144919F5059B291EBB1ED019B90
                                                                                                                Function 0AA494C8 Relevance: .1, Instructions: 56COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000016.00000002.4082922941.000000000AA40000.00000040.00000800.00020000.00000000.sdmp, Offset: 0AA40000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_22_2_aa40000_FastestVPN.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: f14986ec69f1bc549e122ee35231c65780af7998940bdaba6f812ed5f2e0c33e
                                                                                                                • Instruction ID: f126fb8266f2166cd6e386cce735e9bdf987b2a0333c9c30264f4217ba303ba9
                                                                                                                • Opcode Fuzzy Hash: f14986ec69f1bc549e122ee35231c65780af7998940bdaba6f812ed5f2e0c33e
                                                                                                                • Instruction Fuzzy Hash: 08118230B102049FC754AB68C841AAB7BF6FBC4620F200559E546DB345DB70EC058B91
                                                                                                                Function 0C550DB8 Relevance: .1, Instructions: 55COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000016.00000002.4104243718.000000000C550000.00000040.00000800.00020000.00000000.sdmp, Offset: 0C550000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_22_2_c550000_FastestVPN.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: 77b70c688132370ad6121c0794be3d859903a4988995e7e8533d97ade3996b9e
                                                                                                                • Instruction ID: 5bdc01c8e3705f7c9e5d5aa91b12146fc703df9d6dbfedc2ede446f9f3e4a385
                                                                                                                • Opcode Fuzzy Hash: 77b70c688132370ad6121c0794be3d859903a4988995e7e8533d97ade3996b9e
                                                                                                                • Instruction Fuzzy Hash: D511A332D116499ACF12CFB9D8804CDFFB6EF95310F254626E50177191D770258ACB50
                                                                                                                Function 0C40C647 Relevance: .1, Instructions: 55COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000016.00000002.4103457864.000000000C400000.00000040.00000800.00020000.00000000.sdmp, Offset: 0C400000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_22_2_c400000_FastestVPN.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: 15d8730c1b2063a37ecd23132e23473abb27816f00f03b797682e956bd9af80f
                                                                                                                • Instruction ID: 3f9adf47f5fb4a5e8d403f981bc771787fefa1a87838138a23b4c2e5875adca1
                                                                                                                • Opcode Fuzzy Hash: 15d8730c1b2063a37ecd23132e23473abb27816f00f03b797682e956bd9af80f
                                                                                                                • Instruction Fuzzy Hash: B011E071B442948BCB25DBA8C894AEEBFF36F88310F28466AD401E7392CE714C05CB61
                                                                                                                Function 0C40B3D8 Relevance: .1, Instructions: 55COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000016.00000002.4103457864.000000000C400000.00000040.00000800.00020000.00000000.sdmp, Offset: 0C400000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_22_2_c400000_FastestVPN.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: 94519639d02457cf516ce062bcf028b1bb55bc4c28cffc619136b3b2a67dc8ba
                                                                                                                • Instruction ID: 17fd41a5b693ba47707a57c2bf5ee8ff611a671359276bd9f94ebef6bd61bd27
                                                                                                                • Opcode Fuzzy Hash: 94519639d02457cf516ce062bcf028b1bb55bc4c28cffc619136b3b2a67dc8ba
                                                                                                                • Instruction Fuzzy Hash: ED11CE31B402189BDB15DF75C814AAFBEF6ABC8260F28407AD805E7381DF705E459BA4
                                                                                                                Function 0C4070C0 Relevance: .1, Instructions: 54COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000016.00000002.4103457864.000000000C400000.00000040.00000800.00020000.00000000.sdmp, Offset: 0C400000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_22_2_c400000_FastestVPN.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: 734cc7e65660115fbceb77b3d8343456981dc395685775b446a88fa64fe4d78b
                                                                                                                • Instruction ID: 7491f4400978885d108768ba0b079ec922d2ef64a2e2c55b6037f7afef6571ac
                                                                                                                • Opcode Fuzzy Hash: 734cc7e65660115fbceb77b3d8343456981dc395685775b446a88fa64fe4d78b
                                                                                                                • Instruction Fuzzy Hash: C7113C31305141CFC309EBB8E5409AABFA6FFCA22531455A9E609CB346CA75DC82CBD5
                                                                                                                Function 0C40B15A Relevance: .1, Instructions: 54COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000016.00000002.4103457864.000000000C400000.00000040.00000800.00020000.00000000.sdmp, Offset: 0C400000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_22_2_c400000_FastestVPN.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: a465f02dd919f9d6c42129100a8cb6d60a017e7c50da0e045f229740547f9457
                                                                                                                • Instruction ID: 646afe4b51a7d21dd237c963f2bd4e79a3193a69507f85fd6e4c31c66a703e93
                                                                                                                • Opcode Fuzzy Hash: a465f02dd919f9d6c42129100a8cb6d60a017e7c50da0e045f229740547f9457
                                                                                                                • Instruction Fuzzy Hash: 63119E35B005158FDB09DF94E84199DBBF1FB88314B1442AAE509DB356DB34AE09DB84
                                                                                                                Function 00CAD31B Relevance: .1, Instructions: 53COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000016.00000002.4015189538.0000000000CAD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00CAD000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_22_2_cad000_FastestVPN.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: 703b7abd3718bd21aa6f36dac6c8dc0e73c65716f16ca45b46755fc1987422b6
                                                                                                                • Instruction ID: 4a5184440dafffc3c56ad5d7914456d9dba32d62b0b4f2274cd900e1341a333f
                                                                                                                • Opcode Fuzzy Hash: 703b7abd3718bd21aa6f36dac6c8dc0e73c65716f16ca45b46755fc1987422b6
                                                                                                                • Instruction Fuzzy Hash: 7F11D075504284CFCB01CF10D5C0B19BFB1FB45318F24C6A9D94A4B666C33AD81ACF62
                                                                                                                Function 0C40B8F8 Relevance: .1, Instructions: 53COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000016.00000002.4103457864.000000000C400000.00000040.00000800.00020000.00000000.sdmp, Offset: 0C400000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_22_2_c400000_FastestVPN.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: 3e114a6ba9b54fde14150d1ec388d192523746fb1b76e7c62aaa882bcc63013b
                                                                                                                • Instruction ID: 429b553f9bd49013b394d35c69ab15c5dc9b47c43da6d0f8e9425e53e6fb659b
                                                                                                                • Opcode Fuzzy Hash: 3e114a6ba9b54fde14150d1ec388d192523746fb1b76e7c62aaa882bcc63013b
                                                                                                                • Instruction Fuzzy Hash: C1110231B406948BCB15DB79C054AEEBFF3AF89300F2980AAC442EB391CE715D40CBA5
                                                                                                                Function 0C404B99 Relevance: .1, Instructions: 53COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000016.00000002.4103457864.000000000C400000.00000040.00000800.00020000.00000000.sdmp, Offset: 0C400000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_22_2_c400000_FastestVPN.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: cd5ff5339e64c4fd164e668e67eb7eb04dc4e2b600cda6558fa5522d861cc082
                                                                                                                • Instruction ID: d2dfd1c063e377e7fd39b87ff6c7e58d6763a19a97883bc009b554da9afd5183
                                                                                                                • Opcode Fuzzy Hash: cd5ff5339e64c4fd164e668e67eb7eb04dc4e2b600cda6558fa5522d861cc082
                                                                                                                • Instruction Fuzzy Hash: 0C110231704201DFDB249F24D484A9ABBF6FFC9310B04856AE509C7391DB75EC05CB90
                                                                                                                Function 0C40C460 Relevance: .1, Instructions: 52COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000016.00000002.4103457864.000000000C400000.00000040.00000800.00020000.00000000.sdmp, Offset: 0C400000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_22_2_c400000_FastestVPN.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: c74436e9c396dab708970905a43db5d6a27f8c72d4bd2382510b11054c848274
                                                                                                                • Instruction ID: 584999d091d4f9f9026fdcc015080f6ead8173225ceebf78829e2350151a7134
                                                                                                                • Opcode Fuzzy Hash: c74436e9c396dab708970905a43db5d6a27f8c72d4bd2382510b11054c848274
                                                                                                                • Instruction Fuzzy Hash: 55115BB1A042688BDB19DF68D455AEEBBF1BF4C310F24827AE402F7391DB349944CB65
                                                                                                                Function 0C40B6F0 Relevance: .1, Instructions: 52COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000016.00000002.4103457864.000000000C400000.00000040.00000800.00020000.00000000.sdmp, Offset: 0C400000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_22_2_c400000_FastestVPN.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: 9e772efe5f96f86aeebc880e753f80815a66de7b17f823c2b2b0dcbe30bda525
                                                                                                                • Instruction ID: f129c77cad858b08d30f0fb904da0b2c71affdc2b9d4973723a76847d54ddea5
                                                                                                                • Opcode Fuzzy Hash: 9e772efe5f96f86aeebc880e753f80815a66de7b17f823c2b2b0dcbe30bda525
                                                                                                                • Instruction Fuzzy Hash: 53115BB1A041198BDB09DFA8D415AEEBBF1BF4C300F20817AD802F7391DB349944CB64
                                                                                                                Function 0C409140 Relevance: .1, Instructions: 52COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000016.00000002.4103457864.000000000C400000.00000040.00000800.00020000.00000000.sdmp, Offset: 0C400000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_22_2_c400000_FastestVPN.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: e02a0c9a47e3f4a020c7d2b06477c246f222bb005cbf8baa6e70f65e05a7eee0
                                                                                                                • Instruction ID: 950d3f83cdbe8e4ce4552a5264acbc9a20ed43cd1a89627d3666ccb76633ec66
                                                                                                                • Opcode Fuzzy Hash: e02a0c9a47e3f4a020c7d2b06477c246f222bb005cbf8baa6e70f65e05a7eee0
                                                                                                                • Instruction Fuzzy Hash: A9017572B04118AB9B10DEA9EC449BFF7FEEBD8251B10443AE614D3241DB70D91597A1
                                                                                                                Function 0C404BA8 Relevance: .1, Instructions: 52COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000016.00000002.4103457864.000000000C400000.00000040.00000800.00020000.00000000.sdmp, Offset: 0C400000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_22_2_c400000_FastestVPN.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: 6dde0f45336c6710ad21bbafbbaf79258a3f101c9e0230dfd4ea56cecd5f97f2
                                                                                                                • Instruction ID: 6113ca6117bd68bfa40c539f83341e1d4073d5cf047f1d338a86576500a82832
                                                                                                                • Opcode Fuzzy Hash: 6dde0f45336c6710ad21bbafbbaf79258a3f101c9e0230dfd4ea56cecd5f97f2
                                                                                                                • Instruction Fuzzy Hash: 7D117C717042059FDB249F28D488E5ABBF6FF89310B04856DE509CB391DB75EC45CB90
                                                                                                                Function 0C55AB3F Relevance: .1, Instructions: 51COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000016.00000002.4104243718.000000000C550000.00000040.00000800.00020000.00000000.sdmp, Offset: 0C550000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_22_2_c550000_FastestVPN.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: 801b5735fd83fcffc2bc21789fd0c7cb2b5bb1dbbeb684c53fe560fe3801d66c
                                                                                                                • Instruction ID: d3cbf5fd8cdf79e5026ecc6254a4db385b88f48ba1792b00792e6d3d812e0e9c
                                                                                                                • Opcode Fuzzy Hash: 801b5735fd83fcffc2bc21789fd0c7cb2b5bb1dbbeb684c53fe560fe3801d66c
                                                                                                                • Instruction Fuzzy Hash: 2BF0A476B051144FA7148A59AC54B7FB7ABEBC4535724023BE809C3251DB61CC0147D0
                                                                                                                Function 0C40C528 Relevance: .1, Instructions: 51COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000016.00000002.4103457864.000000000C400000.00000040.00000800.00020000.00000000.sdmp, Offset: 0C400000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_22_2_c400000_FastestVPN.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: 8432f901d7888e8894ca4e095203469c1f59360b0d6c7e7454f7486c8980231d
                                                                                                                • Instruction ID: 64845f4d59cb2380a91a4c3e97b4e3cd0ddb38e52b7e33b646c7ac3691027860
                                                                                                                • Opcode Fuzzy Hash: 8432f901d7888e8894ca4e095203469c1f59360b0d6c7e7454f7486c8980231d
                                                                                                                • Instruction Fuzzy Hash: B911CE74E00229CBDB00DBA9D844AEEBFB5BB88328F244166D500A3384EB349900CBA5
                                                                                                                Function 0C40FE11 Relevance: .1, Instructions: 51COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000016.00000002.4103457864.000000000C400000.00000040.00000800.00020000.00000000.sdmp, Offset: 0C400000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_22_2_c400000_FastestVPN.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: db377d9098eb117d683a2d8e0b53afa82721d31ad6dec7f99535da7da01eadba
                                                                                                                • Instruction ID: 037fe2f6ea37e24f165287397689721ba5aa9bf410a09e6e09a5b0e6ba26be48
                                                                                                                • Opcode Fuzzy Hash: db377d9098eb117d683a2d8e0b53afa82721d31ad6dec7f99535da7da01eadba
                                                                                                                • Instruction Fuzzy Hash: 8E114231A502099FDB14CFA9D888BDE7BB5FF88350F248175E811A7391DB746849CF91
                                                                                                                Function 0C40E6D3 Relevance: .1, Instructions: 51COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000016.00000002.4103457864.000000000C400000.00000040.00000800.00020000.00000000.sdmp, Offset: 0C400000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_22_2_c400000_FastestVPN.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: b6d9b0fe9eb36d4ce106dc8baff43bfd57a5864cffbba7778097730c4025dd21
                                                                                                                • Instruction ID: 5640390b4224d55e995ffe2f2227dd14cc7205ee94bb84d9b59455d659de5b87
                                                                                                                • Opcode Fuzzy Hash: b6d9b0fe9eb36d4ce106dc8baff43bfd57a5864cffbba7778097730c4025dd21
                                                                                                                • Instruction Fuzzy Hash: B801F7317001901F4E1623B9245D4BEAE97DFC6161318097ED646CB3C2CE514C074BB5
                                                                                                                Function 0C406533 Relevance: .0, Instructions: 50COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000016.00000002.4103457864.000000000C400000.00000040.00000800.00020000.00000000.sdmp, Offset: 0C400000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_22_2_c400000_FastestVPN.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: df93a12d27ce08020e614284ca9f67986aaea84e449b7468c81dcd0cd11124e7
                                                                                                                • Instruction ID: 72403ff03c2bbdc3c3f1714c0a75c6fe9299d7b1874e98d4cf92e6ba072c2c28
                                                                                                                • Opcode Fuzzy Hash: df93a12d27ce08020e614284ca9f67986aaea84e449b7468c81dcd0cd11124e7
                                                                                                                • Instruction Fuzzy Hash: 4B01F5727056618FCB259720A804C7F7BA5BEC9260316456ADC06AB385EF34EC06C7D0
                                                                                                                Function 0C552718 Relevance: .0, Instructions: 49COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000016.00000002.4104243718.000000000C550000.00000040.00000800.00020000.00000000.sdmp, Offset: 0C550000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_22_2_c550000_FastestVPN.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: 6512bd2f04ffe7140e2676fccb59b8f65a83ea8abb71ed6e4f39b83dee850c7c
                                                                                                                • Instruction ID: 5f5dc7168e2c61873f6e93ff7628cbfebcb2ca9584ee957d005f760ccdec2652
                                                                                                                • Opcode Fuzzy Hash: 6512bd2f04ffe7140e2676fccb59b8f65a83ea8abb71ed6e4f39b83dee850c7c
                                                                                                                • Instruction Fuzzy Hash: 1801267A6097C04FC31397ACACA549A7FA5EEC331070549EFD2498F293DE648906C791
                                                                                                                Function 0C406540 Relevance: .0, Instructions: 49COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000016.00000002.4103457864.000000000C400000.00000040.00000800.00020000.00000000.sdmp, Offset: 0C400000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_22_2_c400000_FastestVPN.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: 922ed796772f9fb95d30f9f766a2608cf014cad17c88f5e6233de71b15140e9f
                                                                                                                • Instruction ID: ac2b4c1ed51be0d39559d03d2618d343d49f61139e60e409ead17ac00a6332e3
                                                                                                                • Opcode Fuzzy Hash: 922ed796772f9fb95d30f9f766a2608cf014cad17c88f5e6233de71b15140e9f
                                                                                                                • Instruction Fuzzy Hash: DA01F772B412354F8B249B15A540D7FB7A5FF88620326062ADD06AB384EF34EC0287D4
                                                                                                                Function 0C40C658 Relevance: .0, Instructions: 49COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000016.00000002.4103457864.000000000C400000.00000040.00000800.00020000.00000000.sdmp, Offset: 0C400000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_22_2_c400000_FastestVPN.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: b985c9f75e4d3175a3e5c8cdc40ddc9e561b6ebaf19658a5b35b29a0a4eb7fbd
                                                                                                                • Instruction ID: d470427abe15f62fb5a16e5c9de949aed6f0b7323aae833bb36e59693717c079
                                                                                                                • Opcode Fuzzy Hash: b985c9f75e4d3175a3e5c8cdc40ddc9e561b6ebaf19658a5b35b29a0a4eb7fbd
                                                                                                                • Instruction Fuzzy Hash: C801C471B402548BCB24DBA9C454AEEBFF6AF88310F29457BD401E7391DE715D41CBA1
                                                                                                                Function 0C40B908 Relevance: .0, Instructions: 49COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000016.00000002.4103457864.000000000C400000.00000040.00000800.00020000.00000000.sdmp, Offset: 0C400000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_22_2_c400000_FastestVPN.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: cf373b8517a4e09e5a88834da397eb2e478a2a7337d54b4a684025fefa0e4d16
                                                                                                                • Instruction ID: f799349604654f9e4179195914253cf90a45203eb4d9564d58b17981d1f828b6
                                                                                                                • Opcode Fuzzy Hash: cf373b8517a4e09e5a88834da397eb2e478a2a7337d54b4a684025fefa0e4d16
                                                                                                                • Instruction Fuzzy Hash: E801AD31B406188BDB14DF69C554AAEBBF7AF88310F29406AD802EB391DE759D408AA4
                                                                                                                Function 0C40CA48 Relevance: .0, Instructions: 49COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000016.00000002.4103457864.000000000C400000.00000040.00000800.00020000.00000000.sdmp, Offset: 0C400000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_22_2_c400000_FastestVPN.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: 7b041569d4fc8400607b9a3efd0d8caa9280f0ead3762cd71b5f3078d293e178
                                                                                                                • Instruction ID: 840f4bed274a29e1f80deebec1d9a064253830587f4b350be60de6a3c1f12330
                                                                                                                • Opcode Fuzzy Hash: 7b041569d4fc8400607b9a3efd0d8caa9280f0ead3762cd71b5f3078d293e178
                                                                                                                • Instruction Fuzzy Hash: C6117370A04159CFDF01DBB8C451BEE7FF2AF89245F248266C401E7391DB754905CBA1
                                                                                                                Function 0C40DB98 Relevance: .0, Instructions: 49COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000016.00000002.4103457864.000000000C400000.00000040.00000800.00020000.00000000.sdmp, Offset: 0C400000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_22_2_c400000_FastestVPN.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: 79c4dac557695e073474f23c5c50a9dcde9d5585f822b030bd4fabd7a5def7ea
                                                                                                                • Instruction ID: 49d916d35ca92dd27cb6a35634f8fbbeff64d405b1200483e62b973f5f7d8e68
                                                                                                                • Opcode Fuzzy Hash: 79c4dac557695e073474f23c5c50a9dcde9d5585f822b030bd4fabd7a5def7ea
                                                                                                                • Instruction Fuzzy Hash: 88114C71E482588FDF19DBA4D455AEDBBB2BF89300F24447AC402B7281DBB59845CBA1
                                                                                                                Function 0AA46E72 Relevance: .0, Instructions: 49COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000016.00000002.4082922941.000000000AA40000.00000040.00000800.00020000.00000000.sdmp, Offset: 0AA40000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_22_2_aa40000_FastestVPN.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: f1c069f987ba77428ccf155118982c583aa87d09fa3aef6c37efae12ffccb0b5
                                                                                                                • Instruction ID: 0a8f881655138b10d42a7894adb81f78bf9ac4b1e097b39da08a8034a5667554
                                                                                                                • Opcode Fuzzy Hash: f1c069f987ba77428ccf155118982c583aa87d09fa3aef6c37efae12ffccb0b5
                                                                                                                • Instruction Fuzzy Hash: 3501A2622091E43FCB124EAA1C609FB7FED9F8E155B0900DAFAD8C6193C4288920DB70
                                                                                                                Function 0C559D10 Relevance: .0, Instructions: 48COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000016.00000002.4104243718.000000000C550000.00000040.00000800.00020000.00000000.sdmp, Offset: 0C550000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_22_2_c550000_FastestVPN.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: 141c8a20ae7589fc6cae81e1b793856cb6fcb466c3389415274f704a642bb3f2
                                                                                                                • Instruction ID: c45817b52d689800a3c00b10807fa23bb526c70cf69ebd4b88413542f22e0e4e
                                                                                                                • Opcode Fuzzy Hash: 141c8a20ae7589fc6cae81e1b793856cb6fcb466c3389415274f704a642bb3f2
                                                                                                                • Instruction Fuzzy Hash: C9F0A4363081189F9724DA5EE85095BF7DDEFC96713448227ED08C7310DA35EC0186A4
                                                                                                                Function 0C40B3C8 Relevance: .0, Instructions: 48COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000016.00000002.4103457864.000000000C400000.00000040.00000800.00020000.00000000.sdmp, Offset: 0C400000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_22_2_c400000_FastestVPN.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: 7ae9a4cd89ce5c78b7cf04d268f7ea8d4c8144eb10549b0e222c84b7f46b51c0
                                                                                                                • Instruction ID: 1746940f3d855f4cc3cbad0cf428e92100372f0e77fc299f17a2093b200034fe
                                                                                                                • Opcode Fuzzy Hash: 7ae9a4cd89ce5c78b7cf04d268f7ea8d4c8144eb10549b0e222c84b7f46b51c0
                                                                                                                • Instruction Fuzzy Hash: 7501C471A442588BDB11DF69C454AEEBFF2AFC9250F28406AC845B7392CE710E05CB64
                                                                                                                Function 0C40CF00 Relevance: .0, Instructions: 47COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000016.00000002.4103457864.000000000C400000.00000040.00000800.00020000.00000000.sdmp, Offset: 0C400000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_22_2_c400000_FastestVPN.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: b08870b11221ff3a0b6f701676be010f86035825836ec1312cc7a4b1568e6099
                                                                                                                • Instruction ID: ec646d4a87557915e47c2654044c8f3835c40d68872b1e983e9bd708e2bbeeae
                                                                                                                • Opcode Fuzzy Hash: b08870b11221ff3a0b6f701676be010f86035825836ec1312cc7a4b1568e6099
                                                                                                                • Instruction Fuzzy Hash: 0301B1306042419FD709EBB8E8856DEBF72EFC13107009A6DD21987252EFB46D098BA5
                                                                                                                Function 0C559D80 Relevance: .0, Instructions: 46COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000016.00000002.4104243718.000000000C550000.00000040.00000800.00020000.00000000.sdmp, Offset: 0C550000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_22_2_c550000_FastestVPN.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: f8660c395e845b9ab577c8f2ef970617e83780d3e9bc75afab0691b2b40016a7
                                                                                                                • Instruction ID: 5b73ded6525bf2f4d997f36b049e5ed7c7bdc9bb3a9633bbb8f7cbc8a24a5d3a
                                                                                                                • Opcode Fuzzy Hash: f8660c395e845b9ab577c8f2ef970617e83780d3e9bc75afab0691b2b40016a7
                                                                                                                • Instruction Fuzzy Hash: 9D016D757002049FEB24CA29D890E7ABBE9EB88360B14853AEE09CB341DE71DC01C760
                                                                                                                Function 0C5598B0 Relevance: .0, Instructions: 46COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000016.00000002.4104243718.000000000C550000.00000040.00000800.00020000.00000000.sdmp, Offset: 0C550000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_22_2_c550000_FastestVPN.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: 72656da14e301c3c5e8aacccc629ad7587d0110f34b7518817434950a038481f
                                                                                                                • Instruction ID: 51a10e8dab81401e7c480ee93db7b941ec44b5af93cba9f97ed913170ae39643
                                                                                                                • Opcode Fuzzy Hash: 72656da14e301c3c5e8aacccc629ad7587d0110f34b7518817434950a038481f
                                                                                                                • Instruction Fuzzy Hash: 460126757052058FCB20CA6A98509AAFFF6FFC538071482BAE80CC7346DA30E806C7A1
                                                                                                                Function 0AA47D58 Relevance: .0, Instructions: 46COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000016.00000002.4082922941.000000000AA40000.00000040.00000800.00020000.00000000.sdmp, Offset: 0AA40000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_22_2_aa40000_FastestVPN.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: 51ff5095cbf827e8d10f6d8e9f9cfd1550af08c96b5a50d6000e1a79be13c8e7
                                                                                                                • Instruction ID: 313f22607cde8c58b7065cb030054a2743622a2f0f05a43e4eded2e0b9741778
                                                                                                                • Opcode Fuzzy Hash: 51ff5095cbf827e8d10f6d8e9f9cfd1550af08c96b5a50d6000e1a79be13c8e7
                                                                                                                • Instruction Fuzzy Hash: 8BF03132314114AF5B64DE69EC448FFBBAEFBC8261714852AF509C3250EB71DC159BA0
                                                                                                                Function 0C550DC8 Relevance: .0, Instructions: 45COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000016.00000002.4104243718.000000000C550000.00000040.00000800.00020000.00000000.sdmp, Offset: 0C550000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_22_2_c550000_FastestVPN.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: e57b8e67991431ff0290c66bf47d82e5bc06774da64febc1951a1683ea657f94
                                                                                                                • Instruction ID: a59c5358fc8cfff0838b8faeac943f6d8baff76ecbce64b6f3c47930c7b86e08
                                                                                                                • Opcode Fuzzy Hash: e57b8e67991431ff0290c66bf47d82e5bc06774da64febc1951a1683ea657f94
                                                                                                                • Instruction Fuzzy Hash: 92011E32D1160D9BCF11DFA9D9808CDFBB6EF99320F654626E51177250E7703A4ACB60
                                                                                                                Function 0C550AD0 Relevance: .0, Instructions: 45COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000016.00000002.4104243718.000000000C550000.00000040.00000800.00020000.00000000.sdmp, Offset: 0C550000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_22_2_c550000_FastestVPN.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: b801ee614e5e46af568c8a2c6154198881c2b5c7af41c3afd88f1e52e1a66e8d
                                                                                                                • Instruction ID: 47084eaf1f649246d2d691994e3b3f1df32d74b88459f70ad9fd9fa27e3c6aa3
                                                                                                                • Opcode Fuzzy Hash: b801ee614e5e46af568c8a2c6154198881c2b5c7af41c3afd88f1e52e1a66e8d
                                                                                                                • Instruction Fuzzy Hash: 88012132D1061D97CF15DFA9D8404CDFBB6EFC9320F654616E11177250EB70258A8BA1
                                                                                                                Function 00C9DACD Relevance: .0, Instructions: 45COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000016.00000002.4014918783.0000000000C9D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C9D000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_22_2_c9d000_FastestVPN.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: 7ba3dd4d703efee55b40f991b58d2cc8db89003cea2cd648189571f1854e9577
                                                                                                                • Instruction ID: 2db46a833825365f39f7f867ffd8ebf6ab1fd27a36b270356d224a6a70c55567
                                                                                                                • Opcode Fuzzy Hash: 7ba3dd4d703efee55b40f991b58d2cc8db89003cea2cd648189571f1854e9577
                                                                                                                • Instruction Fuzzy Hash: 2A012B711093449BEF104E16CDC8B67FF98EF41320F18C45AEE1A2A282CAB89940DA71
                                                                                                                Function 0C40D621 Relevance: .0, Instructions: 45COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000016.00000002.4103457864.000000000C400000.00000040.00000800.00020000.00000000.sdmp, Offset: 0C400000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_22_2_c400000_FastestVPN.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: 8144bf36cdeaf88f2027b9754b968180f3f84492b2014430ffda31765330a022
                                                                                                                • Instruction ID: e601647bd1a452f7ff21462a898c84257925bcc91bd547206891d645c35fc58d
                                                                                                                • Opcode Fuzzy Hash: 8144bf36cdeaf88f2027b9754b968180f3f84492b2014430ffda31765330a022
                                                                                                                • Instruction Fuzzy Hash: 0B01BC32E1175E9BCB01DBA9EC444DDFBB2EFCA310F514616D11077250EB70294ACB91
                                                                                                                Function 0C40D04F Relevance: .0, Instructions: 45COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000016.00000002.4103457864.000000000C400000.00000040.00000800.00020000.00000000.sdmp, Offset: 0C400000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_22_2_c400000_FastestVPN.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: 490937acd1ae831f5c648c574371229534946a557cbde24b01da54ac0830a71a
                                                                                                                • Instruction ID: bc22e2a8ad70baca4f531c62227266c5885888d3ecf160ef1bf9fcc5335df7f7
                                                                                                                • Opcode Fuzzy Hash: 490937acd1ae831f5c648c574371229534946a557cbde24b01da54ac0830a71a
                                                                                                                • Instruction Fuzzy Hash: C80128317042868FDF01ABB8E8086EE7FB2FF85311B1481F9E102C7255DB74580ACB90
                                                                                                                Function 0C40DBA8 Relevance: .0, Instructions: 45COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000016.00000002.4103457864.000000000C400000.00000040.00000800.00020000.00000000.sdmp, Offset: 0C400000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_22_2_c400000_FastestVPN.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: 7ed8c2323ca83aba7ecb467e9d5ab92e990dce393395e69cbbce37f5d0a90a69
                                                                                                                • Instruction ID: 41bc712a3fbece64744838f61b5d2c18a2ed4b80f408261e86da8b7f34bcdfc2
                                                                                                                • Opcode Fuzzy Hash: 7ed8c2323ca83aba7ecb467e9d5ab92e990dce393395e69cbbce37f5d0a90a69
                                                                                                                • Instruction Fuzzy Hash: 15015B71A482288BDF08DBA4C414AADBAB2BF89300F64443AC402B7280DBB59C45CBA1
                                                                                                                Function 0AA4E300 Relevance: .0, Instructions: 45COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000016.00000002.4082922941.000000000AA40000.00000040.00000800.00020000.00000000.sdmp, Offset: 0AA40000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_22_2_aa40000_FastestVPN.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: 8f682012df4027783ad805903a0294a8b7ee59767da37a70c56f94bfaac94069
                                                                                                                • Instruction ID: 8287e67e47cda8f46741c327160f47142d9087290a44cc95da0cc0a57ed4cfcf
                                                                                                                • Opcode Fuzzy Hash: 8f682012df4027783ad805903a0294a8b7ee59767da37a70c56f94bfaac94069
                                                                                                                • Instruction Fuzzy Hash: B20161312006458FD725DF39E98498FBFF1EFC4300B009A2DE55A9B622DF70AD058B90
                                                                                                                Function 0C55AAD0 Relevance: .0, Instructions: 44COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000016.00000002.4104243718.000000000C550000.00000040.00000800.00020000.00000000.sdmp, Offset: 0C550000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_22_2_c550000_FastestVPN.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: e632ef5ab5901ea348890553bd9acfc22af8a967a1848ef1ffd9a967f4c15bc1
                                                                                                                • Instruction ID: 60b9a70c3e20e95c2e5a8208bbc7379592594458819edb7c8be6c1b8bb3fa254
                                                                                                                • Opcode Fuzzy Hash: e632ef5ab5901ea348890553bd9acfc22af8a967a1848ef1ffd9a967f4c15bc1
                                                                                                                • Instruction Fuzzy Hash: AE016D39B026069F87259A69D410866B7A6FFC823532487BBD949C7705DF32EC82D7D0
                                                                                                                Function 0C55B60A Relevance: .0, Instructions: 44COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000016.00000002.4104243718.000000000C550000.00000040.00000800.00020000.00000000.sdmp, Offset: 0C550000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_22_2_c550000_FastestVPN.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: 8868e8bed4dc83aecd62d2815bd6403f9f3f977f880b60cf658c07405e425d31
                                                                                                                • Instruction ID: 7f89ab2b9f1c0fd1ccac8463573bf8b8e69c948abef79553dcd4de194f0a8790
                                                                                                                • Opcode Fuzzy Hash: 8868e8bed4dc83aecd62d2815bd6403f9f3f977f880b60cf658c07405e425d31
                                                                                                                • Instruction Fuzzy Hash: C3014430605288AFDB04CBB5D952ADC7FB2EF8A200B2081EAE449D7392EA719D06D750
                                                                                                                Function 0C558BE8 Relevance: .0, Instructions: 43COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000016.00000002.4104243718.000000000C550000.00000040.00000800.00020000.00000000.sdmp, Offset: 0C550000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_22_2_c550000_FastestVPN.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: d81ed99e37c9160773fa109d3a6de07dd1c5303529a48a6bee3e986e5243db73
                                                                                                                • Instruction ID: 31adbe5e81fc014f658547e3e4ee9aeb1b510bb1ebd24893f5715322dbf48651
                                                                                                                • Opcode Fuzzy Hash: d81ed99e37c9160773fa109d3a6de07dd1c5303529a48a6bee3e986e5243db73
                                                                                                                • Instruction Fuzzy Hash: A3014436B0F3A08FCB0657B854601593BA29E9214035C80EEC4498F292CE169C07C381
                                                                                                                Function 0C55B680 Relevance: .0, Instructions: 43COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000016.00000002.4104243718.000000000C550000.00000040.00000800.00020000.00000000.sdmp, Offset: 0C550000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_22_2_c550000_FastestVPN.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: ff8d688841ab9c848cd1546eb0c7cf539f8b49b0ec89967671c04825b76b09a3
                                                                                                                • Instruction ID: 7763d5b5042f9f7af8b804db19d3f279d65a029d33e3acf6ac68e55fefebdf97
                                                                                                                • Opcode Fuzzy Hash: ff8d688841ab9c848cd1546eb0c7cf539f8b49b0ec89967671c04825b76b09a3
                                                                                                                • Instruction Fuzzy Hash: DF018470905248FFDF00DBB5E94259C7BB1EB96300B2096EDD405E7342DA711F01DB40
                                                                                                                Function 00C9D813 Relevance: .0, Instructions: 43COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000016.00000002.4014918783.0000000000C9D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C9D000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_22_2_c9d000_FastestVPN.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: 6058a55b7a11d7bce5ec017fead89f20dc3b4c626579a582bf45adeee6cb583a
                                                                                                                • Instruction ID: 7e6e973f5b75e3cdae4f974cbf94427605f3e279dc3331eb1538ebd71f851d55
                                                                                                                • Opcode Fuzzy Hash: 6058a55b7a11d7bce5ec017fead89f20dc3b4c626579a582bf45adeee6cb583a
                                                                                                                • Instruction Fuzzy Hash: 11011A72100A04AFCB219F46DD44C23FBBAFF88720355855DE98A4BA22C372F811DFA0
                                                                                                                Function 0C40CF10 Relevance: .0, Instructions: 43COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000016.00000002.4103457864.000000000C400000.00000040.00000800.00020000.00000000.sdmp, Offset: 0C400000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_22_2_c400000_FastestVPN.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: ff88e78462a7a1f67e65b924a5b56ff28832359ad9df9cc66c218eb88660e214
                                                                                                                • Instruction ID: 1864d54aec1bcb60a22c7976acf1af55767ccdc222cace4e6688b61cdd9e0b61
                                                                                                                • Opcode Fuzzy Hash: ff88e78462a7a1f67e65b924a5b56ff28832359ad9df9cc66c218eb88660e214
                                                                                                                • Instruction Fuzzy Hash: A00186316042159FD708FBB8E84569EBBA6EFC43107409A3DE21997645EFB06D098BE4
                                                                                                                Function 0C408CB0 Relevance: .0, Instructions: 42COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000016.00000002.4103457864.000000000C400000.00000040.00000800.00020000.00000000.sdmp, Offset: 0C400000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_22_2_c400000_FastestVPN.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: 9e624331ad8deb9bf0008ca854782f7a8d6f5622b70a13b7eccf232e33ddf1f1
                                                                                                                • Instruction ID: c94b1c04db832496e047be210e3ececf0861a524d7310748a270ddf0e01f1077
                                                                                                                • Opcode Fuzzy Hash: 9e624331ad8deb9bf0008ca854782f7a8d6f5622b70a13b7eccf232e33ddf1f1
                                                                                                                • Instruction Fuzzy Hash: D5F0AF32B4A1108BD7059A5DD010E6FB7E6EBC42617248036E908CB390DA32EC42D794
                                                                                                                Function 0AA48EA3 Relevance: .0, Instructions: 42COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000016.00000002.4082922941.000000000AA40000.00000040.00000800.00020000.00000000.sdmp, Offset: 0AA40000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_22_2_aa40000_FastestVPN.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: 0429fcb30b148368b05cb422f3f8f950f9510374dddf82b78d36ae41478bcca8
                                                                                                                • Instruction ID: e72cf3586f234dfdc98d1e83db5de94a3eea9700b34cf329f49e1b4042c6cc46
                                                                                                                • Opcode Fuzzy Hash: 0429fcb30b148368b05cb422f3f8f950f9510374dddf82b78d36ae41478bcca8
                                                                                                                • Instruction Fuzzy Hash: 0B11F375E10259ABDB15DFA9E954AEEBFF2AF8C300F148169E811B6291CB315900CB60
                                                                                                                Function 0AA48EA8 Relevance: .0, Instructions: 42COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000016.00000002.4082922941.000000000AA40000.00000040.00000800.00020000.00000000.sdmp, Offset: 0AA40000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_22_2_aa40000_FastestVPN.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: f724214657cc1b006f5686b0de609dbf4d9b2299c7c9a5c74a337cb26c8ceb8c
                                                                                                                • Instruction ID: 8fbc2d1c30d5394c89185bf8e647b143a348597724ed682c39e513ddf9c4f143
                                                                                                                • Opcode Fuzzy Hash: f724214657cc1b006f5686b0de609dbf4d9b2299c7c9a5c74a337cb26c8ceb8c
                                                                                                                • Instruction Fuzzy Hash: B1010975E10218ABDF05DFA5D954AEEBFF6AF8C310F148159E911B7290CB715900CBA0
                                                                                                                Function 0AA45508 Relevance: .0, Instructions: 42COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000016.00000002.4082922941.000000000AA40000.00000040.00000800.00020000.00000000.sdmp, Offset: 0AA40000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_22_2_aa40000_FastestVPN.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: 729bf1d0913f5a308854e130a3203a7469f9f1bdc38b0ee1ff7c7375cbfa33a1
                                                                                                                • Instruction ID: 54db695004cb92079c41102c7a0c02d43f0926907620bd2b22e62393d3ddbf01
                                                                                                                • Opcode Fuzzy Hash: 729bf1d0913f5a308854e130a3203a7469f9f1bdc38b0ee1ff7c7375cbfa33a1
                                                                                                                • Instruction Fuzzy Hash: BE016D35A11303DFC7699A39E5045B7B7F7BFC4215B14882DF50686684DAB6EC80CF92
                                                                                                                Function 0C551EE8 Relevance: .0, Instructions: 41COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000016.00000002.4104243718.000000000C550000.00000040.00000800.00020000.00000000.sdmp, Offset: 0C550000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_22_2_c550000_FastestVPN.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: 0ed5fa9f047d78fa86252fc98368be6d380e54461b9d8f5b5a32ebd94ee7ff61
                                                                                                                • Instruction ID: 520d695a288363bffccc5c616a8f7e4c95341a79c0206ab7ea2095e684374415
                                                                                                                • Opcode Fuzzy Hash: 0ed5fa9f047d78fa86252fc98368be6d380e54461b9d8f5b5a32ebd94ee7ff61
                                                                                                                • Instruction Fuzzy Hash: CAF0C8397111449BCB41EF68E41415E7F7AEFC560171005EADA09D7611DB368E069B51
                                                                                                                Function 00C9D804 Relevance: .0, Instructions: 41COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000016.00000002.4014918783.0000000000C9D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C9D000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_22_2_c9d000_FastestVPN.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: e88e2552cb4fa8326291d090707ab8713aaf73e8cfd436e95e230479a8a961a6
                                                                                                                • Instruction ID: eee7032ba2174267f8974d6da8db20649dd4d37c066c02029bfda52b11b21c2d
                                                                                                                • Opcode Fuzzy Hash: e88e2552cb4fa8326291d090707ab8713aaf73e8cfd436e95e230479a8a961a6
                                                                                                                • Instruction Fuzzy Hash: 03010C76104B40AFD7228F55CD44C23BFBAFF89720719858DE9864BA62C272F811DF60
                                                                                                                Function 0C553989 Relevance: .0, Instructions: 40COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000016.00000002.4104243718.000000000C550000.00000040.00000800.00020000.00000000.sdmp, Offset: 0C550000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_22_2_c550000_FastestVPN.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: ebe90ce44c270af995c3ce7ff17633acf3cb0d3ee7aff6e686398bd03a390519
                                                                                                                • Instruction ID: 4707f409e7b75d22927f0d21cb8be021e1b979fb87e1c966669253cfeef3d8b1
                                                                                                                • Opcode Fuzzy Hash: ebe90ce44c270af995c3ce7ff17633acf3cb0d3ee7aff6e686398bd03a390519
                                                                                                                • Instruction Fuzzy Hash: 59F024B93052424BCB15DF7DD8A48AA7BE6EFC6290308056AE54DCF361FE62DC0197A1
                                                                                                                Function 0C55AAC0 Relevance: .0, Instructions: 40COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000016.00000002.4104243718.000000000C550000.00000040.00000800.00020000.00000000.sdmp, Offset: 0C550000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_22_2_c550000_FastestVPN.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: 05116d7188202a1095538861d6a002fbcfd45b3eb24466b0aa8e2f6ec89cf2c1
                                                                                                                • Instruction ID: 975646a81c7fb6fda8ff188f04ef4c7d139c392aa07299f0ec88ba0b3a2efab2
                                                                                                                • Opcode Fuzzy Hash: 05116d7188202a1095538861d6a002fbcfd45b3eb24466b0aa8e2f6ec89cf2c1
                                                                                                                • Instruction Fuzzy Hash: 8C018635B01602DFD721CB25D450866B7A2BF8436571487ABDC4987755CB31EC83DBC0
                                                                                                                Function 0C40D630 Relevance: .0, Instructions: 40COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000016.00000002.4103457864.000000000C400000.00000040.00000800.00020000.00000000.sdmp, Offset: 0C400000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_22_2_c400000_FastestVPN.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: e92c82e51a03e42c018026f255c7a7058cae8957622450deb7744386da334d0c
                                                                                                                • Instruction ID: 9c247ea25d44d8d1e8ae8cfe321c29b0b26b1e200ff98c6324a55829c04c2c34
                                                                                                                • Opcode Fuzzy Hash: e92c82e51a03e42c018026f255c7a7058cae8957622450deb7744386da334d0c
                                                                                                                • Instruction Fuzzy Hash: 38016932E2061E97CF05DBA9DC444DDF7B6EFCA311F614726E11177290EBB0294A8B91
                                                                                                                Function 0AA48872 Relevance: .0, Instructions: 40COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000016.00000002.4082922941.000000000AA40000.00000040.00000800.00020000.00000000.sdmp, Offset: 0AA40000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_22_2_aa40000_FastestVPN.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: 67b3bcd5a95c8c12535fb34cdbea76753a69297f4e806457bf0ffb15bd73900b
                                                                                                                • Instruction ID: 6bd98b4ef3e1d41eb2b46aa85b98ce4ee4edd08b0362bc79964fe623fc07923a
                                                                                                                • Opcode Fuzzy Hash: 67b3bcd5a95c8c12535fb34cdbea76753a69297f4e806457bf0ffb15bd73900b
                                                                                                                • Instruction Fuzzy Hash: 2B01E875A01118DFCB14DBA4E9449EDB7F6FF8C311B244069E806A7394DB36AD02DB50
                                                                                                                Function 0C40B1D4 Relevance: .0, Instructions: 39COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000016.00000002.4103457864.000000000C400000.00000040.00000800.00020000.00000000.sdmp, Offset: 0C400000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_22_2_c400000_FastestVPN.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: d6867f9f28fc388ea8ea95c8ae4fe233efe83a04b37549f8482d8de1cba23b5d
                                                                                                                • Instruction ID: 9e9852cd4535e02a6b1b14cbbd5082d4b7080c0c7aba44959dfc598fcd22563c
                                                                                                                • Opcode Fuzzy Hash: d6867f9f28fc388ea8ea95c8ae4fe233efe83a04b37549f8482d8de1cba23b5d
                                                                                                                • Instruction Fuzzy Hash: 9C01F231B00915CFDB00EF94D845AAD7BF2FB88304F1441A5E4099B39ADB389E05DB80
                                                                                                                Function 0AA4CE88 Relevance: .0, Instructions: 39COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000016.00000002.4082922941.000000000AA40000.00000040.00000800.00020000.00000000.sdmp, Offset: 0AA40000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_22_2_aa40000_FastestVPN.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: 7ab27bc4a2f4af6f6a51618916bcd712e03ba8d2dd389e00841ada9a32b4de8d
                                                                                                                • Instruction ID: 337c3a504c70dc7097c70859ee4c295ba901b4bcb1bd5ab965e5dcf886728772
                                                                                                                • Opcode Fuzzy Hash: 7ab27bc4a2f4af6f6a51618916bcd712e03ba8d2dd389e00841ada9a32b4de8d
                                                                                                                • Instruction Fuzzy Hash: 83F04F357005008FCB44DF3EE4948AA7BE6AFC975071590B9E506CB371DFB19C028B50
                                                                                                                Function 0C550B5B Relevance: .0, Instructions: 38COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000016.00000002.4104243718.000000000C550000.00000040.00000800.00020000.00000000.sdmp, Offset: 0C550000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_22_2_c550000_FastestVPN.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: 75176a09a5447ec924085f38c01e2023ee949564b2e44b840a2e6258d4b1678b
                                                                                                                • Instruction ID: 89600bf68f57036cbb7394c5be0fd7515152052dd2051d6516967335703e6305
                                                                                                                • Opcode Fuzzy Hash: 75176a09a5447ec924085f38c01e2023ee949564b2e44b840a2e6258d4b1678b
                                                                                                                • Instruction Fuzzy Hash: 3EF0FC35D1110997DB14DF54C4959EFBBB2EF84320F11886AD9026B280DFB05A0787C1
                                                                                                                Function 0C40D6A8 Relevance: .0, Instructions: 38COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000016.00000002.4103457864.000000000C400000.00000040.00000800.00020000.00000000.sdmp, Offset: 0C400000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_22_2_c400000_FastestVPN.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: 405b5c6c465a5f1c9ab9c0b3bebb0e4dfb53000816ebd3244fd0fd0774cd6040
                                                                                                                • Instruction ID: ca566d8b7ee89a8117b4f6534f0babbf2546285dcc8662adee53d304495c0019
                                                                                                                • Opcode Fuzzy Hash: 405b5c6c465a5f1c9ab9c0b3bebb0e4dfb53000816ebd3244fd0fd0774cd6040
                                                                                                                • Instruction Fuzzy Hash: 01F0F631E141899BDB16EBB8C4659EFBFF29F98300F14882BD152E7391DE70190AC7A1
                                                                                                                Function 0C408790 Relevance: .0, Instructions: 38COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000016.00000002.4103457864.000000000C400000.00000040.00000800.00020000.00000000.sdmp, Offset: 0C400000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_22_2_c400000_FastestVPN.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: 206adcd170032db8bc6f3f6023aaa51c25f5411943b7312f5e0d9cd068528292
                                                                                                                • Instruction ID: c3b6fbe592298e34e31063e35338da7c734710e7199a310496f80340b529a41c
                                                                                                                • Opcode Fuzzy Hash: 206adcd170032db8bc6f3f6023aaa51c25f5411943b7312f5e0d9cd068528292
                                                                                                                • Instruction Fuzzy Hash: 50F0CD313102509FC718EB78E894A9EBBA2FFC921071006BEE14ACB392DE319C05CBC0
                                                                                                                Function 0C559D01 Relevance: .0, Instructions: 37COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000016.00000002.4104243718.000000000C550000.00000040.00000800.00020000.00000000.sdmp, Offset: 0C550000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_22_2_c550000_FastestVPN.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: fe27b8f2168406a782e3ac7a9c26bc65f0bfbd4cacfdf86a56112e0cdd127c4e
                                                                                                                • Instruction ID: a74dfc2c0128bddbfb27ff6cf00565bdcffd411cd2ad21ff1d1fe2f256780f7a
                                                                                                                • Opcode Fuzzy Hash: fe27b8f2168406a782e3ac7a9c26bc65f0bfbd4cacfdf86a56112e0cdd127c4e
                                                                                                                • Instruction Fuzzy Hash: 5CF0E276708114AFE724CA1BAC50EABBBE9EBC97617008226F808D3300D670EC0286A0
                                                                                                                Function 0C550E4B Relevance: .0, Instructions: 37COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000016.00000002.4104243718.000000000C550000.00000040.00000800.00020000.00000000.sdmp, Offset: 0C550000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_22_2_c550000_FastestVPN.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: 68c40176394a583937931dde4e0967006cf31456746d25b91902bd7adf6e997b
                                                                                                                • Instruction ID: 083ec3c748edbc26b4bb1c3bfb3fbfca2d24380222868a1e0c9de1ad7c11b511
                                                                                                                • Opcode Fuzzy Hash: 68c40176394a583937931dde4e0967006cf31456746d25b91902bd7adf6e997b
                                                                                                                • Instruction Fuzzy Hash: 19F0F635A211059BDB05EBA8C4659EFFBB6EF84310F51882AD912BB280DF70690687D1
                                                                                                                Function 00C9D64F Relevance: .0, Instructions: 37COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000016.00000002.4014918783.0000000000C9D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C9D000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_22_2_c9d000_FastestVPN.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: 3fe5a4ee3d61386d9a0489cd22d3c1de25e3ba4d0ec057f555f9bca2d47dd90a
                                                                                                                • Instruction ID: f250e44f445baf291c979ed38d576a7be9bd4a086504cc9c29f7d8fd170c5cae
                                                                                                                • Opcode Fuzzy Hash: 3fe5a4ee3d61386d9a0489cd22d3c1de25e3ba4d0ec057f555f9bca2d47dd90a
                                                                                                                • Instruction Fuzzy Hash: 17F0F9B6640604AF97208F0AD885C23FBADEBC4770715C55AE94A5B712C672EC41CAA0
                                                                                                                Function 0C40DBFB Relevance: .0, Instructions: 37COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000016.00000002.4103457864.000000000C400000.00000040.00000800.00020000.00000000.sdmp, Offset: 0C400000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_22_2_c400000_FastestVPN.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: 8a68c25655ef1cf942693b789b255c5affbf12a3504cb50b0e5a21f011a9fcd5
                                                                                                                • Instruction ID: c8e37fd04bd096e14cd96d3d8ec5eee1a0fb6295dcb3e12b04f19512760de6e2
                                                                                                                • Opcode Fuzzy Hash: 8a68c25655ef1cf942693b789b255c5affbf12a3504cb50b0e5a21f011a9fcd5
                                                                                                                • Instruction Fuzzy Hash: 72014F70B44515CFDB04DFA8C450A6D7BB1BB49304F20447AE502EB391DB709C01DF60
                                                                                                                Function 0C554FE0 Relevance: .0, Instructions: 36COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000016.00000002.4104243718.000000000C550000.00000040.00000800.00020000.00000000.sdmp, Offset: 0C550000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_22_2_c550000_FastestVPN.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: 84688eac6b6bd145bdebb900a58a48af754976d191bb760c2a3d1752e221bbcf
                                                                                                                • Instruction ID: 913ecbbfee3a8e2b27934dc54b2e9b9a20b570d8bc27969ae5089af0af6d08ce
                                                                                                                • Opcode Fuzzy Hash: 84688eac6b6bd145bdebb900a58a48af754976d191bb760c2a3d1752e221bbcf
                                                                                                                • Instruction Fuzzy Hash: BB011D74E00209EFCF44EFA8D95599DBBB9EF84204F1085A99505A7345DB30AF059F80
                                                                                                                Function 0C554828 Relevance: .0, Instructions: 36COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000016.00000002.4104243718.000000000C550000.00000040.00000800.00020000.00000000.sdmp, Offset: 0C550000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_22_2_c550000_FastestVPN.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: 3df47553349b49fef4d00805deb39c020f67d31075eab11c59d8eaf72bfc0520
                                                                                                                • Instruction ID: 59469908bd6d3b15110a2c40f733449dbb95981c73fcb4624579519b85fe66e8
                                                                                                                • Opcode Fuzzy Hash: 3df47553349b49fef4d00805deb39c020f67d31075eab11c59d8eaf72bfc0520
                                                                                                                • Instruction Fuzzy Hash: B9F0C239218B908BC3218F28E41438BBFF4FFC6708B04485EC1CA47A62D7F5A44AC795
                                                                                                                Function 0C559741 Relevance: .0, Instructions: 36COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000016.00000002.4104243718.000000000C550000.00000040.00000800.00020000.00000000.sdmp, Offset: 0C550000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_22_2_c550000_FastestVPN.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: 4e52603c96b822bc36b116e159b6637328a75551eda8fb51c06cea1ffd88f9b8
                                                                                                                • Instruction ID: 892c14592bf5dc494f33397ee36fabe2429a1726365ba3003d77d7d2620a975c
                                                                                                                • Opcode Fuzzy Hash: 4e52603c96b822bc36b116e159b6637328a75551eda8fb51c06cea1ffd88f9b8
                                                                                                                • Instruction Fuzzy Hash: 02F0E236700501AFD3248A6BAC909AABBD9EFC62B0310862BE509C7344DEB1CC0186A0
                                                                                                                Function 00C9DACC Relevance: .0, Instructions: 36COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000016.00000002.4014918783.0000000000C9D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C9D000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_22_2_c9d000_FastestVPN.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: f72c729f184853939ab61b93e04cbc78274927579697addae513e55a35bb7d6b
                                                                                                                • Instruction ID: 7ca3339b181f184bdf1ba99e4a635414ed2d1db1eedcdbb0a6a718b1fd89c6d8
                                                                                                                • Opcode Fuzzy Hash: f72c729f184853939ab61b93e04cbc78274927579697addae513e55a35bb7d6b
                                                                                                                • Instruction Fuzzy Hash: B0F0F672405344AFEB108E05CCC8B62FF98EB51734F18C55AEE191B286C379AC40CB71
                                                                                                                Function 0AA4CE98 Relevance: .0, Instructions: 36COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000016.00000002.4082922941.000000000AA40000.00000040.00000800.00020000.00000000.sdmp, Offset: 0AA40000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_22_2_aa40000_FastestVPN.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: 6596f0fd733e0493ef61de882f372d346478762fe83d9e292078abfad4e76158
                                                                                                                • Instruction ID: cfdd00a0ede6658b4fbce0dc368cdfa7f5e557b2e76f5a49dc8364b2f86bacd6
                                                                                                                • Opcode Fuzzy Hash: 6596f0fd733e0493ef61de882f372d346478762fe83d9e292078abfad4e76158
                                                                                                                • Instruction Fuzzy Hash: 1CF0FE35710A108FC748DB3EE45486A7BEAAFCD66131580B9E606CB371EFB1DC018B50
                                                                                                                Function 0AA43EC8 Relevance: .0, Instructions: 36COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000016.00000002.4082922941.000000000AA40000.00000040.00000800.00020000.00000000.sdmp, Offset: 0AA40000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_22_2_aa40000_FastestVPN.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: c2c4edd819e75930e442de84f95db1eaa51e5c928ec48818f2bc76c39dd82ac2
                                                                                                                • Instruction ID: c656c9e11cf57a88ea1ff5d8fb9ef7ec2914b45bf7f3933c31fc2f038a5177ca
                                                                                                                • Opcode Fuzzy Hash: c2c4edd819e75930e442de84f95db1eaa51e5c928ec48818f2bc76c39dd82ac2
                                                                                                                • Instruction Fuzzy Hash: 11F090313002018FC618E768E45196E7BDBEFC9210314596DE1069B714EFA4BD0697E2
                                                                                                                Function 00C9D640 Relevance: .0, Instructions: 35COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000016.00000002.4014918783.0000000000C9D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C9D000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_22_2_c9d000_FastestVPN.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: 7fb44887c7ff4d3b3b34a2b4b5b7e1418360827b7acf9b09179782cb0961c061
                                                                                                                • Instruction ID: 8917f5e6b0eff37027d85f9c12cbb9a92a1d0e6b65eeddd8d410fcd887053755
                                                                                                                • Opcode Fuzzy Hash: 7fb44887c7ff4d3b3b34a2b4b5b7e1418360827b7acf9b09179782cb0961c061
                                                                                                                • Instruction Fuzzy Hash: 5EF0EC75104744AFD725CF06C984C23BFB9EF857607198589E85A5B752C671FC42CB60
                                                                                                                Function 0C40D9F8 Relevance: .0, Instructions: 35COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000016.00000002.4103457864.000000000C400000.00000040.00000800.00020000.00000000.sdmp, Offset: 0C400000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_22_2_c400000_FastestVPN.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: aacd4cd4c2993c8670a5cdfe98e540c98b6bc88cf0edacfb49e9e1acaf59fe67
                                                                                                                • Instruction ID: efef297b658da6a2cee8c4e62af23c12e5da942360cf6d4ff69c082490651cc6
                                                                                                                • Opcode Fuzzy Hash: aacd4cd4c2993c8670a5cdfe98e540c98b6bc88cf0edacfb49e9e1acaf59fe67
                                                                                                                • Instruction Fuzzy Hash: C6F0A7227081508FE70893FCA81976F7F9B9FDE311B1850AD924AC73A7CE658D0243D6
                                                                                                                Function 0AA46EA0 Relevance: .0, Instructions: 35COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000016.00000002.4082922941.000000000AA40000.00000040.00000800.00020000.00000000.sdmp, Offset: 0AA40000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_22_2_aa40000_FastestVPN.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: 74d70a309a3eeede60b543641ad9645caf6fb07e436e78c23d160c79df6636b4
                                                                                                                • Instruction ID: 2ce2bf39276653c91a75c299c3db4b56f92f2abbef153abbebda97b8e16357b4
                                                                                                                • Opcode Fuzzy Hash: 74d70a309a3eeede60b543641ad9645caf6fb07e436e78c23d160c79df6636b4
                                                                                                                • Instruction Fuzzy Hash: 63F012722041E83F8B515E9A5C14CFF7FEDEA8E1A17094056FEA8D2141C469CD20ABB0
                                                                                                                Function 0C551415 Relevance: .0, Instructions: 34COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000016.00000002.4104243718.000000000C550000.00000040.00000800.00020000.00000000.sdmp, Offset: 0C550000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_22_2_c550000_FastestVPN.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: cae7745e067cbf4685bc261403dcd9915449140dc6919755add3470d456ed212
                                                                                                                • Instruction ID: 3a916e0e7814fe91f8759bb3a7bd26648e3a8d7026ace7274169443f7e8c5f28
                                                                                                                • Opcode Fuzzy Hash: cae7745e067cbf4685bc261403dcd9915449140dc6919755add3470d456ed212
                                                                                                                • Instruction Fuzzy Hash: D8F09035740904CFDB55EFA8D850A6D3BB2BBC9224B0441EAE90ACB3A5DB30AC42DF51
                                                                                                                Function 0C5527A3 Relevance: .0, Instructions: 34COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000016.00000002.4104243718.000000000C550000.00000040.00000800.00020000.00000000.sdmp, Offset: 0C550000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_22_2_c550000_FastestVPN.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: cd5e909ad56f830c07e21c92d0ac4382cbf97a56b21b2196554d85311f3012b8
                                                                                                                • Instruction ID: 15025e0c76866ffb915b9c91de66fc58907e93107266d7954fbeb8e89145f1b5
                                                                                                                • Opcode Fuzzy Hash: cd5e909ad56f830c07e21c92d0ac4382cbf97a56b21b2196554d85311f3012b8
                                                                                                                • Instruction Fuzzy Hash: B4F09A353142458FC711DB2DE85481A7BEAEFC921070848AAE549CB222DA60EC029790
                                                                                                                Function 0C4087A0 Relevance: .0, Instructions: 33COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000016.00000002.4103457864.000000000C400000.00000040.00000800.00020000.00000000.sdmp, Offset: 0C400000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_22_2_c400000_FastestVPN.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: 48f163e38511a2cc81935b6bee4a03dd18be2813fdb8a094bfac4223dcd45f7c
                                                                                                                • Instruction ID: 0a62e1d89031b3fd9c3defeeee773fcf847ca1d7d244f27e3c51cbc532c074c7
                                                                                                                • Opcode Fuzzy Hash: 48f163e38511a2cc81935b6bee4a03dd18be2813fdb8a094bfac4223dcd45f7c
                                                                                                                • Instruction Fuzzy Hash: 2DF058323102109F8708EB29E88895AB7E6FFC9220350067EE50ACB791EE30EC05CBD4
                                                                                                                Function 0AA463C7 Relevance: .0, Instructions: 33COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000016.00000002.4082922941.000000000AA40000.00000040.00000800.00020000.00000000.sdmp, Offset: 0AA40000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_22_2_aa40000_FastestVPN.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: 58bd61438af21c4d1c9fb3a279ece8ab708ba8a0b61377d09a7653a35f72ad75
                                                                                                                • Instruction ID: 801b0b3ab3982620f0c092b674fc59ea9bd184042cc72332e04a8dc8d22b53f5
                                                                                                                • Opcode Fuzzy Hash: 58bd61438af21c4d1c9fb3a279ece8ab708ba8a0b61377d09a7653a35f72ad75
                                                                                                                • Instruction Fuzzy Hash: 81F0B4327002119FDB24CB58D945F9A7BA5EBC5714F24866AF214CB1D1E7B1E8068B40
                                                                                                                Function 0AA454F8 Relevance: .0, Instructions: 33COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000016.00000002.4082922941.000000000AA40000.00000040.00000800.00020000.00000000.sdmp, Offset: 0AA40000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_22_2_aa40000_FastestVPN.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: ddc53d38ab2f33cfd9b5ff86de47267bbe8076e3c8b7b21b16b6c799ade292ec
                                                                                                                • Instruction ID: f0c30e5e6448451c3cf27206d0ba0d605485722be08ae743cc12195b59fc5c36
                                                                                                                • Opcode Fuzzy Hash: ddc53d38ab2f33cfd9b5ff86de47267bbe8076e3c8b7b21b16b6c799ade292ec
                                                                                                                • Instruction Fuzzy Hash: 20F01D31A00752DFCB24CF25E5446F6B7B6BFC0208B14946DE04646A55C6B6E842CF51
                                                                                                                Function 0AA47D48 Relevance: .0, Instructions: 33COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000016.00000002.4082922941.000000000AA40000.00000040.00000800.00020000.00000000.sdmp, Offset: 0AA40000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_22_2_aa40000_FastestVPN.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: 3300f7ee9fb74ae8bc16e6ed30ba47553a2074a2a777d2f2980e1a1dd8bc626a
                                                                                                                • Instruction ID: 0656e6ae9df1dc468ea938577c870dce5ea8631ff84286511e1ec57c0538f83e
                                                                                                                • Opcode Fuzzy Hash: 3300f7ee9fb74ae8bc16e6ed30ba47553a2074a2a777d2f2980e1a1dd8bc626a
                                                                                                                • Instruction Fuzzy Hash: A0F0A0B27041596F9F64CA69AC84AFF7FAEFBC4254B09442AF409D3280EB708C05CB50
                                                                                                                Function 0AA4EB39 Relevance: .0, Instructions: 32COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000016.00000002.4082922941.000000000AA40000.00000040.00000800.00020000.00000000.sdmp, Offset: 0AA40000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_22_2_aa40000_FastestVPN.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: f2c57b979abc232c533c0fdd34b8b4e2bb2e747a1c1e2fad5153acad4d00b87d
                                                                                                                • Instruction ID: 83a1e2fdf7d010fa5e6c6834073c8e6de5116f965046afc756da5842cd376277
                                                                                                                • Opcode Fuzzy Hash: f2c57b979abc232c533c0fdd34b8b4e2bb2e747a1c1e2fad5153acad4d00b87d
                                                                                                                • Instruction Fuzzy Hash: 6EF0E9313053815FD3354B39D8448927FF6FFD232071842A9E589C7792D621DC02C711
                                                                                                                Function 0C555072 Relevance: .0, Instructions: 31COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000016.00000002.4104243718.000000000C550000.00000040.00000800.00020000.00000000.sdmp, Offset: 0C550000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_22_2_c550000_FastestVPN.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: c80fa5d2fa7e788e1275e810fc94114621f3b26c0923954120940805ff28d013
                                                                                                                • Instruction ID: bf7baac6c09116bf9ef1ba1e8f6aa23e70d2ae275ce1555badf77c73f2f8e2ca
                                                                                                                • Opcode Fuzzy Hash: c80fa5d2fa7e788e1275e810fc94114621f3b26c0923954120940805ff28d013
                                                                                                                • Instruction Fuzzy Hash: 53E0927120E2909FC3028738A858D81FFF4DF4B20176E96EBD048CB2A7C570888AC782
                                                                                                                Function 0C5593D0 Relevance: .0, Instructions: 31COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000016.00000002.4104243718.000000000C550000.00000040.00000800.00020000.00000000.sdmp, Offset: 0C550000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_22_2_c550000_FastestVPN.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: 4f99c5eed8230eb5a9a423ce7104a032e381a7b1274861a36bec3962d3643c33
                                                                                                                • Instruction ID: ee6fe2d18f6e0cabe22bced923bb850f399cc6317567aaf77ae5be2da5f61ea5
                                                                                                                • Opcode Fuzzy Hash: 4f99c5eed8230eb5a9a423ce7104a032e381a7b1274861a36bec3962d3643c33
                                                                                                                • Instruction Fuzzy Hash: 58E092323152109BD7045B6BA898D6A7FB9FBCA77171504BAF90EC7351DA628C068650
                                                                                                                Function 0C40D845 Relevance: .0, Instructions: 31COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000016.00000002.4103457864.000000000C400000.00000040.00000800.00020000.00000000.sdmp, Offset: 0C400000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_22_2_c400000_FastestVPN.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: 5d1ade80821540b0178ffc32fc5bd9baccd95ab3eeb5cdd49e79d84d1b38ed47
                                                                                                                • Instruction ID: 6abedcf71a318a75c2c26906e426e4e5752afff5520e8539036a9085fae4b675
                                                                                                                • Opcode Fuzzy Hash: 5d1ade80821540b0178ffc32fc5bd9baccd95ab3eeb5cdd49e79d84d1b38ed47
                                                                                                                • Instruction Fuzzy Hash: 12F0E735E002088FDB05CFA8D4849CDBBB5FF89321F1491A6D506EB252D770AD89CF60
                                                                                                                Function 0AA4CE3F Relevance: .0, Instructions: 31COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000016.00000002.4082922941.000000000AA40000.00000040.00000800.00020000.00000000.sdmp, Offset: 0AA40000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_22_2_aa40000_FastestVPN.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: 61580ff4eb90d368082360f634b4d59c815860f1bfe09f844976633dc1289c98
                                                                                                                • Instruction ID: c15bf1fbada9d7cf2db8d899ca96a078cd5dee6508d0fdd432193cd825a6df82
                                                                                                                • Opcode Fuzzy Hash: 61580ff4eb90d368082360f634b4d59c815860f1bfe09f844976633dc1289c98
                                                                                                                • Instruction Fuzzy Hash: 9EF082356042119FC714CF69E88099AFBE9FF85720714817DE81CC7201C731D846CB90
                                                                                                                Function 0C40DA08 Relevance: .0, Instructions: 30COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000016.00000002.4103457864.000000000C400000.00000040.00000800.00020000.00000000.sdmp, Offset: 0C400000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_22_2_c400000_FastestVPN.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: 17a7b1d0ba36c0fdc181bd1f314ffa800bd3ffaf16bb0f4400a607d9a124687b
                                                                                                                • Instruction ID: b530060dac8629c6baab60148641a7cde737cefe26e8b6ea47b08b0e8fd97d40
                                                                                                                • Opcode Fuzzy Hash: 17a7b1d0ba36c0fdc181bd1f314ffa800bd3ffaf16bb0f4400a607d9a124687b
                                                                                                                • Instruction Fuzzy Hash: 93E0D8317001149BE70866BDA81972F7D9FEBCC711B14502DA30AC7396DFB59C0243E5
                                                                                                                Function 0C40CFD9 Relevance: .0, Instructions: 28COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000016.00000002.4103457864.000000000C400000.00000040.00000800.00020000.00000000.sdmp, Offset: 0C400000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_22_2_c400000_FastestVPN.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: 21ca224a78bfaf08ed5380ca78e5c76dc67c3b8927546f3ce73010a273ca5a13
                                                                                                                • Instruction ID: d7509899e6698ee5dc8430d3e82ddaf90cd8d5d3bfc1cb2126465436e7b1da04
                                                                                                                • Opcode Fuzzy Hash: 21ca224a78bfaf08ed5380ca78e5c76dc67c3b8927546f3ce73010a273ca5a13
                                                                                                                • Instruction Fuzzy Hash: 1DF0BE70A05681CFD701EBB8E9409AC3FB1EF85300F2486EDC44993216EE35190CCB91
                                                                                                                Function 0C551EA8 Relevance: .0, Instructions: 27COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000016.00000002.4104243718.000000000C550000.00000040.00000800.00020000.00000000.sdmp, Offset: 0C550000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_22_2_c550000_FastestVPN.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: d6db9af71c9b5f23d4a5aef8796fc48b8262424622a38d23c018448a49fac491
                                                                                                                • Instruction ID: c3ff4a9dae6559b65485d4a17756cf73dcdbf761c0b51f365c691f62856d891a
                                                                                                                • Opcode Fuzzy Hash: d6db9af71c9b5f23d4a5aef8796fc48b8262424622a38d23c018448a49fac491
                                                                                                                • Instruction Fuzzy Hash: 86E0D8397192901B87461669742415A7F7DCEC7A11318049BE645CB342CD17CC429765
                                                                                                                Function 0C552888 Relevance: .0, Instructions: 27COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000016.00000002.4104243718.000000000C550000.00000040.00000800.00020000.00000000.sdmp, Offset: 0C550000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_22_2_c550000_FastestVPN.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: dd97124d741a940e75e0857e5bf270bf978a12b6686c0dc860aff277c7445fb7
                                                                                                                • Instruction ID: 0f028737b02e2a2a66123b5a7e88f3342210c2d05d6949ed5685f38dde6f314e
                                                                                                                • Opcode Fuzzy Hash: dd97124d741a940e75e0857e5bf270bf978a12b6686c0dc860aff277c7445fb7
                                                                                                                • Instruction Fuzzy Hash: 09E092307052049FC701DBDCA4154ADBBB9EF8531170448A7E10AC7260CE309811D7D0
                                                                                                                Function 0C55B642 Relevance: .0, Instructions: 27COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000016.00000002.4104243718.000000000C550000.00000040.00000800.00020000.00000000.sdmp, Offset: 0C550000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_22_2_c550000_FastestVPN.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: 70f20bb5a4c2e088e3774cbcab8766d82df582c9d64d243b88ae7a7a5f60eee9
                                                                                                                • Instruction ID: 93c4dc19d486e3005905ef6af7108f24c048a93f897a50dbbe74cc3284c57161
                                                                                                                • Opcode Fuzzy Hash: 70f20bb5a4c2e088e3774cbcab8766d82df582c9d64d243b88ae7a7a5f60eee9
                                                                                                                • Instruction Fuzzy Hash: C6E0C2363540246BE51562F93C16ABA7B8ACBC9652B2882ABEE08C7780CD754C1313A1
                                                                                                                Function 0C406FD8 Relevance: .0, Instructions: 27COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000016.00000002.4103457864.000000000C400000.00000040.00000800.00020000.00000000.sdmp, Offset: 0C400000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_22_2_c400000_FastestVPN.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: 01bc2087722a3a64de6d1f66465b0e67c545e863801d3ef0be8b1a8a3f7ab526
                                                                                                                • Instruction ID: 369aa7e07bc5437d740b9766bcabfe8f269850f56a38ce82ff3003cab84a61df
                                                                                                                • Opcode Fuzzy Hash: 01bc2087722a3a64de6d1f66465b0e67c545e863801d3ef0be8b1a8a3f7ab526
                                                                                                                • Instruction Fuzzy Hash: B6E0863A7052548BD705163AA80897E7BAEAFDB16271840B7E945C7381FE79CC028762
                                                                                                                Function 0C406FE8 Relevance: .0, Instructions: 27COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000016.00000002.4103457864.000000000C400000.00000040.00000800.00020000.00000000.sdmp, Offset: 0C400000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_22_2_c400000_FastestVPN.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: 04735427095dbe39de3498a700a4b15eaf375b3c1ecaa12e505d6862ffd289ea
                                                                                                                • Instruction ID: c84eabd97058ee26b27e5fde02a903b71a33e8326e450d500effae17ed8237ea
                                                                                                                • Opcode Fuzzy Hash: 04735427095dbe39de3498a700a4b15eaf375b3c1ecaa12e505d6862ffd289ea
                                                                                                                • Instruction Fuzzy Hash: 5AE0863A34111447C714167DB4085BE779EEFC91727144077E909C3340EE75CC0253A1
                                                                                                                Function 0AA4CE50 Relevance: .0, Instructions: 27COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000016.00000002.4082922941.000000000AA40000.00000040.00000800.00020000.00000000.sdmp, Offset: 0AA40000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_22_2_aa40000_FastestVPN.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: f05416c0cf2cefb7e34a14cf0c654be102ca755752c20a0444c92a3551913d74
                                                                                                                • Instruction ID: 76dac5486745f39b9d771573722df6654933cb3ab27eb19489a8b0f27fd2f4fc
                                                                                                                • Opcode Fuzzy Hash: f05416c0cf2cefb7e34a14cf0c654be102ca755752c20a0444c92a3551913d74
                                                                                                                • Instruction Fuzzy Hash: 91E01A36605625AF9715CF59E88485BBBEDFB89761311812AF81CC7340CB72EC42CBE0
                                                                                                                Function 0C4050E8 Relevance: .0, Instructions: 26COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000016.00000002.4103457864.000000000C400000.00000040.00000800.00020000.00000000.sdmp, Offset: 0C400000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_22_2_c400000_FastestVPN.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: 7115b380229c57a73ccb2df7b64ea105df1ded50ddcfc3b76a37d3b116e2e0b5
                                                                                                                • Instruction ID: fcb9e7ea7a9e2a5838cdb6f6f9dc52ad594951aa2ec7d4bda283243cf223c32a
                                                                                                                • Opcode Fuzzy Hash: 7115b380229c57a73ccb2df7b64ea105df1ded50ddcfc3b76a37d3b116e2e0b5
                                                                                                                • Instruction Fuzzy Hash: 3CE0ED317592118F8B04AB12D5548663BE9FF8821131001A7C808CF283CA20C802CBE4
                                                                                                                Function 0AA4ED68 Relevance: .0, Instructions: 26COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000016.00000002.4082922941.000000000AA40000.00000040.00000800.00020000.00000000.sdmp, Offset: 0AA40000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_22_2_aa40000_FastestVPN.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: dc85e79585cbf761c96d2b6bb2fe95c0badebe5e5250b171d04116e14de9d685
                                                                                                                • Instruction ID: 5f6915a33911d61c68657520716e22d41b00aab08a14eb7f07518540f716106b
                                                                                                                • Opcode Fuzzy Hash: dc85e79585cbf761c96d2b6bb2fe95c0badebe5e5250b171d04116e14de9d685
                                                                                                                • Instruction Fuzzy Hash: ECE04F363001145BC7109A4EE404D9ABBAEEBD97717058037F609C7360CA71DC5286E4
                                                                                                                Function 0C40B625 Relevance: .0, Instructions: 25COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000016.00000002.4103457864.000000000C400000.00000040.00000800.00020000.00000000.sdmp, Offset: 0C400000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_22_2_c400000_FastestVPN.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: da4dd30d170b11f17f30e209592698eff6193815ce3ce3b469ea09e64934651d
                                                                                                                • Instruction ID: fbe6fac1cc667ffd2401c38a465842783c0c937b79e90c209bf92471c0a37b08
                                                                                                                • Opcode Fuzzy Hash: da4dd30d170b11f17f30e209592698eff6193815ce3ce3b469ea09e64934651d
                                                                                                                • Instruction Fuzzy Hash: 8DE092B0E443845FD745DFBD581176ABFF29B86700F24C6EAD888DB283E63105568791
                                                                                                                Function 0C551E70 Relevance: .0, Instructions: 24COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000016.00000002.4104243718.000000000C550000.00000040.00000800.00020000.00000000.sdmp, Offset: 0C550000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_22_2_c550000_FastestVPN.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: c312d77586b9cb40e0b47025e8a2a68bb3866b1fd98c0c93b9adaf60a883f07a
                                                                                                                • Instruction ID: ce2ba224da304bf29fb30c686463e839c491452cf67bf45e4b12c4d48a2b022a
                                                                                                                • Opcode Fuzzy Hash: c312d77586b9cb40e0b47025e8a2a68bb3866b1fd98c0c93b9adaf60a883f07a
                                                                                                                • Instruction Fuzzy Hash: 4BE04F383157859FCF479B6AA82462A7FA8AB4650830408DB994ACB293EA26D8038715
                                                                                                                Function 0C55066E Relevance: .0, Instructions: 24COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000016.00000002.4104243718.000000000C550000.00000040.00000800.00020000.00000000.sdmp, Offset: 0C550000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_22_2_c550000_FastestVPN.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: 4a425c59b573b3de7f423f438f154e3cb914b5f5671edc794a897fa5c19dcf1c
                                                                                                                • Instruction ID: d9c69ba1afb6c4375e58a84b008a2d5cc35ba089076efabd2f1cb460e6358c49
                                                                                                                • Opcode Fuzzy Hash: 4a425c59b573b3de7f423f438f154e3cb914b5f5671edc794a897fa5c19dcf1c
                                                                                                                • Instruction Fuzzy Hash: 89E0863C70874B4E6B21627654751673BD16BC4258B205A73CC45CB6C2F611C8054650
                                                                                                                Function 0C40CFE8 Relevance: .0, Instructions: 24COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000016.00000002.4103457864.000000000C400000.00000040.00000800.00020000.00000000.sdmp, Offset: 0C400000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_22_2_c400000_FastestVPN.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: f9db692499f498134047d6d268420f3cd6f21d94d692fceee29276e6cf76edcc
                                                                                                                • Instruction ID: 4aed36c74b330f89b902b71f078b64366a789d85d0de460b2491159b5a56d372
                                                                                                                • Opcode Fuzzy Hash: f9db692499f498134047d6d268420f3cd6f21d94d692fceee29276e6cf76edcc
                                                                                                                • Instruction Fuzzy Hash: 50E06D74911606DBD700FFB8E94095C7BB5EF84210B204AA9D90993608EF752D1C9B91
                                                                                                                Function 0C407363 Relevance: .0, Instructions: 24COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000016.00000002.4103457864.000000000C400000.00000040.00000800.00020000.00000000.sdmp, Offset: 0C400000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_22_2_c400000_FastestVPN.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: b4bf8e2a92f8568d3d73363a0d62a6e1d5bf70baff60437b99ec9f1e77057eec
                                                                                                                • Instruction ID: bb2ad04a52fc18d1b372669b504ce0cb9f824766073e60aeb87c67c45b9805c1
                                                                                                                • Opcode Fuzzy Hash: b4bf8e2a92f8568d3d73363a0d62a6e1d5bf70baff60437b99ec9f1e77057eec
                                                                                                                • Instruction Fuzzy Hash: 46E0E51160E7D10FC70797B82838184BF725E8751470E51DFC489DB2A3C9189D4993E6
                                                                                                                Function 0C5528B0 Relevance: .0, Instructions: 23COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000016.00000002.4104243718.000000000C550000.00000040.00000800.00020000.00000000.sdmp, Offset: 0C550000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_22_2_c550000_FastestVPN.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: 368f5856b5301f82b0eaf323045daec5118f1282a8b95e842153dde6e54819a8
                                                                                                                • Instruction ID: 58864dd78d6db34db0c0209f8f89f41825da9a0adf20eaaf022764fc8f12e0bd
                                                                                                                • Opcode Fuzzy Hash: 368f5856b5301f82b0eaf323045daec5118f1282a8b95e842153dde6e54819a8
                                                                                                                • Instruction Fuzzy Hash: 20F03970E09308AFCB45DFA8D4954DCBFF0AB45300F0080EAD418973A0EA345A14CF91
                                                                                                                Function 0C551A0F Relevance: .0, Instructions: 23COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000016.00000002.4104243718.000000000C550000.00000040.00000800.00020000.00000000.sdmp, Offset: 0C550000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_22_2_c550000_FastestVPN.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: cd4ef396aa38e36b530deeedbbc1db05d278bc8d22e18a573df2330ba9661f62
                                                                                                                • Instruction ID: 5e15a285d459457290171f1b143b1024f22aabc2376142e3488afcb66a53d600
                                                                                                                • Opcode Fuzzy Hash: cd4ef396aa38e36b530deeedbbc1db05d278bc8d22e18a573df2330ba9661f62
                                                                                                                • Instruction Fuzzy Hash: 1EE06D78E082098F8B80EFA8C4955ADFFF0EB49604B1484A9D84DD3301D3718A02CB80
                                                                                                                Function 0C405FE8 Relevance: .0, Instructions: 23COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000016.00000002.4103457864.000000000C400000.00000040.00000800.00020000.00000000.sdmp, Offset: 0C400000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_22_2_c400000_FastestVPN.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: d48c7d7bfd3f2bd8633cc49a4199f810fb5335f58f13e12a7c9f0432f643ada4
                                                                                                                • Instruction ID: 25ee2f60e381bb2a4b4b941d9a343dca770abe78843246ca700bcad0c9ada3b9
                                                                                                                • Opcode Fuzzy Hash: d48c7d7bfd3f2bd8633cc49a4199f810fb5335f58f13e12a7c9f0432f643ada4
                                                                                                                • Instruction Fuzzy Hash: F8E0D8323102608FCA04F794C45069C37E3EFCD320B0459A5DE083B355CE609C028BD5
                                                                                                                Function 0C408CA3 Relevance: .0, Instructions: 22COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000016.00000002.4103457864.000000000C400000.00000040.00000800.00020000.00000000.sdmp, Offset: 0C400000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_22_2_c400000_FastestVPN.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: a4966fa7468924d86328a332535f789f49772daf22a81337af13879c539ed1f6
                                                                                                                • Instruction ID: 39d19fec9b2dd727345318a4fcf1e90abc898256899172fdede4e65357696d97
                                                                                                                • Opcode Fuzzy Hash: a4966fa7468924d86328a332535f789f49772daf22a81337af13879c539ed1f6
                                                                                                                • Instruction Fuzzy Hash: D8E0863170D2C01E8712D7BA65449EB7FF59ED615131880ABE088C7252D5208401D771
                                                                                                                Function 0C550269 Relevance: .0, Instructions: 21COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000016.00000002.4104243718.000000000C550000.00000040.00000800.00020000.00000000.sdmp, Offset: 0C550000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_22_2_c550000_FastestVPN.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: a2a6fbc75351b4ac796b3e7837952cd6df1d9a6218026fbf7baaf4bd88f9b640
                                                                                                                • Instruction ID: e5477eabbefe83826cdb5b313c0d4abd674eba9d49ac6479a8c0e1aceb59d65e
                                                                                                                • Opcode Fuzzy Hash: a2a6fbc75351b4ac796b3e7837952cd6df1d9a6218026fbf7baaf4bd88f9b640
                                                                                                                • Instruction Fuzzy Hash: 43E08674D051189F8F50DFF8A5151EEBFF4FFC8254B1045B6D85AE3205E2344A01CB80
                                                                                                                Function 0C551EB8 Relevance: .0, Instructions: 20COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000016.00000002.4104243718.000000000C550000.00000040.00000800.00020000.00000000.sdmp, Offset: 0C550000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_22_2_c550000_FastestVPN.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: c1224f41a4ead0f6f291a81565c44f9456c46ddbace9bccbd1bfb94099e0d7ad
                                                                                                                • Instruction ID: 4ad2c43392f782e2c6936d43bc27ba9dc4b674ff73e862e7f8b241f67e173447
                                                                                                                • Opcode Fuzzy Hash: c1224f41a4ead0f6f291a81565c44f9456c46ddbace9bccbd1bfb94099e0d7ad
                                                                                                                • Instruction Fuzzy Hash: EFD0A73A311120230584229E741892F7AAECBC9F61714042FFA0AC7300CE578C4343E5
                                                                                                                Function 0C5528C0 Relevance: .0, Instructions: 19COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000016.00000002.4104243718.000000000C550000.00000040.00000800.00020000.00000000.sdmp, Offset: 0C550000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_22_2_c550000_FastestVPN.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: bc5d05e6138b6fb95c2e77681233e503a8ef805909259d8c9dc3b257fb5d7c52
                                                                                                                • Instruction ID: 83083ccada41f00631e89e231ef7249bb1f94f7262de5de4ead87223058025e6
                                                                                                                • Opcode Fuzzy Hash: bc5d05e6138b6fb95c2e77681233e503a8ef805909259d8c9dc3b257fb5d7c52
                                                                                                                • Instruction Fuzzy Hash: B0E0B670E0420CEFCB54EFA8D44559DBFF5EB88300F0085A9E919E7350EA745A05CF91
                                                                                                                Function 0C550680 Relevance: .0, Instructions: 19COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000016.00000002.4104243718.000000000C550000.00000040.00000800.00020000.00000000.sdmp, Offset: 0C550000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_22_2_c550000_FastestVPN.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: 4aa6ecb12374e6cbe82e79fc85134496427375efc51abe75ff264b1aca8f478b
                                                                                                                • Instruction ID: 7ca202d390cc94420116ec02cbe7f95d3c8ae86bf655ebf7afd7a9caadcdfa06
                                                                                                                • Opcode Fuzzy Hash: 4aa6ecb12374e6cbe82e79fc85134496427375efc51abe75ff264b1aca8f478b
                                                                                                                • Instruction Fuzzy Hash: CAD09E7C714B0B8F5B156677996152373DABBC46647218A72DC05CB7C6FA20D80146A0
                                                                                                                Function 0C40B638 Relevance: .0, Instructions: 19COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000016.00000002.4103457864.000000000C400000.00000040.00000800.00020000.00000000.sdmp, Offset: 0C400000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_22_2_c400000_FastestVPN.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: 78a6b55709e00db28bf301511fdf660e79428c5d8eb36cf6f5f59eaaf18aa057
                                                                                                                • Instruction ID: 993ac6caa4f1b3398a215de34a39d5d4016478976e3cc7edae4936ecfb4f2cc0
                                                                                                                • Opcode Fuzzy Hash: 78a6b55709e00db28bf301511fdf660e79428c5d8eb36cf6f5f59eaaf18aa057
                                                                                                                • Instruction Fuzzy Hash: 48E01270E453485FD784EFB9580176EBBF6A784200F64C5A6C90CDB285E7705A554BC1
                                                                                                                Function 0AA45DC0 Relevance: .0, Instructions: 19COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000016.00000002.4082922941.000000000AA40000.00000040.00000800.00020000.00000000.sdmp, Offset: 0AA40000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_22_2_aa40000_FastestVPN.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: ed03ea0253d01c071bfd561588ab69abb289c55bba4cb1004d65c430b4225ccc
                                                                                                                • Instruction ID: 7bc0a50fd9e3a6c9902cd46ef70a7b6b3c403b83dc1bc434054b081c6751fa78
                                                                                                                • Opcode Fuzzy Hash: ed03ea0253d01c071bfd561588ab69abb289c55bba4cb1004d65c430b4225ccc
                                                                                                                • Instruction Fuzzy Hash: B8E072323043038BDB18CBA8D4406A73BD39FC8322B05482FA20A8B6A1CE60AC008780
                                                                                                                Function 0C551A20 Relevance: .0, Instructions: 18COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000016.00000002.4104243718.000000000C550000.00000040.00000800.00020000.00000000.sdmp, Offset: 0C550000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_22_2_c550000_FastestVPN.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: dbc70ccbbb489de7f7f4fa514fc1cc4d53cac31e840b05c756ad1825859a7919
                                                                                                                • Instruction ID: 12b50b8215f5f74a40dc23636fa92eeb0a4b392b7a052d30b41298ef8e878617
                                                                                                                • Opcode Fuzzy Hash: dbc70ccbbb489de7f7f4fa514fc1cc4d53cac31e840b05c756ad1825859a7919
                                                                                                                • Instruction Fuzzy Hash: 44E0B674D04209DF8B80DFA8C98156EFFF4EB48200F1085AAD91DE7301E7319A028BD1
                                                                                                                Function 0C550278 Relevance: .0, Instructions: 17COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000016.00000002.4104243718.000000000C550000.00000040.00000800.00020000.00000000.sdmp, Offset: 0C550000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_22_2_c550000_FastestVPN.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: f18a4a2378a0df4a01fd420ecbc62c10522127a5e4e457b504b534609c519d58
                                                                                                                • Instruction ID: a303af51e57306a1918fade36a4ca94f379e803d067c48e7557842677782020b
                                                                                                                • Opcode Fuzzy Hash: f18a4a2378a0df4a01fd420ecbc62c10522127a5e4e457b504b534609c519d58
                                                                                                                • Instruction Fuzzy Hash: 95D017B1D01219AF8B40EFF999051DEBBF8FA48260B000866D909E3200E6304A108BD1
                                                                                                                Function 0C40F8A9 Relevance: .0, Instructions: 17COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000016.00000002.4103457864.000000000C400000.00000040.00000800.00020000.00000000.sdmp, Offset: 0C400000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_22_2_c400000_FastestVPN.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: d92cc928f30509eb950c06f401cef7174fd768534eaf428a5cd06ffc8ab20fc0
                                                                                                                • Instruction ID: e8d7d4bbd4607ed670c2c8fae6c9b194c1a6b1b74586b97b15bd7f2f3c1e622a
                                                                                                                • Opcode Fuzzy Hash: d92cc928f30509eb950c06f401cef7174fd768534eaf428a5cd06ffc8ab20fc0
                                                                                                                • Instruction Fuzzy Hash: F1D02E34900188DAEF1083BDE20A8EE7F74ABC0200F1044B0C680A70C3EBB2093ECBD2
                                                                                                                Function 0AA45DD0 Relevance: .0, Instructions: 17COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000016.00000002.4082922941.000000000AA40000.00000040.00000800.00020000.00000000.sdmp, Offset: 0AA40000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_22_2_aa40000_FastestVPN.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: 4418b3e75d07f15a54d0645c7a2c03866d812b668a548fd4fe49d197195df08b
                                                                                                                • Instruction ID: 98e61062fd282b3ccac873c4253d9a64bdbfa7658532d3fbfe7278dead29e463
                                                                                                                • Opcode Fuzzy Hash: 4418b3e75d07f15a54d0645c7a2c03866d812b668a548fd4fe49d197195df08b
                                                                                                                • Instruction Fuzzy Hash: A3D05E32200716878A14E76AE8404AB7BD9DEC4220301942AA60A87650DEA0EC0187C0
                                                                                                                Function 0C551EF8 Relevance: .0, Instructions: 16COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000016.00000002.4104243718.000000000C550000.00000040.00000800.00020000.00000000.sdmp, Offset: 0C550000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_22_2_c550000_FastestVPN.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: 066533bf455bbd6da8aaa6493bcad0d35c4a6805d3930f0699bcd83c02219eb7
                                                                                                                • Instruction ID: 54593ff9dbc206408e23607df25c3a570f48b5cbb31f248109e5f7a03902e7d9
                                                                                                                • Opcode Fuzzy Hash: 066533bf455bbd6da8aaa6493bcad0d35c4a6805d3930f0699bcd83c02219eb7
                                                                                                                • Instruction Fuzzy Hash: 66D01271A00109EBCB40DFA8E90155DB7B9DB84200B1045D9D508E3210DB316F009B50
                                                                                                                Function 0C55B690 Relevance: .0, Instructions: 16COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000016.00000002.4104243718.000000000C550000.00000040.00000800.00020000.00000000.sdmp, Offset: 0C550000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_22_2_c550000_FastestVPN.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: 3612cf6c98a03283247b620b4e0fd4433a46dcc67c6fa26856b74db51c4744d1
                                                                                                                • Instruction ID: 63ba6cbe865fce2bcf357091ca1f6be78e08f64e9cc24df93dd1e8993d3cc62b
                                                                                                                • Opcode Fuzzy Hash: 3612cf6c98a03283247b620b4e0fd4433a46dcc67c6fa26856b74db51c4744d1
                                                                                                                • Instruction Fuzzy Hash: 96D01730A0120DFF8B00EFA9E94259DBBF9EB98200B1081EA9508E3300EA316F009B81
                                                                                                                Function 0C550122 Relevance: .0, Instructions: 15COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000016.00000002.4104243718.000000000C550000.00000040.00000800.00020000.00000000.sdmp, Offset: 0C550000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_22_2_c550000_FastestVPN.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: 3a0b4fc83566a41c31551a403665cbb1b68f29fb78abe4c7565e55d76b2702d5
                                                                                                                • Instruction ID: 3c1446eef4482cc2360c3964719d02579b025915a83064e96c50076e3a8a0b97
                                                                                                                • Opcode Fuzzy Hash: 3a0b4fc83566a41c31551a403665cbb1b68f29fb78abe4c7565e55d76b2702d5
                                                                                                                • Instruction Fuzzy Hash: E3D0E239740408CBCB04EB94E044A9A77B1FB8832AF200496E6055B664C7359A059B91
                                                                                                                Function 0C40D8DB Relevance: .0, Instructions: 15COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000016.00000002.4103457864.000000000C400000.00000040.00000800.00020000.00000000.sdmp, Offset: 0C400000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_22_2_c400000_FastestVPN.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: 8a97862583cb995afe15dbe4889c3dae204084a5d05ac34b9708b3c0ecc1d665
                                                                                                                • Instruction ID: e52fbeef1924a93a153c67df693105fbd85d27a636d6dcd5e6aaae31f2581db3
                                                                                                                • Opcode Fuzzy Hash: 8a97862583cb995afe15dbe4889c3dae204084a5d05ac34b9708b3c0ecc1d665
                                                                                                                • Instruction Fuzzy Hash: 10D02336F051498FCB148BFCD8004DCFBE0DEC4130310C1A7C529C7191C63485158B32
                                                                                                                Function 0C406CA0 Relevance: .0, Instructions: 14COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000016.00000002.4103457864.000000000C400000.00000040.00000800.00020000.00000000.sdmp, Offset: 0C400000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_22_2_c400000_FastestVPN.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: cd43a9a473eb7124c976aab42f98d0202ed93c84d52bf85460418719ad93a6e4
                                                                                                                • Instruction ID: be01bd91a46d6f906e2c5da13bbf38383e01b1080e592f7c29fd289b6bca492d
                                                                                                                • Opcode Fuzzy Hash: cd43a9a473eb7124c976aab42f98d0202ed93c84d52bf85460418719ad93a6e4
                                                                                                                • Instruction Fuzzy Hash: 04C08C22700470234684A15D7808C9EC29ABBC9961361423AE81EE3348CA30AC4283D1
                                                                                                                Function 0C40F8B8 Relevance: .0, Instructions: 14COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000016.00000002.4103457864.000000000C400000.00000040.00000800.00020000.00000000.sdmp, Offset: 0C400000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_22_2_c400000_FastestVPN.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: a11ce49d5958d625c3af1b13410fe7f032ce93e4c43d16d3eea14551a5c0cd6d
                                                                                                                • Instruction ID: a44f2306a367c20a47443bfb8dfd6b6502d40b1d9bc3acca8b4eb64126304efa
                                                                                                                • Opcode Fuzzy Hash: a11ce49d5958d625c3af1b13410fe7f032ce93e4c43d16d3eea14551a5c0cd6d
                                                                                                                • Instruction Fuzzy Hash: 70C01235A0420CD7DF04A6A9E9095DA7779E784211F500471D605A3185EB712A2A59A2
                                                                                                                Function 0C408822 Relevance: .0, Instructions: 13COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000016.00000002.4103457864.000000000C400000.00000040.00000800.00020000.00000000.sdmp, Offset: 0C400000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_22_2_c400000_FastestVPN.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: f094a617b1c46dba100537897c6d29af5630f5b2c444a545058152571da7c923
                                                                                                                • Instruction ID: 4699e4cc29a9b1e9170f2940d54b1e05d6b111209ac221c3d19beb283fb792b4
                                                                                                                • Opcode Fuzzy Hash: f094a617b1c46dba100537897c6d29af5630f5b2c444a545058152571da7c923
                                                                                                                • Instruction Fuzzy Hash: 16C022BA30C6648BCF196324B104C9C7F70FEC613032013AFC5468A0C1C73108078A81
                                                                                                                Function 0C40F8D3 Relevance: .0, Instructions: 13COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000016.00000002.4103457864.000000000C400000.00000040.00000800.00020000.00000000.sdmp, Offset: 0C400000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_22_2_c400000_FastestVPN.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: 957ee8142ce22ab1401c2489aa91a07e1bd2504f097a5ab77e76c02400dbb265
                                                                                                                • Instruction ID: 7ff3d784f866f426b014ff70cbca954f50f1487cf44f9f01f8095691dbd98297
                                                                                                                • Opcode Fuzzy Hash: 957ee8142ce22ab1401c2489aa91a07e1bd2504f097a5ab77e76c02400dbb265
                                                                                                                • Instruction Fuzzy Hash: A4D06775E00518CFEF11DFD4E9408EDBBB1FB88200B204166E915A2214D7385916AF51
                                                                                                                Function 0C407D00 Relevance: .0, Instructions: 12COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000016.00000002.4103457864.000000000C400000.00000040.00000800.00020000.00000000.sdmp, Offset: 0C400000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_22_2_c400000_FastestVPN.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: 4046ecf972ff82a2c31640d533d877ddfc594f1588b08cc0bf342da8cd51198e
                                                                                                                • Instruction ID: b2eb51eeb67594ab0e285057de2753f13cb591d9d8fdf0690a2a8b419c6bfa37
                                                                                                                • Opcode Fuzzy Hash: 4046ecf972ff82a2c31640d533d877ddfc594f1588b08cc0bf342da8cd51198e
                                                                                                                • Instruction Fuzzy Hash: 11D012352095C09FC702DBB9D845DC47F709F2B124F1980CAE08DDB233C512C508CB12
                                                                                                                Function 0C40C42F Relevance: .0, Instructions: 10COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000016.00000002.4103457864.000000000C400000.00000040.00000800.00020000.00000000.sdmp, Offset: 0C400000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_22_2_c400000_FastestVPN.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: 0dd1c51c6929227c41c63f359ca2e747dae7f1abdc37dddbf728280b24538db3
                                                                                                                • Instruction ID: fcefcd45a239347a059aed87d29b6566d049ee2d0ffde737cc7441d15b7e508c
                                                                                                                • Opcode Fuzzy Hash: 0dd1c51c6929227c41c63f359ca2e747dae7f1abdc37dddbf728280b24538db3
                                                                                                                • Instruction Fuzzy Hash: C1C04C046096C989E70687AA19147A07FA1DF63549B8C82F6848989217A409554F573E
                                                                                                                Function 0C407D41 Relevance: .0, Instructions: 10COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000016.00000002.4103457864.000000000C400000.00000040.00000800.00020000.00000000.sdmp, Offset: 0C400000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_22_2_c400000_FastestVPN.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: 7251a7e8734415d6ea217fef444f7b9dea2cd5ee9a397092551ad2907b7b1d8f
                                                                                                                • Instruction ID: 1bda67a4efcb7c3c51b9469d0454d55c6f6cd53007e0978154f07740b0968048
                                                                                                                • Opcode Fuzzy Hash: 7251a7e8734415d6ea217fef444f7b9dea2cd5ee9a397092551ad2907b7b1d8f
                                                                                                                • Instruction Fuzzy Hash: F3C04C1430E6D08AD74397B87814A94BFB14FEE501B49D4CFD4D1D7327C5158E068797
                                                                                                                Function 0C40F900 Relevance: .0, Instructions: 8COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000016.00000002.4103457864.000000000C400000.00000040.00000800.00020000.00000000.sdmp, Offset: 0C400000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_22_2_c400000_FastestVPN.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: a410f6c15e0f7ed46b0a98a295948b945f0474caf205e4d19cbfcce079e7dcec
                                                                                                                • Instruction ID: b865e3aac21415442db266ad7c2cede609e6a3e4a447cacfe73a021c43bcd453
                                                                                                                • Opcode Fuzzy Hash: a410f6c15e0f7ed46b0a98a295948b945f0474caf205e4d19cbfcce079e7dcec
                                                                                                                • Instruction Fuzzy Hash: DEC002202096819FDB0ADF64E5297427B61EB57304F4444C5D4558B696CA28584ADB26
                                                                                                                Function 0AA43720 Relevance: .0, Instructions: 8COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000016.00000002.4082922941.000000000AA40000.00000040.00000800.00020000.00000000.sdmp, Offset: 0AA40000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_22_2_aa40000_FastestVPN.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: c2aca6456aa62a0874644cbdacc25a8004307f04869a25f9c588995d069838b3
                                                                                                                • Instruction ID: 3c54bbc51b76afce380cda136bd353e94e0fc8c8057300a8b6b8a0e919dc5751
                                                                                                                • Opcode Fuzzy Hash: c2aca6456aa62a0874644cbdacc25a8004307f04869a25f9c588995d069838b3
                                                                                                                • Instruction Fuzzy Hash: 1FC09BD7A181405BD32941009850FBD170357B5144F9B495D516117353DD54CC0342A7
                                                                                                                Function 0C55AAA0 Relevance: .0, Instructions: 7COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000016.00000002.4104243718.000000000C550000.00000040.00000800.00020000.00000000.sdmp, Offset: 0C550000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_22_2_c550000_FastestVPN.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: 857ae4a3acd2fee78cfdc3e95830ae4ce18e30d9ef3f77e1b24f0cdd101d4816
                                                                                                                • Instruction ID: ba92ce310a87ae1834164e357c70d6e603a1c101f4af7b8209c571c8bfca7a5c
                                                                                                                • Opcode Fuzzy Hash: 857ae4a3acd2fee78cfdc3e95830ae4ce18e30d9ef3f77e1b24f0cdd101d4816
                                                                                                                • Instruction Fuzzy Hash: 3DC08C300112048BCB08E701C12F714BBE5D781230F05DC4880000A0A0C22C91188F04
                                                                                                                Function 0C407D10 Relevance: .0, Instructions: 7COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000016.00000002.4103457864.000000000C400000.00000040.00000800.00020000.00000000.sdmp, Offset: 0C400000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_22_2_c400000_FastestVPN.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: b76679b0a354449729844e828cdbdd8dc5f87ab3334555cc76ca9f307cd6f9ad
                                                                                                                • Instruction ID: a0ccf6e4bed68dc0c69f5d0bbd707ad7c253f4111acce2a0e91a8f8d8fd4bd45
                                                                                                                • Opcode Fuzzy Hash: b76679b0a354449729844e828cdbdd8dc5f87ab3334555cc76ca9f307cd6f9ad
                                                                                                                • Instruction Fuzzy Hash: 03B092351602088F82409B68E448C00B3E8AB08A243118090E10C8B232C621F8008A40
                                                                                                                Function 0C556CAA Relevance: .0, Instructions: 6COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000016.00000002.4104243718.000000000C550000.00000040.00000800.00020000.00000000.sdmp, Offset: 0C550000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_22_2_c550000_FastestVPN.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: ab612b91f0668d0b08a3e65c40ceb716cf19cb60169c9d24a1d961abab089b9d
                                                                                                                • Instruction ID: 632623a8792205c01019c9a66a5c59e350140f84136c0b6734d273ea7da29a84
                                                                                                                • Opcode Fuzzy Hash: ab612b91f0668d0b08a3e65c40ceb716cf19cb60169c9d24a1d961abab089b9d
                                                                                                                • Instruction Fuzzy Hash: 38A0240F14444CDDCF1111511F043401F41C0071003CC15C4430040307570C500D5F03

                                                                                                                Executed Functions

                                                                                                                Function 04E3A520 Relevance: 1.5, Strings: 1, Instructions: 281COMMON
                                                                                                                Download Yara Rule
                                                                                                                Strings
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 0000001D.00000002.2764619105.0000000004E30000.00000040.00000800.00020000.00000000.sdmp, Offset: 04E30000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_29_2_4e30000_powershell.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID: \Vf
                                                                                                                • API String ID: 0-3363418015
                                                                                                                • Opcode ID: 5f7fe5003f2082502bea0c9494d60f2192a8f39114edb3380b57bed242d5f142
                                                                                                                • Instruction ID: 956eb9eaba3cc3f205dd18c804b7506fde88a2009d52703bb7d22d4264600026
                                                                                                                • Opcode Fuzzy Hash: 5f7fe5003f2082502bea0c9494d60f2192a8f39114edb3380b57bed242d5f142
                                                                                                                • Instruction Fuzzy Hash: DCB16170E00209DFDB11CFA9C8897EDBBF2AF88315F149539D455A7294EB74A882CF81
                                                                                                                Function 04E3ADF0 Relevance: .3, Instructions: 266COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 0000001D.00000002.2764619105.0000000004E30000.00000040.00000800.00020000.00000000.sdmp, Offset: 04E30000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_29_2_4e30000_powershell.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: b39c4086f9373248f19d58568c5ef1a81cb5e1b896093dcfa29fe79a9996189e
                                                                                                                • Instruction ID: 12e2473cf19e203971a70d24038bb1c54968ee10fd374a29f68ce1684fa3ebe4
                                                                                                                • Opcode Fuzzy Hash: b39c4086f9373248f19d58568c5ef1a81cb5e1b896093dcfa29fe79a9996189e
                                                                                                                • Instruction Fuzzy Hash: F2B16F70E00209CFDF11CFA9C8897ADBBF2AF88715F149539E455EB254EB74A885CB81
                                                                                                                Function 04E36A28 Relevance: 6.8, Strings: 5, Instructions: 520COMMON
                                                                                                                Download Yara Rule
                                                                                                                Strings
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 0000001D.00000002.2764619105.0000000004E30000.00000040.00000800.00020000.00000000.sdmp, Offset: 04E30000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_29_2_4e30000_powershell.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID: 8Nf$h]f$h]f$h]f$If
                                                                                                                • API String ID: 0-353951402
                                                                                                                • Opcode ID: 464772133024176c00894c1dca451e4f121da7a65f0b73f03ddc0cf0d61131b0
                                                                                                                • Instruction ID: c926bbd592c059ad793c9834df9ebe0dd0bb0d8c51db61e379eae12f4f84e967
                                                                                                                • Opcode Fuzzy Hash: 464772133024176c00894c1dca451e4f121da7a65f0b73f03ddc0cf0d61131b0
                                                                                                                • Instruction Fuzzy Hash: 9E227274B00218CFDB25DB34C858AAEBBB6BF89305F1481A9D509AB351DF35AD85CF81
                                                                                                                Function 04E3AB68 Relevance: 2.7, Strings: 2, Instructions: 180COMMON
                                                                                                                Download Yara Rule
                                                                                                                Strings
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 0000001D.00000002.2764619105.0000000004E30000.00000040.00000800.00020000.00000000.sdmp, Offset: 04E30000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_29_2_4e30000_powershell.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID: \Vf$\Vf
                                                                                                                • API String ID: 0-1775512948
                                                                                                                • Opcode ID: 0de731f9cdd519aed990535131bf39db23a1b13b1cd328bdef9eb8f469a1f540
                                                                                                                • Instruction ID: fac4fbadd55662c18bb86edc93eaf53ccf4582d7c21114ef40dcda53d4f87b85
                                                                                                                • Opcode Fuzzy Hash: 0de731f9cdd519aed990535131bf39db23a1b13b1cd328bdef9eb8f469a1f540
                                                                                                                • Instruction Fuzzy Hash: 80717C70E002099FDF15CFA9C8897EEBBF2BF88719F148129D455A7254EB74A881CF81
                                                                                                                Function 04E3AB5C Relevance: 2.7, Strings: 2, Instructions: 180COMMON
                                                                                                                Download Yara Rule
                                                                                                                Strings
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 0000001D.00000002.2764619105.0000000004E30000.00000040.00000800.00020000.00000000.sdmp, Offset: 04E30000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_29_2_4e30000_powershell.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID: \Vf$\Vf
                                                                                                                • API String ID: 0-1775512948
                                                                                                                • Opcode ID: 6d15587c7a099847ad1167e77f339892e7714b38ce7ea1eca2c48862028de379
                                                                                                                • Instruction ID: 587b033716035bdcc7b9cbe290b84190c2778a4d278db53c72db7329eea8b852
                                                                                                                • Opcode Fuzzy Hash: 6d15587c7a099847ad1167e77f339892e7714b38ce7ea1eca2c48862028de379
                                                                                                                • Instruction Fuzzy Hash: CC717C70E002499FDF15CFA8C8897EEBBF1BF88719F148129D454AB254EB74A881CF81
                                                                                                                Function 04E376E0 Relevance: 2.6, Strings: 2, Instructions: 92COMMON
                                                                                                                Download Yara Rule
                                                                                                                Strings
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 0000001D.00000002.2764619105.0000000004E30000.00000040.00000800.00020000.00000000.sdmp, Offset: 04E30000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_29_2_4e30000_powershell.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID: h]f$If
                                                                                                                • API String ID: 0-404981628
                                                                                                                • Opcode ID: 6149e18d2b3ebd9868a0ce7f3799736c059ae5bd467d4468d5e8c63e131ccb40
                                                                                                                • Instruction ID: 398d5ba92ec11c842afa14159dbb0a315d708531fdf6125fab19ac55f6565847
                                                                                                                • Opcode Fuzzy Hash: 6149e18d2b3ebd9868a0ce7f3799736c059ae5bd467d4468d5e8c63e131ccb40
                                                                                                                • Instruction Fuzzy Hash: 90313230B01118CFCB26DB64C8546EEB7B6BF89309F1484E9C509AB351DB319E81CF91
                                                                                                                Function 04E3A516 Relevance: 1.5, Strings: 1, Instructions: 278COMMON
                                                                                                                Download Yara Rule
                                                                                                                Strings
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 0000001D.00000002.2764619105.0000000004E30000.00000040.00000800.00020000.00000000.sdmp, Offset: 04E30000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_29_2_4e30000_powershell.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID: \Vf
                                                                                                                • API String ID: 0-3363418015
                                                                                                                • Opcode ID: 8ca3a5380af21636eb8d085bffab06ca67d5f76442b99988695c499065681712
                                                                                                                • Instruction ID: 2aa43b73d8c5a7d01100da6278133bf749538c512d0f62e9a499f1857e73bff2
                                                                                                                • Opcode Fuzzy Hash: 8ca3a5380af21636eb8d085bffab06ca67d5f76442b99988695c499065681712
                                                                                                                • Instruction Fuzzy Hash: 03B16E70E00209DFDB11CFA9C8897EDBBF1AF88319F149539D455A7294EB74A886CF81
                                                                                                                Function 04E3ADE4 Relevance: .3, Instructions: 261COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 0000001D.00000002.2764619105.0000000004E30000.00000040.00000800.00020000.00000000.sdmp, Offset: 04E30000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_29_2_4e30000_powershell.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: 767ea449ec71c241198b5bce99d53989df4dee3c44fa4c5f1035cf7b2a0e55f2
                                                                                                                • Instruction ID: b018e6d5706281f1b229632ec6e5d8a7d6f90e09af7a4fcc26f4fed6d0848598
                                                                                                                • Opcode Fuzzy Hash: 767ea449ec71c241198b5bce99d53989df4dee3c44fa4c5f1035cf7b2a0e55f2
                                                                                                                • Instruction Fuzzy Hash: 4EB15D70E00209CFDF11CFA9C8897ADBBF1AF48715F149629E455EB294EB74A885CF81
                                                                                                                Function 04E329F0 Relevance: .2, Instructions: 207COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 0000001D.00000002.2764619105.0000000004E30000.00000040.00000800.00020000.00000000.sdmp, Offset: 04E30000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_29_2_4e30000_powershell.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: d0eff433d9fff2b5e5a0e0b7ba30436af39310185401905cbf8c41c9ace6bac7
                                                                                                                • Instruction ID: 5a3131ba13d28b7b7842da72324528ebb901e27ffd97291f6a11292884f3f694
                                                                                                                • Opcode Fuzzy Hash: d0eff433d9fff2b5e5a0e0b7ba30436af39310185401905cbf8c41c9ace6bac7
                                                                                                                • Instruction Fuzzy Hash: BE918E74A00205CFCB16CF59C598AAEFBB1FF48310B2486A9DA55AB365C735FC51CB90
                                                                                                                Function 04E32B00 Relevance: .1, Instructions: 106COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 0000001D.00000002.2764619105.0000000004E30000.00000040.00000800.00020000.00000000.sdmp, Offset: 04E30000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_29_2_4e30000_powershell.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: 86d4fd6e49aaa372eee4468f122112b756e0286516e3edeb613ff7ed43e6cb7a
                                                                                                                • Instruction ID: 0321eb3ba65479ea9d2b4b46e1120bea2dbf90094bce84f6d91c3f3aea59d0f5
                                                                                                                • Opcode Fuzzy Hash: 86d4fd6e49aaa372eee4468f122112b756e0286516e3edeb613ff7ed43e6cb7a
                                                                                                                • Instruction Fuzzy Hash: 49413A74A00505CFCB06CF59C5989AEFBB1FF48314B2586A9DA55AB364C732FC51CB90
                                                                                                                Function 04E3A80B Relevance: .0, Instructions: 49COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 0000001D.00000002.2764619105.0000000004E30000.00000040.00000800.00020000.00000000.sdmp, Offset: 04E30000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_29_2_4e30000_powershell.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: bb8925f0744f0eea88575c1a64a44ef5409e30972a08b5f7fdd57c8dd8801454
                                                                                                                • Instruction ID: 150881222088ea0d52d08204c1fdd0b9ded72cb5c66f7dda1945b6af3a8b410c
                                                                                                                • Opcode Fuzzy Hash: bb8925f0744f0eea88575c1a64a44ef5409e30972a08b5f7fdd57c8dd8801454
                                                                                                                • Instruction Fuzzy Hash: 1111A270D01158DBEF269B98D99C7ECB7B2AF4531FF142439C081B6190EB7468CACB11
                                                                                                                Function 0494D01D Relevance: .0, Instructions: 45COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 0000001D.00000002.2764134617.000000000494D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0494D000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_29_2_494d000_powershell.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: 7750183fab180a22a6c97270bcc5ce0e16d0a53c1d2cd419a1d767bb50a987ac
                                                                                                                • Instruction ID: a82d24fad8a83d47559d2281f12fc08056a2f86b0462e435b6837ad3ddefb532
                                                                                                                • Opcode Fuzzy Hash: 7750183fab180a22a6c97270bcc5ce0e16d0a53c1d2cd419a1d767bb50a987ac
                                                                                                                • Instruction Fuzzy Hash: 4D01F2755053409AE7208E25E984F66BF9CDF81324F08CA2AED084B242C6B9A942CAB1
                                                                                                                Function 0494D005 Relevance: .0, Instructions: 45COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 0000001D.00000002.2764134617.000000000494D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0494D000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_29_2_494d000_powershell.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: af61b61207e30694ca5f151ed8a41feff832d91be08fd2fc90e579c2abbb2dfd
                                                                                                                • Instruction ID: ca06847af0c5439ff5346d72bb75d1df39ac750e0fbdcac4f0a6cde42fe67420
                                                                                                                • Opcode Fuzzy Hash: af61b61207e30694ca5f151ed8a41feff832d91be08fd2fc90e579c2abbb2dfd
                                                                                                                • Instruction Fuzzy Hash: 1401757140E3C05FE7128B25DD84B52BFA8DF83224F1985EBE9888F193C2695C45C771

                                                                                                                Execution Graph

                                                                                                                Execution Coverage:1.2%
                                                                                                                Dynamic/Decrypted Code Coverage:0%
                                                                                                                Signature Coverage:2.9%
                                                                                                                Total number of Nodes:2000
                                                                                                                Total number of Limit Nodes:28
                                                                                                                execution_graph 15571 100134a0 15583 10013240 15571->15583 15573 100134b2 OpenSCManagerA 15574 100134ca OpenServiceA 15573->15574 15575 1001350f GetLastError 15573->15575 15576 100134dd DeleteService GetLastError CloseServiceHandle CloseServiceHandle 15574->15576 15577 100134fe GetLastError CloseServiceHandle 15574->15577 15578 10013517 SetLastError 15575->15578 15576->15578 15577->15578 15613 10012d70 RegOpenKeyExA 15578->15613 15580 10013525 15618 10012d00 RegOpenKeyExA 15580->15618 15582 1001352c 15621 10012f40 15583->15621 15585 10013266 15611 1001348c 15585->15611 15633 10012e20 RegOpenKeyExA 15585->15633 15587 10013281 15590 1001329f 15587->15590 15591 1001330e 15587->15591 15587->15611 15588 100132bc 15588->15611 15653 10007b2f 15588->15653 15589 10013341 15594 10012f40 105 API calls 15589->15594 15590->15588 15649 10008360 15590->15649 15591->15589 15592 10012f40 105 API calls 15591->15592 15592->15589 15596 1001336f 15594->15596 15595 10013303 15595->15573 15598 10012f40 105 API calls 15596->15598 15603 10013386 15596->15603 15598->15603 15600 100133f5 15605 10008360 ___BuildCatchObjectHelper __VEC_memcpy 15600->15605 15612 100133ea 15600->15612 15601 10012e20 74 API calls 15601->15588 15602 1001342b RegOpenKeyExA 15604 10013482 15602->15604 15606 10013448 RegSetValueExA RegCloseKey 15602->15606 15603->15600 15607 100133b9 15603->15607 15609 10007b2f ___crtGetEnvironmentStringsA 66 API calls 15604->15609 15604->15611 15605->15612 15606->15604 15607->15602 15607->15604 15610 10008360 ___BuildCatchObjectHelper __VEC_memcpy 15607->15610 15609->15611 15610->15612 15611->15573 15612->15602 15614 10012d90 15613->15614 15615 10012d96 RegQueryValueExA 15613->15615 15614->15580 15616 10012dc3 RegSetValueExA RegCloseKey 15615->15616 15616->15580 15619 10012d25 RegSetValueExA RegCloseKey 15618->15619 15620 10012d1f 15618->15620 15619->15582 15620->15582 15666 10008877 15621->15666 15624 10012f93 15681 10007ccf 15624->15681 15625 10012fab 15627 10012fb5 RegQueryValueExA 15625->15627 15628 10012fdc RegSetValueExA 15625->15628 15630 10012ff3 RegCloseKey 15627->15630 15628->15630 15629 10012fa4 15629->15585 15631 10007ccf __ehhandler$?_StructuredChoreWrapper@_UnrealizedChore@details@Concurrency@@CAXPAV123@@Z 5 API calls 15630->15631 15632 10013016 15631->15632 15632->15585 15634 10012e43 15633->15634 15635 10012e4a 15633->15635 15634->15587 15636 10012e56 RegQueryValueExA 15635->15636 15637 10012eef RegSetValueExA 15635->15637 15638 10012e76 RegCloseKey 15636->15638 15639 10012e89 15636->15639 15642 10012f20 RegCloseKey 15637->15642 15638->15587 16392 10007c0c 15639->16392 15642->15587 15643 10012e94 15644 10012eb0 RegQueryValueExA 15643->15644 15645 10012e9d RegCloseKey 15643->15645 15644->15642 15646 10012ecb RegCloseKey 15644->15646 15645->15587 15647 10007b2f ___crtGetEnvironmentStringsA 66 API calls 15646->15647 15648 10012ede 15647->15648 15648->15587 15650 10008378 15649->15650 15651 1000839f __VEC_memcpy 15650->15651 15652 100083a7 15650->15652 15651->15652 15652->15601 15654 10007b3b ___BuildCatchObjectHelper 15653->15654 15655 10007b7a 15654->15655 15656 10007bb4 __dosmaperr ___BuildCatchObjectHelper 15654->15656 15658 10009513 __lock 64 API calls 15654->15658 15655->15656 15657 10007b8f HeapFree 15655->15657 15656->15595 15657->15656 15659 10007ba1 15657->15659 15662 10007b52 ___sbh_find_block 15658->15662 15660 10009230 __wctomb_s_l 64 API calls 15659->15660 15661 10007ba6 GetLastError 15660->15661 15661->15656 15663 10007b6c 15662->15663 16422 100095b7 15662->16422 16429 10007b85 15663->16429 15667 100088a2 15666->15667 15668 10008885 15666->15668 15670 100088ce 15667->15670 15672 100088b1 15667->15672 15689 10009230 15668->15689 15695 1000bd21 15670->15695 15675 10009230 __wctomb_s_l 66 API calls 15672->15675 15676 100088b6 15675->15676 15679 100082eb __wctomb_s_l 66 API calls 15676->15679 15677 100088fc 15678 1000889a RegOpenKeyExA 15677->15678 15739 1000ba9e 15677->15739 15678->15624 15678->15625 15679->15678 15682 10007cd7 15681->15682 15683 10007cd9 IsDebuggerPresent 15681->15683 15682->15629 16391 1000b918 15683->16391 15686 1000a802 SetUnhandledExceptionFilter UnhandledExceptionFilter 15687 1000a827 GetCurrentProcess TerminateProcess 15686->15687 15688 1000a81f __invoke_watson 15686->15688 15687->15629 15688->15687 15760 1000aaf7 GetLastError 15689->15760 15691 1000888a 15692 100082eb 15691->15692 15693 1000a91e __mtterm 66 API calls 15692->15693 15694 100082f9 __invoke_watson 15693->15694 15981 1000bbfe 15695->15981 15698 1000bd81 15699 10009230 __wctomb_s_l 66 API calls 15698->15699 15729 1000bd86 15699->15729 15701 1000bdc1 15703 1000bdef 15701->15703 15705 100106d0 __flsbuf 66 API calls 15701->15705 15702 100082eb __wctomb_s_l 66 API calls 15704 1000bd96 15702->15704 15703->15698 15708 100106d0 __flsbuf 66 API calls 15703->15708 15707 10007ccf __ehhandler$?_StructuredChoreWrapper@_UnrealizedChore@details@Concurrency@@CAXPAV123@@Z 5 API calls 15704->15707 15706 1000bdcf 15705->15706 15706->15703 15710 100106d0 __flsbuf 66 API calls 15706->15710 15709 1000c68d 15707->15709 15711 1000be14 15708->15711 15709->15677 15712 1000bddd 15710->15712 15715 100106d0 __flsbuf 66 API calls 15711->15715 15728 1000be42 15711->15728 15714 100106d0 __flsbuf 66 API calls 15712->15714 15714->15703 15717 1000be22 15715->15717 15716 1000be67 __aulldvrm __woutput_l _strlen 15716->15704 15718 1000bc80 99 API calls _write_multi_char 15716->15718 15720 1000c0d7 15716->15720 15721 1000c656 15716->15721 15724 10007b2f ___crtGetEnvironmentStringsA 66 API calls 15716->15724 15727 1000bcb3 99 API calls _write_multi_char 15716->15727 15735 10010872 77 API calls _wctomb_s 15716->15735 15738 1000bcd7 99 API calls _write_string 15716->15738 15996 1001088d 15716->15996 15719 100106d0 __flsbuf 66 API calls 15717->15719 15717->15728 15718->15716 15722 1000be30 15719->15722 15723 1000c0ff 15720->15723 15731 1000b155 __malloc_crt 66 API calls 15720->15731 15726 10009230 __wctomb_s_l 66 API calls 15721->15726 15725 100106d0 __flsbuf 66 API calls 15722->15725 15730 1000a91e __mtterm 66 API calls 15723->15730 15724->15716 15725->15728 15726->15729 15727->15716 15728->15698 15728->15716 15729->15702 15733 1000c346 15730->15733 15731->15723 15732 1000c36c 15734 1000c38b 15732->15734 15737 1000a91e __mtterm 66 API calls 15732->15737 15733->15732 15736 1000a91e __mtterm 66 API calls 15733->15736 15734->15677 15735->15716 15736->15732 15737->15734 15738->15716 15740 100106d0 __flsbuf 66 API calls 15739->15740 15741 1000baac 15740->15741 15742 1000bab7 15741->15742 15743 1000bace 15741->15743 15744 10009230 __wctomb_s_l 66 API calls 15742->15744 15745 1000bad2 15743->15745 15754 1000badf __flsbuf 15743->15754 15753 1000babc 15744->15753 15746 10009230 __wctomb_s_l 66 API calls 15745->15746 15746->15753 15747 1000bbcd 15751 100103b1 __locking 99 API calls 15747->15751 15748 1000bb4d 15749 1000bb81 15748->15749 15750 1000bb64 15748->15750 15749->15753 16243 1000fc76 15749->16243 16218 100103b1 15750->16218 15751->15753 15753->15678 15754->15753 15756 1000bb34 15754->15756 15759 1000bb3f 15754->15759 16205 100104d1 15754->16205 15756->15759 16215 1001048d 15756->16215 15759->15747 15759->15748 15774 1000a9b0 TlsGetValue 15760->15774 15763 1000ab62 SetLastError 15763->15691 15768 1000ab41 15794 1000aa38 15768->15794 15769 1000ab59 15771 10007b2f ___crtGetEnvironmentStringsA 63 API calls 15769->15771 15773 1000ab5f 15771->15773 15772 1000ab49 GetCurrentThreadId 15772->15763 15773->15763 15775 1000a9c3 15774->15775 15776 1000a9de 15774->15776 15777 1000a91e __mtterm 64 API calls 15775->15777 15776->15763 15779 1000b195 15776->15779 15778 1000a9ce TlsSetValue 15777->15778 15778->15776 15781 1000b199 15779->15781 15782 1000ab20 15781->15782 15783 1000b1b9 Sleep 15781->15783 15808 1000f6fc 15781->15808 15782->15763 15784 1000a91e TlsGetValue 15782->15784 15783->15781 15785 1000a931 15784->15785 15786 1000a952 GetModuleHandleA 15784->15786 15785->15786 15789 1000a93b TlsGetValue 15785->15789 15787 1000a963 15786->15787 15788 1000a94a 15786->15788 15952 1000a83b 15787->15952 15788->15768 15788->15769 15792 1000a946 15789->15792 15791 1000a968 15791->15788 15793 1000a96c GetProcAddress 15791->15793 15792->15786 15792->15788 15793->15788 15964 1000a044 15794->15964 15796 1000aa44 GetModuleHandleA 15797 1000aa95 15796->15797 15798 1000aa66 15796->15798 15802 10009513 __lock 63 API calls 15797->15802 15799 1000a83b __initp_misc_cfltcvt_tab 63 API calls 15798->15799 15800 1000aa6b 15799->15800 15800->15797 15801 1000aa6f GetProcAddress GetProcAddress 15800->15801 15801->15797 15803 1000aabc 15802->15803 15965 1000ee79 InterlockedIncrement 15803->15965 15805 1000aadb 15977 1000aaee 15805->15977 15807 1000aae8 ___BuildCatchObjectHelper 15807->15772 15809 1000f708 ___BuildCatchObjectHelper 15808->15809 15810 1000f720 15809->15810 15820 1000f73f _memset 15809->15820 15811 10009230 __wctomb_s_l 65 API calls 15810->15811 15812 1000f725 15811->15812 15813 100082eb __wctomb_s_l 65 API calls 15812->15813 15817 1000f735 ___BuildCatchObjectHelper 15813->15817 15814 1000f7b1 HeapAlloc 15814->15820 15817->15781 15820->15814 15820->15817 15821 10009513 15820->15821 15828 10009d60 15820->15828 15834 1000f7f8 15820->15834 15837 1000a715 15820->15837 15822 10009526 15821->15822 15823 10009539 EnterCriticalSection 15821->15823 15840 10009450 15822->15840 15823->15820 15825 1000952c 15825->15823 15866 1000a236 15825->15866 15830 10009d8c 15828->15830 15829 10009e25 15832 10009e2e 15829->15832 15947 1000997b 15829->15947 15830->15829 15830->15832 15940 100098cb 15830->15940 15832->15820 15951 1000943b LeaveCriticalSection 15834->15951 15836 1000f7ff 15836->15820 15838 1000a91e __mtterm 66 API calls 15837->15838 15839 1000a720 15838->15839 15839->15820 15841 1000945c ___BuildCatchObjectHelper 15840->15841 15842 10009482 15841->15842 15873 1000a6d2 15841->15873 15848 10009492 ___BuildCatchObjectHelper 15842->15848 15919 1000b155 15842->15919 15848->15825 15850 100094b3 15854 10009513 __lock 66 API calls 15850->15854 15851 100094a4 15853 10009230 __wctomb_s_l 66 API calls 15851->15853 15853->15848 15855 100094ba 15854->15855 15856 100094c2 15855->15856 15857 100094ee 15855->15857 15924 1000e5c6 15856->15924 15859 10007b2f ___crtGetEnvironmentStringsA 66 API calls 15857->15859 15861 100094df 15859->15861 15860 100094cd 15860->15861 15862 10007b2f ___crtGetEnvironmentStringsA 66 API calls 15860->15862 15937 1000950a 15861->15937 15864 100094d9 15862->15864 15865 10009230 __wctomb_s_l 66 API calls 15864->15865 15865->15861 15867 1000a6d2 __FF_MSGBANNER 66 API calls 15866->15867 15868 1000a23b 15867->15868 15869 1000a532 _abort 66 API calls 15868->15869 15870 1000a244 15869->15870 15871 1000a91e __mtterm 66 API calls 15870->15871 15872 10009538 15871->15872 15872->15823 15874 1000ecf3 __FF_MSGBANNER 66 API calls 15873->15874 15875 1000a6d9 15874->15875 15876 1000ecf3 __FF_MSGBANNER 66 API calls 15875->15876 15878 1000a6e6 15875->15878 15876->15878 15877 1000a532 _abort 66 API calls 15879 1000a6fe 15877->15879 15878->15877 15880 10009471 15878->15880 15881 1000a532 _abort 66 API calls 15879->15881 15882 1000a532 15880->15882 15881->15880 15883 1000a53e 15882->15883 15884 1000ecf3 __FF_MSGBANNER 63 API calls 15883->15884 15915 10009478 15883->15915 15885 1000a55e 15884->15885 15886 1000a699 GetStdHandle 15885->15886 15888 1000ecf3 __FF_MSGBANNER 63 API calls 15885->15888 15887 1000a6a7 _strlen 15886->15887 15886->15915 15891 1000a6c1 WriteFile 15887->15891 15887->15915 15889 1000a56f 15888->15889 15889->15886 15890 1000a581 15889->15890 15892 1000b7b8 _strcpy_s 63 API calls 15890->15892 15890->15915 15891->15915 15893 1000a5a3 15892->15893 15894 1000a5b7 GetModuleFileNameA 15893->15894 15895 100081ef __invoke_watson 10 API calls 15893->15895 15896 1000a5d5 15894->15896 15901 1000a5f8 _strlen 15894->15901 15897 1000a5b4 15895->15897 15898 1000b7b8 _strcpy_s 63 API calls 15896->15898 15897->15894 15899 1000a5e5 15898->15899 15899->15901 15902 100081ef __invoke_watson 10 API calls 15899->15902 15900 1000a63b 15903 1000ebcf _strcat_s 63 API calls 15900->15903 15901->15900 15905 1000ec40 __crtLCMapStringW_stat 63 API calls 15901->15905 15902->15901 15904 1000a64e 15903->15904 15907 1000a65f 15904->15907 15908 100081ef __invoke_watson 10 API calls 15904->15908 15906 1000a628 15905->15906 15906->15900 15910 100081ef __invoke_watson 10 API calls 15906->15910 15909 1000ebcf _strcat_s 63 API calls 15907->15909 15908->15907 15912 1000a670 15909->15912 15910->15900 15911 1000a681 15913 1000ea12 _abort 63 API calls 15911->15913 15912->15911 15914 100081ef __invoke_watson 10 API calls 15912->15914 15913->15915 15914->15911 15916 1000a280 15915->15916 15917 1000a25a ___crtCorExitProcess GetModuleHandleA GetProcAddress 15916->15917 15918 1000a289 ExitProcess 15917->15918 15923 1000b159 15919->15923 15920 10007c0c _malloc 65 API calls 15920->15923 15921 1000949d 15921->15850 15921->15851 15922 1000b171 Sleep 15922->15923 15923->15920 15923->15921 15923->15922 15925 1000e5d2 ___BuildCatchObjectHelper 15924->15925 15926 1000a91e __mtterm 64 API calls 15925->15926 15927 1000e5e2 15926->15927 15928 1000a2df ___crtInitCritSecAndSpinCount 64 API calls 15927->15928 15931 1000e636 ___BuildCatchObjectHelper 15927->15931 15929 1000e5f2 15928->15929 15930 1000e601 15929->15930 15932 100081ef __invoke_watson 10 API calls 15929->15932 15933 1000e60a GetModuleHandleA 15930->15933 15934 1000e62b 15930->15934 15931->15860 15932->15930 15933->15934 15935 1000e619 GetProcAddress 15933->15935 15936 1000a8a7 __initp_misc_cfltcvt_tab 64 API calls 15934->15936 15935->15934 15936->15931 15938 1000943b _flsall LeaveCriticalSection 15937->15938 15939 10009511 15938->15939 15939->15848 15941 10009912 HeapAlloc 15940->15941 15942 100098de HeapReAlloc 15940->15942 15944 100098fc 15941->15944 15945 10009935 VirtualAlloc 15941->15945 15943 10009900 15942->15943 15942->15944 15943->15941 15944->15829 15945->15944 15946 1000994f HeapFree 15945->15946 15946->15944 15948 10009990 VirtualAlloc 15947->15948 15950 100099d7 15948->15950 15950->15832 15951->15836 15957 1000a316 15952->15957 15954 1000a856 15955 1000a861 GetModuleHandleA 15954->15955 15956 1000a85d type_info::operator== 15954->15956 15955->15956 15956->15791 15958 1000a321 15957->15958 15959 1000a346 15958->15959 15960 10009230 __wctomb_s_l 66 API calls 15958->15960 15959->15954 15961 1000a326 15960->15961 15962 100082eb __wctomb_s_l 66 API calls 15961->15962 15963 1000a336 15962->15963 15963->15954 15964->15796 15966 1000ee94 InterlockedIncrement 15965->15966 15967 1000ee97 15965->15967 15966->15967 15968 1000eea1 InterlockedIncrement 15967->15968 15969 1000eea4 15967->15969 15968->15969 15970 1000eeb1 15969->15970 15971 1000eeae InterlockedIncrement 15969->15971 15972 1000eebb InterlockedIncrement 15970->15972 15974 1000eebe 15970->15974 15971->15970 15972->15974 15973 1000eed3 InterlockedIncrement 15973->15974 15974->15973 15975 1000eee3 InterlockedIncrement 15974->15975 15976 1000eeec InterlockedIncrement 15974->15976 15975->15974 15976->15805 15980 1000943b LeaveCriticalSection 15977->15980 15979 1000aaf5 15979->15807 15980->15979 15982 1000bc0d 15981->15982 15986 1000bc5a 15981->15986 15999 1000ab6e 15982->15999 15985 1000bc3a 15985->15986 16019 1000f24d 15985->16019 15986->15698 15986->15728 15989 100106d0 15986->15989 15990 100106f8 15989->15990 15991 100106db 15989->15991 15990->15701 15992 10009230 __wctomb_s_l 66 API calls 15991->15992 15993 100106e0 15992->15993 15994 100082eb __wctomb_s_l 66 API calls 15993->15994 15995 100106f0 15994->15995 15995->15701 15997 1000bbfe _LocaleUpdate::_LocaleUpdate 75 API calls 15996->15997 15998 1001089e 15997->15998 15998->15716 16000 1000aaf7 _raise 66 API calls 15999->16000 16001 1000ab74 16000->16001 16002 1000ab81 16001->16002 16003 1000a236 __amsg_exit 66 API calls 16001->16003 16002->15985 16004 1000efc9 16002->16004 16003->16002 16005 1000efd5 ___BuildCatchObjectHelper 16004->16005 16006 1000ab6e FindHandler 66 API calls 16005->16006 16007 1000efda 16006->16007 16008 1000f008 16007->16008 16009 1000efec 16007->16009 16010 10009513 __lock 66 API calls 16008->16010 16012 1000ab6e FindHandler 66 API calls 16009->16012 16011 1000f00f 16010->16011 16033 1000ef8b 16011->16033 16014 1000eff1 16012->16014 16017 1000a236 __amsg_exit 66 API calls 16014->16017 16018 1000efff ___BuildCatchObjectHelper 16014->16018 16017->16018 16018->15985 16020 1000f259 ___BuildCatchObjectHelper 16019->16020 16021 1000ab6e FindHandler 66 API calls 16020->16021 16022 1000f25e 16021->16022 16023 10009513 __lock 66 API calls 16022->16023 16030 1000f270 16022->16030 16024 1000f28e 16023->16024 16025 1000f2a5 InterlockedDecrement 16024->16025 16032 1000f2be 16024->16032 16028 1000f2b0 16025->16028 16025->16032 16026 1000a236 __amsg_exit 66 API calls 16029 1000f27e ___BuildCatchObjectHelper 16026->16029 16031 10007b2f ___crtGetEnvironmentStringsA 66 API calls 16028->16031 16028->16032 16029->15986 16030->16026 16030->16029 16031->16032 16201 1000f2e8 16032->16201 16034 1000ef8f 16033->16034 16040 1000efc1 16033->16040 16035 1000ee79 ___addlocaleref 8 API calls 16034->16035 16034->16040 16036 1000efa2 16035->16036 16036->16040 16044 1000eeff 16036->16044 16041 1000f033 16040->16041 16200 1000943b LeaveCriticalSection 16041->16200 16043 1000f03a 16043->16014 16045 1000ef87 16044->16045 16046 1000ef08 InterlockedDecrement 16044->16046 16045->16040 16058 1000ed39 16045->16058 16047 1000ef21 16046->16047 16048 1000ef1e InterlockedDecrement 16046->16048 16049 1000ef2b InterlockedDecrement 16047->16049 16050 1000ef2e 16047->16050 16048->16047 16049->16050 16051 1000ef38 InterlockedDecrement 16050->16051 16052 1000ef3b 16050->16052 16051->16052 16053 1000ef45 InterlockedDecrement 16052->16053 16054 1000ef48 16052->16054 16053->16054 16055 1000ef5d InterlockedDecrement 16054->16055 16056 1000ef6d InterlockedDecrement 16054->16056 16057 1000ef76 InterlockedDecrement 16054->16057 16055->16054 16056->16054 16057->16045 16059 1000edba 16058->16059 16062 1000ed4d 16058->16062 16060 10007b2f ___crtGetEnvironmentStringsA 66 API calls 16059->16060 16061 1000ee07 16059->16061 16063 1000eddb 16060->16063 16073 1000ee2e 16061->16073 16112 10010e30 16061->16112 16062->16059 16069 10007b2f ___crtGetEnvironmentStringsA 66 API calls 16062->16069 16084 1000ed81 16062->16084 16065 10007b2f ___crtGetEnvironmentStringsA 66 API calls 16063->16065 16070 1000edee 16065->16070 16067 1000ee6d 16072 10007b2f ___crtGetEnvironmentStringsA 66 API calls 16067->16072 16068 10007b2f ___crtGetEnvironmentStringsA 66 API calls 16068->16073 16074 1000ed76 16069->16074 16075 10007b2f ___crtGetEnvironmentStringsA 66 API calls 16070->16075 16071 10007b2f ___crtGetEnvironmentStringsA 66 API calls 16077 1000edaf 16071->16077 16078 1000ee73 16072->16078 16073->16067 16082 10007b2f 66 API calls ___crtGetEnvironmentStringsA 16073->16082 16088 10011000 16074->16088 16080 1000edfc 16075->16080 16076 10007b2f ___crtGetEnvironmentStringsA 66 API calls 16081 1000ed97 16076->16081 16083 10007b2f ___crtGetEnvironmentStringsA 66 API calls 16077->16083 16078->16040 16085 10007b2f ___crtGetEnvironmentStringsA 66 API calls 16080->16085 16104 10010fc0 16081->16104 16082->16073 16083->16059 16084->16076 16087 1000eda2 16084->16087 16085->16061 16087->16071 16089 10011086 16088->16089 16090 10011009 16088->16090 16089->16084 16091 1001101a 16090->16091 16092 10007b2f ___crtGetEnvironmentStringsA 66 API calls 16090->16092 16093 1001102c 16091->16093 16094 10007b2f ___crtGetEnvironmentStringsA 66 API calls 16091->16094 16092->16091 16095 1001103e 16093->16095 16096 10007b2f ___crtGetEnvironmentStringsA 66 API calls 16093->16096 16094->16093 16097 10011050 16095->16097 16098 10007b2f ___crtGetEnvironmentStringsA 66 API calls 16095->16098 16096->16095 16099 10011062 16097->16099 16100 10007b2f ___crtGetEnvironmentStringsA 66 API calls 16097->16100 16098->16097 16101 10011074 16099->16101 16102 10007b2f ___crtGetEnvironmentStringsA 66 API calls 16099->16102 16100->16099 16101->16089 16103 10007b2f ___crtGetEnvironmentStringsA 66 API calls 16101->16103 16102->16101 16103->16089 16105 10010fc9 16104->16105 16111 10010ffd 16104->16111 16106 10010fd9 16105->16106 16107 10007b2f ___crtGetEnvironmentStringsA 66 API calls 16105->16107 16108 10010feb 16106->16108 16109 10007b2f ___crtGetEnvironmentStringsA 66 API calls 16106->16109 16107->16106 16110 10007b2f ___crtGetEnvironmentStringsA 66 API calls 16108->16110 16108->16111 16109->16108 16110->16111 16111->16087 16113 10010e3d 16112->16113 16199 1000ee27 16112->16199 16114 10007b2f ___crtGetEnvironmentStringsA 66 API calls 16113->16114 16115 10010e45 16114->16115 16116 10007b2f ___crtGetEnvironmentStringsA 66 API calls 16115->16116 16117 10010e4d 16116->16117 16118 10007b2f ___crtGetEnvironmentStringsA 66 API calls 16117->16118 16119 10010e55 16118->16119 16120 10007b2f ___crtGetEnvironmentStringsA 66 API calls 16119->16120 16121 10010e5d 16120->16121 16122 10007b2f ___crtGetEnvironmentStringsA 66 API calls 16121->16122 16123 10010e65 16122->16123 16124 10007b2f ___crtGetEnvironmentStringsA 66 API calls 16123->16124 16125 10010e6d 16124->16125 16126 10007b2f ___crtGetEnvironmentStringsA 66 API calls 16125->16126 16127 10010e74 16126->16127 16128 10007b2f ___crtGetEnvironmentStringsA 66 API calls 16127->16128 16129 10010e7c 16128->16129 16130 10007b2f ___crtGetEnvironmentStringsA 66 API calls 16129->16130 16131 10010e84 16130->16131 16132 10007b2f ___crtGetEnvironmentStringsA 66 API calls 16131->16132 16133 10010e8c 16132->16133 16134 10007b2f ___crtGetEnvironmentStringsA 66 API calls 16133->16134 16135 10010e94 16134->16135 16136 10007b2f ___crtGetEnvironmentStringsA 66 API calls 16135->16136 16137 10010e9c 16136->16137 16138 10007b2f ___crtGetEnvironmentStringsA 66 API calls 16137->16138 16139 10010ea4 16138->16139 16140 10007b2f ___crtGetEnvironmentStringsA 66 API calls 16139->16140 16141 10010eac 16140->16141 16142 10007b2f ___crtGetEnvironmentStringsA 66 API calls 16141->16142 16143 10010eb4 16142->16143 16144 10007b2f ___crtGetEnvironmentStringsA 66 API calls 16143->16144 16145 10010ebc 16144->16145 16146 10007b2f ___crtGetEnvironmentStringsA 66 API calls 16145->16146 16147 10010ec7 16146->16147 16148 10007b2f ___crtGetEnvironmentStringsA 66 API calls 16147->16148 16149 10010ecf 16148->16149 16150 10007b2f ___crtGetEnvironmentStringsA 66 API calls 16149->16150 16151 10010ed7 16150->16151 16152 10007b2f ___crtGetEnvironmentStringsA 66 API calls 16151->16152 16153 10010edf 16152->16153 16154 10007b2f ___crtGetEnvironmentStringsA 66 API calls 16153->16154 16155 10010ee7 16154->16155 16156 10007b2f ___crtGetEnvironmentStringsA 66 API calls 16155->16156 16157 10010eef 16156->16157 16158 10007b2f ___crtGetEnvironmentStringsA 66 API calls 16157->16158 16159 10010ef7 16158->16159 16160 10007b2f ___crtGetEnvironmentStringsA 66 API calls 16159->16160 16199->16068 16200->16043 16204 1000943b LeaveCriticalSection 16201->16204 16203 1000f2ef 16203->16030 16204->16203 16206 100104da 16205->16206 16208 100104e8 16205->16208 16207 10009230 __wctomb_s_l 66 API calls 16206->16207 16209 100104df 16207->16209 16210 10010513 16208->16210 16211 10009230 __wctomb_s_l 66 API calls 16208->16211 16209->15756 16210->15756 16212 100104fc 16211->16212 16213 100082eb __wctomb_s_l 66 API calls 16212->16213 16214 1001050c 16213->16214 16214->15756 16216 1000b155 __malloc_crt 66 API calls 16215->16216 16217 1001049d 16216->16217 16217->15759 16219 100103bd ___BuildCatchObjectHelper 16218->16219 16220 100103e0 16219->16220 16221 100103c5 16219->16221 16223 100103ee 16220->16223 16227 1001042f 16220->16227 16275 10009243 16221->16275 16224 10009243 __dosmaperr 66 API calls 16223->16224 16226 100103f3 16224->16226 16229 10009230 __wctomb_s_l 66 API calls 16226->16229 16278 10011917 16227->16278 16228 10009230 __wctomb_s_l 66 API calls 16236 100103d2 ___BuildCatchObjectHelper 16228->16236 16231 100103fa 16229->16231 16233 100082eb __wctomb_s_l 66 API calls 16231->16233 16232 10010435 16234 10010442 16232->16234 16235 10010458 16232->16235 16233->16236 16288 1000fd8f 16234->16288 16238 10009230 __wctomb_s_l 66 API calls 16235->16238 16236->15753 16239 1001045d 16238->16239 16241 10009243 __dosmaperr 66 API calls 16239->16241 16240 10010450 16347 10010483 16240->16347 16241->16240 16244 1000fc82 ___BuildCatchObjectHelper 16243->16244 16245 1000fc93 16244->16245 16246 1000fcaf 16244->16246 16247 10009243 __dosmaperr 66 API calls 16245->16247 16248 1000fcbd 16246->16248 16250 1000fcde 16246->16250 16249 1000fc98 16247->16249 16251 10009243 __dosmaperr 66 API calls 16248->16251 16254 10009230 __wctomb_s_l 66 API calls 16249->16254 16252 1000fd24 16250->16252 16253 1000fcfe 16250->16253 16255 1000fcc2 16251->16255 16258 10011917 ___lock_fhandle 67 API calls 16252->16258 16257 10009243 __dosmaperr 66 API calls 16253->16257 16269 1000fca0 ___BuildCatchObjectHelper 16254->16269 16256 10009230 __wctomb_s_l 66 API calls 16255->16256 16259 1000fcc9 16256->16259 16260 1000fd03 16257->16260 16261 1000fd2a 16258->16261 16262 100082eb __wctomb_s_l 66 API calls 16259->16262 16263 10009230 __wctomb_s_l 66 API calls 16260->16263 16264 1000fd53 16261->16264 16265 1000fd37 16261->16265 16262->16269 16268 1000fd0a 16263->16268 16267 10009230 __wctomb_s_l 66 API calls 16264->16267 16266 1000fbf3 __lseeki64_nolock 68 API calls 16265->16266 16270 1000fd48 16266->16270 16271 1000fd58 16267->16271 16272 100082eb __wctomb_s_l 66 API calls 16268->16272 16269->15753 16387 1000fd85 16270->16387 16273 10009243 __dosmaperr 66 API calls 16271->16273 16272->16269 16273->16270 16276 1000aaf7 _raise 66 API calls 16275->16276 16277 10009248 16276->16277 16277->16228 16279 10011923 ___BuildCatchObjectHelper 16278->16279 16280 1001197e 16279->16280 16282 10009513 __lock 66 API calls 16279->16282 16281 10011983 EnterCriticalSection 16280->16281 16283 100119a0 ___BuildCatchObjectHelper 16280->16283 16281->16283 16284 1001194f 16282->16284 16283->16232 16285 10011966 16284->16285 16287 1000e5c6 ___crtInitCritSecAndSpinCount 66 API calls 16284->16287 16350 100119ae 16285->16350 16287->16285 16289 1000fdcb 16288->16289 16335 1000fdc4 16288->16335 16290 1000fdf6 16289->16290 16291 1000fdcf 16289->16291 16294 1000fe5e 16290->16294 16295 1000fe38 16290->16295 16293 10009243 __dosmaperr 66 API calls 16291->16293 16292 10007ccf __ehhandler$?_StructuredChoreWrapper@_UnrealizedChore@details@Concurrency@@CAXPAV123@@Z 5 API calls 16296 100103a9 16292->16296 16297 1000fdd4 16293->16297 16299 1000fe75 16294->16299 16354 1000fbf3 16294->16354 16298 10009243 __dosmaperr 66 API calls 16295->16298 16296->16240 16300 10009230 __wctomb_s_l 66 API calls 16297->16300 16301 1000fe3d 16298->16301 16304 100104d1 __flsbuf 66 API calls 16299->16304 16303 1000fddb 16300->16303 16306 10009230 __wctomb_s_l 66 API calls 16301->16306 16307 100082eb __wctomb_s_l 66 API calls 16303->16307 16305 1000fe83 16304->16305 16308 100100c5 16305->16308 16313 1000ab6e FindHandler 66 API calls 16305->16313 16309 1000fe46 16306->16309 16307->16335 16311 10010300 WriteFile 16308->16311 16312 100100d5 16308->16312 16310 100082eb __wctomb_s_l 66 API calls 16309->16310 16310->16335 16316 10010327 GetLastError 16311->16316 16320 100100aa 16311->16320 16314 10010179 16312->16314 16338 100100e3 16312->16338 16315 1000fe9e GetConsoleMode 16313->16315 16334 10010185 16314->16334 16336 10010228 16314->16336 16315->16308 16318 1000fec3 16315->16318 16316->16320 16317 1000fed2 GetConsoleCP 16317->16320 16345 1000feef 16317->16345 16318->16308 16318->16317 16319 10010363 16321 10009230 __wctomb_s_l 66 API calls 16319->16321 16319->16335 16320->16319 16322 1001033c 16320->16322 16320->16335 16324 10010380 16321->16324 16326 10010344 16322->16326 16327 10010358 16322->16327 16323 10010133 WriteFile 16323->16316 16323->16338 16332 10009243 __dosmaperr 66 API calls 16324->16332 16325 1001027b WideCharToMultiByte 16325->16316 16329 100102ae WriteFile 16325->16329 16328 10009230 __wctomb_s_l 66 API calls 16326->16328 16367 10009256 16327->16367 16333 10010349 16328->16333 16329->16336 16337 100102dc GetLastError 16329->16337 16330 100101de WriteFile 16330->16316 16330->16334 16332->16335 16339 10009243 __dosmaperr 66 API calls 16333->16339 16334->16319 16334->16320 16334->16330 16335->16292 16336->16319 16336->16320 16336->16325 16336->16329 16337->16336 16338->16319 16338->16320 16338->16323 16339->16335 16341 10010c66 77 API calls __locking 16341->16345 16342 100119d9 11 API calls __putwch_nolock 16342->16345 16343 1000ff8f WideCharToMultiByte 16343->16320 16344 1000ffba WriteFile 16343->16344 16344->16316 16344->16345 16345->16316 16345->16320 16345->16341 16345->16342 16345->16343 16346 1000fffc WriteFile 16345->16346 16364 100108c3 16345->16364 16346->16316 16346->16345 16386 100119b7 LeaveCriticalSection 16347->16386 16349 1001048b 16349->16236 16353 1000943b LeaveCriticalSection 16350->16353 16352 100119b5 16352->16280 16353->16352 16372 100118a6 16354->16372 16356 1000fc0f 16357 1000fc17 16356->16357 16358 1000fc28 SetFilePointer 16356->16358 16359 10009230 __wctomb_s_l 66 API calls 16357->16359 16360 1000fc40 GetLastError 16358->16360 16363 1000fc1c 16358->16363 16359->16363 16361 1000fc4a 16360->16361 16360->16363 16362 10009256 __dosmaperr 66 API calls 16361->16362 16362->16363 16363->16299 16365 1001088d __isleadbyte_l 75 API calls 16364->16365 16366 100108ce 16365->16366 16366->16345 16368 10009243 __dosmaperr 66 API calls 16367->16368 16369 1000925c __dosmaperr 16368->16369 16370 10009230 __wctomb_s_l 66 API calls 16369->16370 16371 10009270 16370->16371 16371->16335 16373 100118c6 16372->16373 16374 100118af 16372->16374 16376 10009243 __dosmaperr 66 API calls 16373->16376 16378 10011913 16373->16378 16375 10009243 __dosmaperr 66 API calls 16374->16375 16377 100118b4 16375->16377 16379 100118f4 16376->16379 16380 10009230 __wctomb_s_l 66 API calls 16377->16380 16378->16356 16381 10009230 __wctomb_s_l 66 API calls 16379->16381 16382 100118bc 16380->16382 16383 100118fb 16381->16383 16382->16356 16384 100082eb __wctomb_s_l 66 API calls 16383->16384 16385 1001190b 16384->16385 16385->16356 16386->16349 16390 100119b7 LeaveCriticalSection 16387->16390 16389 1000fd8d 16389->16269 16390->16389 16391->15686 16393 10007cb9 16392->16393 16400 10007c1a 16392->16400 16394 1000a715 _malloc 65 API calls 16393->16394 16395 10007cbf 16394->16395 16397 10009230 __wctomb_s_l 65 API calls 16395->16397 16396 1000a6d2 __FF_MSGBANNER 65 API calls 16396->16400 16398 10007cc5 16397->16398 16398->15643 16400->16396 16401 1000a532 _abort 65 API calls 16400->16401 16402 10007c7d HeapAlloc 16400->16402 16403 1000a280 _malloc 3 API calls 16400->16403 16404 10007cb0 16400->16404 16405 10007ca4 16400->16405 16406 1000a715 _malloc 65 API calls 16400->16406 16408 10007ca2 16400->16408 16410 10007bbd 16400->16410 16401->16400 16402->16400 16403->16400 16404->15643 16407 10009230 __wctomb_s_l 65 API calls 16405->16407 16406->16400 16407->16408 16409 10009230 __wctomb_s_l 65 API calls 16408->16409 16409->16404 16411 10007bc9 ___BuildCatchObjectHelper 16410->16411 16412 10007bfa ___BuildCatchObjectHelper 16411->16412 16413 10009513 __lock 66 API calls 16411->16413 16412->16400 16414 10007bdf 16413->16414 16415 10009d60 ___sbh_alloc_block 5 API calls 16414->16415 16416 10007bea 16415->16416 16418 10007c03 16416->16418 16421 1000943b LeaveCriticalSection 16418->16421 16420 10007c0a 16420->16412 16421->16420 16423 100095f4 16422->16423 16428 10009896 16422->16428 16424 100097e0 VirtualFree 16423->16424 16423->16428 16425 10009844 16424->16425 16426 10009853 VirtualFree HeapFree 16425->16426 16425->16428 16427 10008360 ___BuildCatchObjectHelper __VEC_memcpy 16426->16427 16427->16428 16428->15663 16432 1000943b LeaveCriticalSection 16429->16432 16431 10007b8c 16431->15655 16432->16431 16433 10008cc4 16434 10008cd0 16433->16434 16435 10008ccb 16433->16435 16439 10008bce 16434->16439 16447 1000d7ad 16435->16447 16438 10008ce1 16440 10008bda ___BuildCatchObjectHelper 16439->16440 16444 10008c77 ___BuildCatchObjectHelper 16440->16444 16445 10008c27 ___DllMainCRTStartup 16440->16445 16451 100089f5 16440->16451 16442 10008c57 16443 100089f5 __CRT_INIT@12 161 API calls 16442->16443 16442->16444 16443->16444 16444->16438 16445->16442 16445->16444 16446 100089f5 __CRT_INIT@12 161 API calls 16445->16446 16446->16442 16448 1000d7d0 16447->16448 16449 1000d7dd GetSystemTimeAsFileTime GetCurrentProcessId GetCurrentThreadId GetTickCount QueryPerformanceCounter 16447->16449 16448->16449 16450 1000d7d4 16448->16450 16449->16450 16450->16434 16452 10008a08 GetProcessHeap HeapAlloc 16451->16452 16453 10008b1f 16451->16453 16454 10008a2c GetVersionExA 16452->16454 16469 10008a25 16452->16469 16455 10008b25 16453->16455 16456 10008b5a 16453->16456 16457 10008a47 GetProcessHeap HeapFree 16454->16457 16458 10008a3c GetProcessHeap HeapFree 16454->16458 16461 10008b44 16455->16461 16455->16469 16635 1000a4d7 16455->16635 16459 10008bb8 16456->16459 16460 10008b5f 16456->16460 16462 10008a73 16457->16462 16458->16469 16459->16469 16638 1000aca7 16459->16638 16463 1000a9b0 __CRT_INIT@12 66 API calls 16460->16463 16468 1000d2b2 __CRT_INIT@12 67 API calls 16461->16468 16461->16469 16504 100092cf HeapCreate 16462->16504 16466 10008b64 16463->16466 16470 1000b195 __calloc_crt 66 API calls 16466->16470 16473 10008b4e 16468->16473 16469->16445 16474 10008b70 16470->16474 16471 10008aa9 16471->16469 16472 10008ab2 16471->16472 16514 1000ad10 GetModuleHandleA 16472->16514 16476 1000a9fb __mtterm 67 API calls 16473->16476 16474->16469 16477 1000a91e __mtterm 66 API calls 16474->16477 16479 10008b53 16476->16479 16480 10008b8e 16477->16480 16478 10008ab7 __RTC_Initialize 16483 10008aca GetCommandLineA 16478->16483 16497 10008abb 16478->16497 16481 10009329 __heap_term 4 API calls 16479->16481 16484 10008b95 16480->16484 16485 10008bac 16480->16485 16481->16469 16553 1000d62a 16483->16553 16487 1000aa38 __CRT_INIT@12 66 API calls 16484->16487 16488 10007b2f ___crtGetEnvironmentStringsA 66 API calls 16485->16488 16490 10008b9c GetCurrentThreadId 16487->16490 16503 10008ac0 16488->16503 16490->16469 16492 10008ae4 16493 10008ae8 16492->16493 16599 1000d571 16492->16599 16593 1000a9fb 16493->16593 16547 10009329 16497->16547 16498 10008b08 16498->16503 16630 1000d2b2 16498->16630 16503->16469 16505 100092f2 16504->16505 16506 100092ef 16504->16506 16649 10009274 16505->16649 16506->16471 16509 10009301 16658 10009544 HeapAlloc 16509->16658 16510 10009325 16510->16471 16513 10009310 HeapDestroy 16513->16506 16515 1000ad22 16514->16515 16516 1000ad2b GetProcAddress GetProcAddress GetProcAddress GetProcAddress 16514->16516 16517 1000a9fb __mtterm 67 API calls 16515->16517 16518 1000ad75 TlsAlloc 16516->16518 16519 1000ad27 16517->16519 16521 1000adc3 TlsSetValue 16518->16521 16522 1000ae8f 16518->16522 16519->16478 16521->16522 16523 1000add4 16521->16523 16522->16478 16676 1000a4e6 16523->16676 16528 1000a8a7 __initp_misc_cfltcvt_tab 66 API calls 16529 1000adf4 16528->16529 16530 1000a8a7 __initp_misc_cfltcvt_tab 66 API calls 16529->16530 16531 1000ae04 16530->16531 16532 1000a8a7 __initp_misc_cfltcvt_tab 66 API calls 16531->16532 16533 1000ae14 16532->16533 16693 1000939d 16533->16693 16536 1000ae8a 16538 1000a9fb __mtterm 67 API calls 16536->16538 16537 1000a91e __mtterm 66 API calls 16539 1000ae35 16537->16539 16538->16522 16539->16536 16540 1000b195 __calloc_crt 66 API calls 16539->16540 16541 1000ae4e 16540->16541 16541->16536 16542 1000a91e __mtterm 66 API calls 16541->16542 16543 1000ae68 16542->16543 16543->16536 16544 1000ae6f 16543->16544 16545 1000aa38 __CRT_INIT@12 66 API calls 16544->16545 16546 1000ae77 GetCurrentThreadId 16545->16546 16546->16522 16548 10009335 16547->16548 16549 10009389 HeapDestroy 16547->16549 16550 10009378 HeapFree 16548->16550 16551 10009351 VirtualFree HeapFree 16548->16551 16549->16503 16550->16549 16551->16551 16552 10009377 16551->16552 16552->16550 16554 1000d665 16553->16554 16555 1000d646 GetEnvironmentStringsW 16553->16555 16557 1000d64e 16554->16557 16558 1000d700 16554->16558 16556 1000d65a GetLastError 16555->16556 16555->16557 16556->16554 16560 1000d680 GetEnvironmentStringsW 16557->16560 16561 1000d68f WideCharToMultiByte 16557->16561 16559 1000d708 GetEnvironmentStrings 16558->16559 16563 10008ada 16558->16563 16559->16563 16564 1000d718 16559->16564 16560->16561 16560->16563 16565 1000d6c3 16561->16565 16566 1000d6f5 FreeEnvironmentStringsW 16561->16566 16578 1000d05e 16563->16578 16567 1000b155 __malloc_crt 66 API calls 16564->16567 16568 1000b155 __malloc_crt 66 API calls 16565->16568 16566->16563 16569 1000d731 16567->16569 16570 1000d6c9 16568->16570 16571 1000d744 ___crtGetEnvironmentStringsA 16569->16571 16572 1000d738 FreeEnvironmentStringsA 16569->16572 16570->16566 16573 1000d6d2 WideCharToMultiByte 16570->16573 16576 1000d74c FreeEnvironmentStringsA 16571->16576 16572->16563 16574 1000d6ec 16573->16574 16575 1000d6e3 16573->16575 16574->16566 16577 10007b2f ___crtGetEnvironmentStringsA 66 API calls 16575->16577 16576->16563 16577->16574 16703 1000a044 16578->16703 16580 1000d06a GetStartupInfoA 16581 1000b195 __calloc_crt 66 API calls 16580->16581 16582 1000d08b 16581->16582 16583 1000d2a9 ___BuildCatchObjectHelper 16582->16583 16584 1000d1f0 16582->16584 16587 1000b195 __calloc_crt 66 API calls 16582->16587 16589 1000d173 16582->16589 16583->16492 16584->16583 16585 1000d226 GetStdHandle 16584->16585 16586 1000d28b SetHandleCount 16584->16586 16588 1000d238 GetFileType 16584->16588 16591 1000e5c6 ___crtInitCritSecAndSpinCount 66 API calls 16584->16591 16585->16584 16586->16583 16587->16582 16588->16584 16589->16583 16589->16584 16590 1000d19c GetFileType 16589->16590 16592 1000e5c6 ___crtInitCritSecAndSpinCount 66 API calls 16589->16592 16590->16589 16591->16584 16592->16589 16594 1000aa05 16593->16594 16598 1000aa11 16593->16598 16595 1000a91e __mtterm 66 API calls 16594->16595 16595->16598 16596 1000aa33 16596->16596 16597 1000aa25 TlsFree 16597->16596 16598->16596 16598->16597 16600 1000d584 16599->16600 16601 1000d589 GetModuleFileNameA 16599->16601 16704 1000f6de 16600->16704 16603 1000d5b0 16601->16603 16708 1000d3d9 16603->16708 16606 1000b155 __malloc_crt 66 API calls 16607 1000d5f2 16606->16607 16608 1000d3d9 _parse_cmdline 75 API calls 16607->16608 16609 10008af4 16607->16609 16608->16609 16609->16498 16610 1000d2fe 16609->16610 16611 1000d30b 16610->16611 16613 1000d310 _strlen 16610->16613 16612 1000f6de ___initmbctable 109 API calls 16611->16612 16612->16613 16614 1000b195 __calloc_crt 66 API calls 16613->16614 16617 10008afd 16613->16617 16622 1000d343 _strlen 16614->16622 16615 1000d39e 16616 10007b2f ___crtGetEnvironmentStringsA 66 API calls 16615->16616 16616->16617 16617->16498 16624 1000a352 16617->16624 16618 1000b195 __calloc_crt 66 API calls 16618->16622 16619 1000d3c3 16620 10007b2f ___crtGetEnvironmentStringsA 66 API calls 16619->16620 16620->16617 16622->16615 16622->16617 16622->16618 16622->16619 16623 100081ef __invoke_watson 10 API calls 16622->16623 16898 1000b7b8 16622->16898 16623->16622 16625 1000a35b __cinit 16624->16625 16907 1000e7df 16625->16907 16627 1000a37a __initterm_e 16629 1000a39b __cinit 16627->16629 16911 10008080 16627->16911 16629->16498 16632 1000d2b9 16630->16632 16631 1000d2fb 16631->16493 16632->16631 16633 1000d2cd DeleteCriticalSection 16632->16633 16634 10007b2f ___crtGetEnvironmentStringsA 66 API calls 16632->16634 16633->16632 16634->16632 17011 1000a3e4 16635->17011 16637 1000a4e2 16637->16461 16639 1000acb0 16638->16639 16648 1000acfb 16638->16648 16642 1000acb9 TlsGetValue 16639->16642 16643 1000acdc 16639->16643 16640 1000ad06 TlsSetValue 16641 1000ad0f 16640->16641 16641->16469 16642->16643 16644 1000accc TlsGetValue 16642->16644 16645 1000a91e __mtterm 66 API calls 16643->16645 16644->16643 16646 1000acf2 16645->16646 17034 1000ab86 16646->17034 16648->16640 16648->16641 16660 1000a2df 16649->16660 16651 1000928b 16652 1000929a 16651->16652 16667 100081ef 16651->16667 16654 1000a316 __initp_misc_cfltcvt_tab 66 API calls 16652->16654 16655 100092a6 16654->16655 16656 100081ef __invoke_watson 10 API calls 16655->16656 16657 100092b5 16655->16657 16656->16657 16657->16509 16657->16510 16659 1000930b 16658->16659 16659->16510 16659->16513 16661 1000a2ea 16660->16661 16662 10009230 __wctomb_s_l 66 API calls 16661->16662 16663 1000a310 16661->16663 16664 1000a2ef 16662->16664 16663->16651 16665 100082eb __wctomb_s_l 66 API calls 16664->16665 16666 1000a2ff 16665->16666 16666->16651 16674 1000b330 16667->16674 16669 10008280 IsDebuggerPresent SetUnhandledExceptionFilter UnhandledExceptionFilter 16670 100082c3 GetCurrentProcess TerminateProcess 16669->16670 16673 100082b7 __invoke_watson 16669->16673 16671 10007ccf __ehhandler$?_StructuredChoreWrapper@_UnrealizedChore@details@Concurrency@@CAXPAV123@@Z 5 API calls 16670->16671 16672 100082e3 16671->16672 16672->16652 16673->16670 16675 1000b33c __VEC_memzero 16674->16675 16675->16669 16697 1000a915 16676->16697 16678 1000a4ec __init_pointers 16700 1000e54e 16678->16700 16681 1000a8a7 __initp_misc_cfltcvt_tab 66 API calls 16682 1000a528 16681->16682 16683 1000a8a7 TlsGetValue 16682->16683 16684 1000a8ba 16683->16684 16685 1000a8db GetModuleHandleA 16683->16685 16684->16685 16687 1000a8c4 TlsGetValue 16684->16687 16686 1000a8ec 16685->16686 16692 1000a8d3 16685->16692 16688 1000a83b __initp_misc_cfltcvt_tab 62 API calls 16686->16688 16690 1000a8cf 16687->16690 16689 1000a8f1 16688->16689 16691 1000a8f5 GetProcAddress 16689->16691 16689->16692 16690->16685 16690->16692 16691->16692 16692->16528 16694 100093a6 16693->16694 16695 1000e5c6 ___crtInitCritSecAndSpinCount 66 API calls 16694->16695 16696 100093d4 16694->16696 16695->16694 16696->16536 16696->16537 16698 1000a8a7 __initp_misc_cfltcvt_tab 66 API calls 16697->16698 16699 1000a91c 16698->16699 16699->16678 16701 1000a8a7 __initp_misc_cfltcvt_tab 66 API calls 16700->16701 16702 1000a51e 16701->16702 16702->16681 16703->16580 16705 1000f6e7 16704->16705 16706 1000f6ee 16704->16706 16714 1000f544 16705->16714 16706->16601 16710 1000d3f6 16708->16710 16712 1000d463 16710->16712 16892 10010cce 16710->16892 16711 1000d561 16711->16606 16711->16609 16712->16711 16713 10010cce 75 API calls _parse_cmdline 16712->16713 16713->16712 16715 1000f550 ___BuildCatchObjectHelper 16714->16715 16716 1000ab6e FindHandler 66 API calls 16715->16716 16717 1000f559 16716->16717 16718 1000f24d _LocaleUpdate::_LocaleUpdate 67 API calls 16717->16718 16719 1000f563 16718->16719 16745 1000f2f1 16719->16745 16722 1000b155 __malloc_crt 66 API calls 16723 1000f584 16722->16723 16724 1000f6a3 ___BuildCatchObjectHelper 16723->16724 16752 1000f36b 16723->16752 16724->16706 16727 1000f5b4 InterlockedDecrement 16728 1000f5d5 InterlockedIncrement 16727->16728 16730 1000f5c4 16727->16730 16728->16724 16731 1000f5eb 16728->16731 16729 1000f6b0 16729->16724 16732 10007b2f ___crtGetEnvironmentStringsA 66 API calls 16729->16732 16735 1000f6c3 16729->16735 16730->16728 16734 10007b2f ___crtGetEnvironmentStringsA 66 API calls 16730->16734 16731->16724 16737 10009513 __lock 66 API calls 16731->16737 16732->16735 16733 10009230 __wctomb_s_l 66 API calls 16733->16724 16736 1000f5d4 16734->16736 16735->16733 16736->16728 16739 1000f5ff InterlockedDecrement 16737->16739 16740 1000f67b 16739->16740 16741 1000f68e InterlockedIncrement 16739->16741 16740->16741 16743 10007b2f ___crtGetEnvironmentStringsA 66 API calls 16740->16743 16762 1000f6a5 16741->16762 16744 1000f68d 16743->16744 16744->16741 16746 1000bbfe _LocaleUpdate::_LocaleUpdate 75 API calls 16745->16746 16747 1000f303 16746->16747 16748 1000f32c 16747->16748 16749 1000f30e GetOEMCP 16747->16749 16750 1000f331 GetACP 16748->16750 16751 1000f31e 16748->16751 16749->16751 16750->16751 16751->16722 16751->16724 16753 1000f2f1 getSystemCP 77 API calls 16752->16753 16754 1000f389 16753->16754 16757 1000f3d8 IsValidCodePage 16754->16757 16759 1000f394 setSBCS 16754->16759 16761 1000f3fd _memset __setmbcp 16754->16761 16755 10007ccf __ehhandler$?_StructuredChoreWrapper@_UnrealizedChore@details@Concurrency@@CAXPAV123@@Z 5 API calls 16756 1000f542 16755->16756 16756->16727 16756->16729 16758 1000f3ea GetCPInfo 16757->16758 16757->16759 16758->16759 16758->16761 16759->16755 16765 1000f0c3 GetCPInfo 16761->16765 16891 1000943b LeaveCriticalSection 16762->16891 16764 1000f6ac 16764->16724 16766 1000f0fa _memset 16765->16766 16767 1000f1a3 16765->16767 16775 1001128e 16766->16775 16771 10007ccf __ehhandler$?_StructuredChoreWrapper@_UnrealizedChore@details@Concurrency@@CAXPAV123@@Z 5 API calls 16767->16771 16773 1000f245 16771->16773 16773->16761 16774 100116b2 ___crtLCMapStringA 100 API calls 16774->16767 16776 1000bbfe _LocaleUpdate::_LocaleUpdate 75 API calls 16775->16776 16777 1001129f 16776->16777 16785 100110d6 16777->16785 16780 100116b2 16781 1000bbfe _LocaleUpdate::_LocaleUpdate 75 API calls 16780->16781 16782 100116c3 16781->16782 16844 10011310 16782->16844 16786 100110f5 GetStringTypeW 16785->16786 16787 10011120 16785->16787 16788 10011115 GetLastError 16786->16788 16789 1001110d 16786->16789 16787->16789 16790 10011207 16787->16790 16788->16787 16791 10011159 MultiByteToWideChar 16789->16791 16808 10011201 16789->16808 16813 10011e31 GetLocaleInfoA 16790->16813 16797 10011186 16791->16797 16791->16808 16793 10007ccf __ehhandler$?_StructuredChoreWrapper@_UnrealizedChore@details@Concurrency@@CAXPAV123@@Z 5 API calls 16795 1000f15e 16793->16795 16795->16780 16796 1001119b _memset __alloca_probe_16 16802 100111d4 MultiByteToWideChar 16796->16802 16796->16808 16797->16796 16800 10007c0c _malloc 66 API calls 16797->16800 16798 10011258 GetStringTypeA 16799 10011273 16798->16799 16798->16808 16805 10007b2f ___crtGetEnvironmentStringsA 66 API calls 16799->16805 16800->16796 16803 100111fb 16802->16803 16804 100111ea GetStringTypeW 16802->16804 16809 1000fa35 16803->16809 16804->16803 16805->16808 16808->16793 16810 1000fa3d 16809->16810 16811 1000fa4e 16809->16811 16810->16811 16812 10007b2f ___crtGetEnvironmentStringsA 66 API calls 16810->16812 16811->16808 16812->16811 16814 10011e62 16813->16814 16815 10011e5d 16813->16815 16816 10011814 ___ansicp 88 API calls 16814->16816 16817 10007ccf __ehhandler$?_StructuredChoreWrapper@_UnrealizedChore@details@Concurrency@@CAXPAV123@@Z 5 API calls 16815->16817 16816->16815 16818 1001122b 16817->16818 16818->16798 16818->16808 16819 10011e78 16818->16819 16820 10011eb6 GetCPInfo 16819->16820 16824 10011f40 16819->16824 16821 10011f2b MultiByteToWideChar 16820->16821 16822 10011ecd 16820->16822 16821->16824 16828 10011ee6 _strlen 16821->16828 16822->16821 16825 10011ed3 GetCPInfo 16822->16825 16823 10007ccf __ehhandler$?_StructuredChoreWrapper@_UnrealizedChore@details@Concurrency@@CAXPAV123@@Z 5 API calls 16826 1001124c 16823->16826 16824->16823 16825->16821 16827 10011ee0 16825->16827 16826->16798 16826->16808 16827->16821 16827->16828 16829 10007c0c _malloc 66 API calls 16828->16829 16831 10011f18 _memset __alloca_probe_16 16828->16831 16829->16831 16830 10011f75 MultiByteToWideChar 16832 10011f8d 16830->16832 16833 10011fac 16830->16833 16831->16824 16831->16830 16835 10011fb1 16832->16835 16836 10011f94 WideCharToMultiByte 16832->16836 16834 1000fa35 __freea 66 API calls 16833->16834 16834->16824 16837 10011fd0 16835->16837 16838 10011fbc WideCharToMultiByte 16835->16838 16836->16833 16839 1000b195 __calloc_crt 66 API calls 16837->16839 16838->16833 16838->16837 16840 10011fd8 16839->16840 16840->16833 16841 10011fe1 WideCharToMultiByte 16840->16841 16841->16833 16842 10011ff3 16841->16842 16843 10007b2f ___crtGetEnvironmentStringsA 66 API calls 16842->16843 16843->16833 16845 1001132f LCMapStringW 16844->16845 16848 1001134a 16844->16848 16846 10011352 GetLastError 16845->16846 16845->16848 16846->16848 16847 10011547 16851 10011e31 ___ansicp 89 API calls 16847->16851 16848->16847 16849 100113a4 16848->16849 16850 100113bd MultiByteToWideChar 16849->16850 16852 1001153e 16849->16852 16850->16852 16860 100113ea 16850->16860 16854 1001156f 16851->16854 16853 10007ccf __ehhandler$?_StructuredChoreWrapper@_UnrealizedChore@details@Concurrency@@CAXPAV123@@Z 5 API calls 16852->16853 16855 1000f17e 16853->16855 16854->16852 16856 10011663 LCMapStringA 16854->16856 16857 10011588 16854->16857 16855->16774 16861 100115bf 16856->16861 16858 10011e78 ___convertcp 73 API calls 16857->16858 16863 1001159a 16858->16863 16859 1001143b MultiByteToWideChar 16864 10011454 LCMapStringW 16859->16864 16865 10011535 16859->16865 16862 10007c0c _malloc 66 API calls 16860->16862 16871 10011403 __alloca_probe_16 16860->16871 16866 1001168a 16861->16866 16870 10007b2f ___crtGetEnvironmentStringsA 66 API calls 16861->16870 16862->16871 16863->16852 16867 100115a4 LCMapStringA 16863->16867 16864->16865 16869 10011475 16864->16869 16868 1000fa35 __freea 66 API calls 16865->16868 16866->16852 16873 10007b2f ___crtGetEnvironmentStringsA 66 API calls 16866->16873 16867->16861 16876 100115c6 16867->16876 16868->16852 16872 1001147d 16869->16872 16875 100114a6 16869->16875 16870->16866 16871->16852 16871->16859 16872->16865 16874 1001148f LCMapStringW 16872->16874 16873->16852 16874->16865 16878 100114c1 __alloca_probe_16 16875->16878 16880 10007c0c _malloc 66 API calls 16875->16880 16879 100115d7 _memset __alloca_probe_16 16876->16879 16881 10007c0c _malloc 66 API calls 16876->16881 16877 100114f5 LCMapStringW 16882 1001150d WideCharToMultiByte 16877->16882 16883 1001152f 16877->16883 16878->16865 16878->16877 16879->16861 16885 10011615 LCMapStringA 16879->16885 16880->16878 16881->16879 16882->16883 16886 10011631 16885->16886 16887 10011635 16885->16887 16891->16764 16895 10010c7d 16892->16895 16896 1000bbfe _LocaleUpdate::_LocaleUpdate 75 API calls 16895->16896 16897 10010c8e 16896->16897 16897->16710 16899 1000b7c5 16898->16899 16900 1000b7cd 16898->16900 16899->16900 16905 1000b7f4 16899->16905 16901 10009230 __wctomb_s_l 66 API calls 16900->16901 16902 1000b7d2 16901->16902 16903 100082eb __wctomb_s_l 66 API calls 16902->16903 16904 1000b7e1 16903->16904 16904->16622 16905->16904 16906 10009230 __wctomb_s_l 66 API calls 16905->16906 16906->16902 16908 1000e7e3 16907->16908 16909 1000a8a7 __initp_misc_cfltcvt_tab 66 API calls 16908->16909 16910 1000e7fb 16908->16910 16909->16908 16910->16627 16914 10008044 16911->16914 16913 10008089 16913->16629 16915 10008050 ___BuildCatchObjectHelper 16914->16915 16922 1000a295 16915->16922 16921 10008071 ___BuildCatchObjectHelper 16921->16913 16923 10009513 __lock 66 API calls 16922->16923 16924 10008055 16923->16924 16925 10007f5c 16924->16925 16926 1000a91e __mtterm 66 API calls 16925->16926 16927 10007f6c 16926->16927 16928 1000a91e __mtterm 66 API calls 16927->16928 16929 10007f7d 16928->16929 16937 10008000 16929->16937 16945 1000b715 16929->16945 16931 1000a8a7 __initp_misc_cfltcvt_tab 66 API calls 16933 10007ff5 16931->16933 16932 10007f9b 16934 10007fbd 16932->16934 16941 10007fe6 16932->16941 16958 1000b1dd 16932->16958 16935 1000a8a7 __initp_misc_cfltcvt_tab 66 API calls 16933->16935 16934->16937 16938 1000b1dd __realloc_crt 72 API calls 16934->16938 16939 10007fd4 16934->16939 16935->16937 16942 1000807a 16937->16942 16938->16939 16939->16937 16940 1000a8a7 __initp_misc_cfltcvt_tab 66 API calls 16939->16940 16940->16941 16941->16931 17007 1000a29e 16942->17007 16946 1000b721 ___BuildCatchObjectHelper 16945->16946 16947 1000b731 16946->16947 16948 1000b74e 16946->16948 16949 10009230 __wctomb_s_l 66 API calls 16947->16949 16950 1000b78f HeapSize 16948->16950 16952 10009513 __lock 66 API calls 16948->16952 16951 1000b736 16949->16951 16954 1000b746 ___BuildCatchObjectHelper 16950->16954 16953 100082eb __wctomb_s_l 66 API calls 16951->16953 16955 1000b75e ___sbh_find_block 16952->16955 16953->16954 16954->16932 16963 1000b7af 16955->16963 16961 1000b1e1 16958->16961 16960 1000b223 16960->16934 16961->16960 16962 1000b204 Sleep 16961->16962 16967 1000f81a 16961->16967 16962->16961 16966 1000943b LeaveCriticalSection 16963->16966 16965 1000b78a 16965->16950 16965->16954 16966->16965 16968 1000f826 ___BuildCatchObjectHelper 16967->16968 16969 1000f83b 16968->16969 16970 1000f82d 16968->16970 16972 1000f842 16969->16972 16973 1000f84e 16969->16973 16971 10007c0c _malloc 66 API calls 16970->16971 16975 1000f835 __dosmaperr ___BuildCatchObjectHelper 16971->16975 16974 10007b2f ___crtGetEnvironmentStringsA 66 API calls 16972->16974 16980 1000f9c0 16973->16980 17002 1000f85b ___sbh_resize_block ___sbh_find_block ___crtGetEnvironmentStringsA 16973->17002 16974->16975 16975->16961 16976 1000f9f3 16978 1000a715 _malloc 66 API calls 16976->16978 16977 1000f9c5 HeapReAlloc 16977->16975 16977->16980 16981 1000f9f9 16978->16981 16979 10009513 __lock 66 API calls 16979->17002 16980->16976 16980->16977 16982 1000fa17 16980->16982 16984 1000a715 _malloc 66 API calls 16980->16984 16986 1000fa0d 16980->16986 16983 10009230 __wctomb_s_l 66 API calls 16981->16983 16982->16975 16985 10009230 __wctomb_s_l 66 API calls 16982->16985 16983->16975 16984->16980 16987 1000fa20 GetLastError 16985->16987 16989 10009230 __wctomb_s_l 66 API calls 16986->16989 16987->16975 16991 1000f98e 16989->16991 16990 1000f8e6 HeapAlloc 16990->17002 16991->16975 16992 1000f993 GetLastError 16991->16992 16992->16975 16993 1000f93b HeapReAlloc 16993->17002 16994 10009d60 ___sbh_alloc_block 5 API calls 16994->17002 16995 1000f9a6 16995->16975 16998 10009230 __wctomb_s_l 66 API calls 16995->16998 16996 1000a715 _malloc 66 API calls 16996->17002 16997 100095b7 __VEC_memcpy VirtualFree VirtualFree HeapFree ___sbh_free_block 16997->17002 17000 1000f9b3 16998->17000 16999 1000f989 17001 10009230 __wctomb_s_l 66 API calls 16999->17001 17000->16975 17000->16987 17001->16991 17002->16975 17002->16976 17002->16979 17002->16990 17002->16993 17002->16994 17002->16995 17002->16996 17002->16997 17002->16999 17003 1000f95e 17002->17003 17006 1000943b LeaveCriticalSection 17003->17006 17005 1000f965 17005->17002 17006->17005 17010 1000943b LeaveCriticalSection 17007->17010 17009 1000807f 17009->16921 17010->17009 17012 1000a3f0 ___BuildCatchObjectHelper 17011->17012 17013 10009513 __lock 66 API calls 17012->17013 17014 1000a3f7 17013->17014 17015 1000a466 _abort 17014->17015 17018 1000a91e __mtterm 66 API calls 17014->17018 17028 1000a4b1 17015->17028 17019 1000a426 17018->17019 17021 1000a91e __mtterm 66 API calls 17019->17021 17020 1000a4ae ___BuildCatchObjectHelper 17020->16637 17025 1000a434 17021->17025 17023 1000a4a5 17024 1000a280 _malloc 3 API calls 17023->17024 17024->17020 17025->17015 17026 1000a915 FindHandlerForForeignException 66 API calls 17025->17026 17027 1000a91e __mtterm 66 API calls 17025->17027 17026->17025 17027->17025 17029 1000a4b7 17028->17029 17030 1000a492 17028->17030 17033 1000943b LeaveCriticalSection 17029->17033 17030->17020 17032 1000943b LeaveCriticalSection 17030->17032 17032->17023 17033->17030 17036 1000ab92 ___BuildCatchObjectHelper 17034->17036 17035 1000ac86 ___BuildCatchObjectHelper 17035->16648 17036->17035 17037 1000abaa 17036->17037 17038 10007b2f ___crtGetEnvironmentStringsA 66 API calls 17036->17038 17039 1000abb8 17037->17039 17040 10007b2f ___crtGetEnvironmentStringsA 66 API calls 17037->17040 17038->17037 17041 1000abc6 17039->17041 17042 10007b2f ___crtGetEnvironmentStringsA 66 API calls 17039->17042 17040->17039 17043 1000abd4 17041->17043 17044 10007b2f ___crtGetEnvironmentStringsA 66 API calls 17041->17044 17042->17041 17045 1000abe2 17043->17045 17046 10007b2f ___crtGetEnvironmentStringsA 66 API calls 17043->17046 17044->17043 17047 1000abf0 17045->17047 17048 10007b2f ___crtGetEnvironmentStringsA 66 API calls 17045->17048 17046->17045 17049 1000ac01 17047->17049 17050 10007b2f ___crtGetEnvironmentStringsA 66 API calls 17047->17050 17048->17047 17051 10009513 __lock 66 API calls 17049->17051 17050->17049 17052 1000ac09 17051->17052 17053 1000ac15 InterlockedDecrement 17052->17053 17054 1000ac2e 17052->17054 17053->17054 17056 1000ac20 17053->17056 17068 1000ac92 17054->17068 17056->17054 17058 10007b2f ___crtGetEnvironmentStringsA 66 API calls 17056->17058 17058->17054 17059 10009513 __lock 66 API calls 17060 1000ac42 17059->17060 17062 1000eeff ___removelocaleref 8 API calls 17060->17062 17067 1000ac73 17060->17067 17065 1000ac57 17062->17065 17064 10007b2f ___crtGetEnvironmentStringsA 66 API calls 17064->17035 17066 1000ed39 ___freetlocinfo 66 API calls 17065->17066 17065->17067 17066->17067 17071 1000ac9e 17067->17071 17074 1000943b LeaveCriticalSection 17068->17074 17070 1000ac3b 17070->17059 17075 1000943b LeaveCriticalSection 17071->17075 17073 1000ac80 17073->17064 17074->17070 17075->17073 14473 401160 14528 4028b8 14473->14528 14475 40116c GetStartupInfoA GetProcessHeap HeapAlloc 14476 4011ab GetVersionExA 14475->14476 14477 40119e 14475->14477 14478 4011c9 GetProcessHeap HeapFree 14476->14478 14479 4011bb GetProcessHeap HeapFree 14476->14479 14618 4010fb 14477->14618 14481 4011f5 14478->14481 14482 4011a5 __freefls@4 14479->14482 14529 40285e HeapCreate 14481->14529 14484 401236 14485 401242 14484->14485 14486 4010fb _fast_error_exit 61 API calls 14484->14486 14626 40267f GetModuleHandleA 14485->14626 14486->14485 14488 401248 14489 401254 __RTC_Initialize 14488->14489 14490 40124c 14488->14490 14539 401fab 14489->14539 14491 4010fb _fast_error_exit 61 API calls 14490->14491 14492 401253 14491->14492 14492->14489 14494 401261 14495 401265 14494->14495 14496 40126d GetCommandLineA 14494->14496 14659 401499 14495->14659 14554 401e76 14496->14554 14502 401287 14503 401293 14502->14503 14504 40128b 14502->14504 14580 401b4a 14503->14580 14505 401499 __amsg_exit 61 API calls 14504->14505 14507 401292 14505->14507 14507->14503 14509 4012a4 14594 4015b5 14509->14594 14510 40129c 14511 401499 __amsg_exit 61 API calls 14510->14511 14513 4012a3 14511->14513 14513->14509 14514 4012aa 14515 4012b6 14514->14515 14516 4012af 14514->14516 14600 401aed 14515->14600 14518 401499 __amsg_exit 61 API calls 14516->14518 14520 4012b5 14518->14520 14519 4012bb 14521 4012c0 14519->14521 14606 401050 14519->14606 14520->14515 14521->14519 14523 4012d7 14524 4012e6 14523->14524 14615 401729 14523->14615 14677 40174b 14524->14677 14528->14475 14530 402881 14529->14530 14531 40287e 14529->14531 14680 402803 14530->14680 14531->14484 14534 402890 14689 40489e HeapAlloc 14534->14689 14535 4028b4 14535->14484 14538 40289f HeapDestroy 14538->14531 14949 4028b8 14539->14949 14541 401fb7 GetStartupInfoA 14542 404107 __calloc_crt 61 API calls 14541->14542 14549 401fd8 14542->14549 14543 4021f6 __freefls@4 14543->14494 14544 402173 GetStdHandle 14553 40213d 14544->14553 14545 4021d8 SetHandleCount 14545->14543 14546 404107 __calloc_crt 61 API calls 14546->14549 14547 402185 GetFileType 14547->14553 14548 4020c0 14548->14543 14550 4020e9 GetFileType 14548->14550 14552 403383 ___crtInitCritSecAndSpinCount 61 API calls 14548->14552 14548->14553 14549->14543 14549->14546 14549->14548 14549->14553 14550->14548 14551 403383 ___crtInitCritSecAndSpinCount 61 API calls 14551->14553 14552->14548 14553->14543 14553->14544 14553->14545 14553->14547 14553->14551 14555 401e92 GetEnvironmentStringsW 14554->14555 14556 401eb1 14554->14556 14557 401ea6 GetLastError 14555->14557 14558 401e9a 14555->14558 14556->14558 14560 401f4c 14556->14560 14557->14556 14559 401ecc GetEnvironmentStringsW 14558->14559 14565 401edb 14558->14565 14562 40127d 14559->14562 14559->14565 14561 401f54 GetEnvironmentStrings 14560->14561 14560->14562 14561->14562 14563 401f64 14561->14563 14666 401dbd 14562->14666 14568 4040c7 __malloc_crt 61 API calls 14563->14568 14564 401ef0 WideCharToMultiByte 14566 401f41 FreeEnvironmentStringsW 14564->14566 14567 401f0f 14564->14567 14565->14564 14565->14565 14566->14562 14569 4040c7 __malloc_crt 61 API calls 14567->14569 14570 401f7d 14568->14570 14571 401f15 14569->14571 14572 401f90 14570->14572 14573 401f84 FreeEnvironmentStringsA 14570->14573 14571->14566 14574 401f1e WideCharToMultiByte 14571->14574 14950 4041a0 14572->14950 14573->14562 14576 401f38 14574->14576 14577 401f2f 14574->14577 14576->14566 14579 404039 __freefls@4 61 API calls 14577->14579 14579->14576 14581 401b57 14580->14581 14583 401b5c _strlen 14580->14583 14954 40401b 14581->14954 14584 404107 __calloc_crt 61 API calls 14583->14584 14587 401298 14583->14587 14592 401b8f _strlen 14584->14592 14585 401bea 14586 404039 __freefls@4 61 API calls 14585->14586 14586->14587 14587->14509 14587->14510 14588 404107 __calloc_crt 61 API calls 14588->14592 14589 401c0f 14590 404039 __freefls@4 61 API calls 14589->14590 14590->14587 14592->14585 14592->14587 14592->14588 14592->14589 14593 402d4d __invoke_watson 5 API calls 14592->14593 14958 4037eb 14592->14958 14593->14592 14595 4015be __cinit 14594->14595 15385 402ff1 14595->15385 14597 4015dd __initterm_e 14599 4015fe __cinit 14597->14599 15389 402fdf 14597->15389 14599->14514 14601 401af9 14600->14601 14603 401afe 14600->14603 14602 40401b ___initmbctable 105 API calls 14601->14602 14602->14603 14605 401b3a 14603->14605 15500 403969 14603->15500 14605->14519 15506 401000 14606->15506 14608 40107e 14610 401096 14608->14610 14611 401000 3 API calls 14608->14611 14609 4010a0 MessageBoxA 14609->14523 14610->14609 14612 4010c2 14610->14612 14611->14610 14613 4010ca ?nf_registerDriver@nfapi@@YA?AW4_NF_STATUS@@PBD 14612->14613 14614 4010db ?nf_unRegisterDriver@nfapi@@YA?AW4_NF_STATUS@@PBD 14612->14614 14613->14523 14614->14523 15512 401647 14615->15512 14617 401736 14617->14524 14619 401104 14618->14619 14620 401109 14618->14620 14621 401955 __FF_MSGBANNER 61 API calls 14619->14621 14622 4017b5 __FF_MSGBANNER 61 API calls 14620->14622 14621->14620 14623 401112 14622->14623 14624 4014e3 __mtinitlocknum 3 API calls 14623->14624 14625 40111c 14624->14625 14625->14482 14627 402691 14626->14627 14628 40269a GetProcAddress GetProcAddress GetProcAddress GetProcAddress 14626->14628 15540 4023d3 14627->15540 14630 4026e4 TlsAlloc 14628->14630 14633 402732 TlsSetValue 14630->14633 14634 4027fe 14630->14634 14633->14634 14635 402743 14633->14635 14634->14488 15551 401769 14635->15551 14638 4022b3 __init_pointers 61 API calls 14639 402753 14638->14639 14640 4022b3 __init_pointers 61 API calls 14639->14640 14641 402763 14640->14641 14642 4022b3 __init_pointers 61 API calls 14641->14642 14643 402773 14642->14643 14644 4022b3 __init_pointers 61 API calls 14643->14644 14645 402783 14644->14645 15558 402b9c 14645->15558 14648 4027f9 14650 4023d3 __mtterm 64 API calls 14648->14650 14649 40232a __mtterm 61 API calls 14651 4027a4 14649->14651 14650->14634 14651->14648 14652 404107 __calloc_crt 61 API calls 14651->14652 14653 4027bd 14652->14653 14653->14648 14654 40232a __mtterm 61 API calls 14653->14654 14655 4027d7 14654->14655 14655->14648 14656 4027de 14655->14656 14657 402410 _raise 61 API calls 14656->14657 14658 4027e6 GetCurrentThreadId 14657->14658 14658->14634 14660 401955 __FF_MSGBANNER 61 API calls 14659->14660 14661 40149e 14660->14661 14662 4017b5 __FF_MSGBANNER 61 API calls 14661->14662 14663 4014a7 14662->14663 14664 40232a __mtterm 61 API calls 14663->14664 14665 40126c 14664->14665 14665->14496 14667 401dd0 14666->14667 14668 401dd5 GetModuleFileNameA 14666->14668 14669 40401b ___initmbctable 105 API calls 14667->14669 14670 401dfc 14668->14670 14669->14668 15565 401c25 14670->15565 14672 401e58 14672->14502 14674 4040c7 __malloc_crt 61 API calls 14675 401e3e 14674->14675 14675->14672 14676 401c25 _parse_cmdline 71 API calls 14675->14676 14676->14672 14678 401647 _abort 61 API calls 14677->14678 14679 4012eb 14678->14679 14679->14482 14691 401542 14680->14691 14685 402829 14704 401579 14685->14704 14686 402835 14687 402844 14686->14687 14688 402d4d __invoke_watson 5 API calls 14686->14688 14687->14534 14687->14535 14688->14687 14690 40289a 14689->14690 14690->14535 14690->14538 14692 40154d 14691->14692 14694 401573 14692->14694 14711 402ea8 14692->14711 14694->14685 14698 402d4d 14694->14698 14947 4055f0 14698->14947 14700 402dde IsDebuggerPresent SetUnhandledExceptionFilter UnhandledExceptionFilter 14701 402e21 GetCurrentProcess TerminateProcess 14700->14701 14702 402e15 ___report_gsfailure 14700->14702 14703 402e41 setSBUpLow 14701->14703 14702->14701 14703->14685 14705 401584 14704->14705 14706 402ea8 __mtinitlocknum 61 API calls 14705->14706 14707 4015a9 14705->14707 14708 401589 14706->14708 14707->14686 14709 402e49 __msize 61 API calls 14708->14709 14710 401599 14709->14710 14710->14686 14717 4024cf GetLastError 14711->14717 14713 401552 14714 402e49 14713->14714 14715 40232a __mtterm 61 API calls 14714->14715 14716 402e57 ___report_gsfailure 14715->14716 14731 4023a1 TlsGetValue 14717->14731 14720 40253a SetLastError 14720->14713 14725 402531 14765 404039 14725->14765 14726 402519 14751 402410 14726->14751 14729 402521 GetCurrentThreadId 14729->14720 14730 402537 14730->14720 14732 4023b4 14731->14732 14733 4023cf 14731->14733 14734 40232a __mtterm 59 API calls 14732->14734 14733->14720 14736 404107 14733->14736 14735 4023bf TlsSetValue 14734->14735 14735->14733 14738 40410b 14736->14738 14739 4024f8 14738->14739 14740 40412b Sleep 14738->14740 14778 405e20 14738->14778 14739->14720 14741 40232a TlsGetValue 14739->14741 14740->14738 14742 40233d 14741->14742 14743 40235e GetModuleHandleA 14741->14743 14742->14743 14744 402347 TlsGetValue 14742->14744 14745 40236f 14743->14745 14750 402356 14743->14750 14747 402352 14744->14747 14915 402247 14745->14915 14747->14743 14747->14750 14748 402374 14749 402378 GetProcAddress 14748->14749 14748->14750 14749->14750 14750->14725 14750->14726 14920 4028b8 14751->14920 14753 40241c GetModuleHandleA 14754 40246d InterlockedIncrement 14753->14754 14755 40243e 14753->14755 14756 402d12 __lock 57 API calls 14754->14756 14757 402247 __mtterm 57 API calls 14755->14757 14758 402494 14756->14758 14759 402443 14757->14759 14921 4046d8 InterlockedIncrement 14758->14921 14759->14754 14760 402447 GetProcAddress GetProcAddress 14759->14760 14760->14754 14762 4024b3 14933 4024c6 14762->14933 14764 4024c0 __freefls@4 14764->14729 14766 404045 __freefls@4 14765->14766 14767 404084 14766->14767 14768 402d12 __lock 59 API calls 14766->14768 14769 4040be _realloc __freefls@4 14766->14769 14767->14769 14770 404099 HeapFree 14767->14770 14771 40405c ___sbh_find_block 14768->14771 14769->14730 14770->14769 14772 4040ab 14770->14772 14777 404076 14771->14777 14937 404911 14771->14937 14773 402ea8 __mtinitlocknum 59 API calls 14772->14773 14774 4040b0 GetLastError 14773->14774 14774->14769 14943 40408f 14777->14943 14779 405e2c __freefls@4 14778->14779 14780 405e44 14779->14780 14790 405e63 setSBUpLow 14779->14790 14781 402ea8 __mtinitlocknum 60 API calls 14780->14781 14782 405e49 14781->14782 14783 402e49 __msize 60 API calls 14782->14783 14785 405e59 __freefls@4 14783->14785 14784 405ed5 HeapAlloc 14784->14790 14785->14738 14790->14784 14790->14785 14791 402d12 14790->14791 14798 4050ba 14790->14798 14804 405f1c 14790->14804 14807 403452 14790->14807 14792 402d25 14791->14792 14793 402d38 EnterCriticalSection 14791->14793 14810 402c4f 14792->14810 14793->14790 14795 402d2b 14795->14793 14796 401499 __amsg_exit 60 API calls 14795->14796 14797 402d37 14796->14797 14797->14793 14799 4050e6 14798->14799 14800 40517f 14799->14800 14803 405188 14799->14803 14903 404c25 14799->14903 14800->14803 14910 404cd5 14800->14910 14803->14790 14914 402c3a LeaveCriticalSection 14804->14914 14806 405f23 14806->14790 14808 40232a __mtterm 61 API calls 14807->14808 14809 40345d 14808->14809 14809->14790 14811 402c5b __freefls@4 14810->14811 14812 402c81 14811->14812 14836 401955 14811->14836 14820 402c91 __freefls@4 14812->14820 14882 4040c7 14812->14882 14818 402cb2 14823 402d12 __lock 61 API calls 14818->14823 14819 402ca3 14822 402ea8 __mtinitlocknum 61 API calls 14819->14822 14820->14795 14822->14820 14825 402cb9 14823->14825 14826 402cc1 14825->14826 14827 402ced 14825->14827 14887 403383 14826->14887 14828 404039 __freefls@4 61 API calls 14827->14828 14830 402cde 14828->14830 14900 402d09 14830->14900 14831 402ccc 14831->14830 14832 404039 __freefls@4 61 API calls 14831->14832 14834 402cd8 14832->14834 14835 402ea8 __mtinitlocknum 61 API calls 14834->14835 14835->14830 14837 403850 __FF_MSGBANNER 61 API calls 14836->14837 14838 40195c 14837->14838 14839 403850 __FF_MSGBANNER 61 API calls 14838->14839 14841 401969 14838->14841 14839->14841 14840 4017b5 __FF_MSGBANNER 61 API calls 14842 401981 14840->14842 14841->14840 14843 40198b 14841->14843 14844 4017b5 __FF_MSGBANNER 61 API calls 14842->14844 14845 4017b5 14843->14845 14844->14843 14846 4017c1 14845->14846 14847 403850 __FF_MSGBANNER 58 API calls 14846->14847 14878 401917 14846->14878 14848 4017e1 14847->14848 14849 40191c GetStdHandle 14848->14849 14851 403850 __FF_MSGBANNER 58 API calls 14848->14851 14850 40192a _strlen 14849->14850 14849->14878 14854 401944 WriteFile 14850->14854 14850->14878 14852 4017f2 14851->14852 14852->14849 14853 401804 14852->14853 14855 4037eb _strcpy_s 58 API calls 14853->14855 14853->14878 14854->14878 14856 401826 14855->14856 14857 40183a GetModuleFileNameA 14856->14857 14858 402d4d __invoke_watson 5 API calls 14856->14858 14859 401858 14857->14859 14864 40187b _strlen 14857->14864 14860 401837 14858->14860 14861 4037eb _strcpy_s 58 API calls 14859->14861 14860->14857 14862 401868 14861->14862 14862->14864 14865 402d4d __invoke_watson 5 API calls 14862->14865 14863 4018be 14866 403631 _strcat_s 58 API calls 14863->14866 14864->14863 14867 4036a2 __FF_MSGBANNER 58 API calls 14864->14867 14865->14864 14868 4018d1 14866->14868 14869 4018ab 14867->14869 14870 4018e2 14868->14870 14871 402d4d __invoke_watson 5 API calls 14868->14871 14869->14863 14873 402d4d __invoke_watson 5 API calls 14869->14873 14872 403631 _strcat_s 58 API calls 14870->14872 14871->14870 14874 4018f3 14872->14874 14873->14863 14875 402d4d __invoke_watson 5 API calls 14874->14875 14877 401904 14874->14877 14875->14877 14876 403474 __FF_MSGBANNER 58 API calls 14876->14878 14877->14876 14879 4014e3 14878->14879 14880 4014bd ___crtCorExitProcess GetModuleHandleA GetProcAddress 14879->14880 14881 4014ec ExitProcess 14880->14881 14885 4040cb 14882->14885 14883 405d5d _malloc 60 API calls 14883->14885 14884 402c9c 14884->14818 14884->14819 14885->14883 14885->14884 14886 4040e3 Sleep 14885->14886 14886->14885 14888 40338f __freefls@4 14887->14888 14889 40232a __mtterm 59 API calls 14888->14889 14890 40339f 14889->14890 14891 401542 ___crtInitCritSecAndSpinCount 59 API calls 14890->14891 14894 4033f3 __freefls@4 14890->14894 14892 4033af 14891->14892 14893 4033be 14892->14893 14895 402d4d __invoke_watson 5 API calls 14892->14895 14896 4033c7 GetModuleHandleA 14893->14896 14897 4033e8 14893->14897 14894->14831 14895->14893 14896->14897 14898 4033d6 GetProcAddress 14896->14898 14899 4022b3 __init_pointers 59 API calls 14897->14899 14898->14897 14899->14894 14901 402c3a _raise LeaveCriticalSection 14900->14901 14902 402d10 14901->14902 14902->14820 14904 404c38 HeapReAlloc 14903->14904 14905 404c6c HeapAlloc 14903->14905 14906 404c5a 14904->14906 14909 404c56 14904->14909 14907 404c8f VirtualAlloc 14905->14907 14905->14909 14906->14905 14908 404ca9 HeapFree 14907->14908 14907->14909 14908->14909 14909->14800 14911 404cea VirtualAlloc 14910->14911 14913 404d31 14911->14913 14913->14803 14914->14806 14916 401579 __FF_MSGBANNER 60 API calls 14915->14916 14917 402262 14916->14917 14918 402269 __mtterm 14917->14918 14919 40226d GetModuleHandleA 14917->14919 14918->14748 14919->14918 14920->14753 14922 4046f3 InterlockedIncrement 14921->14922 14923 4046f6 14921->14923 14922->14923 14924 404700 InterlockedIncrement 14923->14924 14925 404703 14923->14925 14924->14925 14926 404710 14925->14926 14927 40470d InterlockedIncrement 14925->14927 14928 40471a InterlockedIncrement 14926->14928 14930 40471d 14926->14930 14927->14926 14928->14930 14929 404732 InterlockedIncrement 14929->14930 14930->14929 14931 404742 InterlockedIncrement 14930->14931 14932 40474b InterlockedIncrement 14930->14932 14931->14930 14932->14762 14936 402c3a LeaveCriticalSection 14933->14936 14935 4024cd 14935->14764 14936->14935 14938 40494e 14937->14938 14942 404bf0 ___sbh_free_block 14937->14942 14939 404b3a VirtualFree 14938->14939 14938->14942 14940 404b9e 14939->14940 14941 404bad VirtualFree HeapFree 14940->14941 14940->14942 14941->14942 14942->14777 14946 402c3a LeaveCriticalSection 14943->14946 14945 404096 14945->14767 14946->14945 14948 4055fc __VEC_memzero 14947->14948 14948->14700 14949->14541 14951 4041b8 14950->14951 14952 4041df __VEC_memcpy 14951->14952 14953 401f98 FreeEnvironmentStringsA 14951->14953 14952->14953 14953->14562 14955 404024 14954->14955 14956 40402b 14954->14956 14967 403e81 14955->14967 14956->14583 14959 403800 14958->14959 14960 4037f8 14958->14960 14961 402ea8 __mtinitlocknum 61 API calls 14959->14961 14960->14959 14965 403827 14960->14965 14962 403805 14961->14962 14963 402e49 __msize 61 API calls 14962->14963 14964 403814 14963->14964 14964->14592 14965->14964 14966 402ea8 __mtinitlocknum 61 API calls 14965->14966 14966->14962 14968 403e8d __freefls@4 14967->14968 14998 402546 14968->14998 14972 403ea0 15019 403c2e 14972->15019 14975 4040c7 __malloc_crt 61 API calls 14976 403ec1 14975->14976 14977 403fe0 __freefls@4 14976->14977 15026 403ca8 14976->15026 14977->14956 14979 403ee4 14980 403ef1 InterlockedDecrement 14979->14980 14981 403fed 14979->14981 14982 403f01 14980->14982 14983 403f12 InterlockedIncrement 14980->14983 14981->14977 14984 404000 14981->14984 14986 404039 __freefls@4 61 API calls 14981->14986 14982->14983 14988 404039 __freefls@4 61 API calls 14982->14988 14983->14977 14985 403f28 14983->14985 14987 402ea8 __mtinitlocknum 61 API calls 14984->14987 14985->14977 14990 402d12 __lock 61 API calls 14985->14990 14986->14984 14987->14977 14989 403f11 14988->14989 14989->14983 14992 403f3c InterlockedDecrement 14990->14992 14993 403fb8 14992->14993 14994 403fcb InterlockedIncrement 14992->14994 14993->14994 14996 404039 __freefls@4 61 API calls 14993->14996 15034 403fe2 14994->15034 14997 403fca 14996->14997 14997->14994 14999 4024cf _raise 61 API calls 14998->14999 15000 40254c 14999->15000 15001 402559 15000->15001 15002 401499 __amsg_exit 61 API calls 15000->15002 15003 403b8a 15001->15003 15002->15001 15004 403b96 __freefls@4 15003->15004 15005 402546 _LocaleUpdate::_LocaleUpdate 61 API calls 15004->15005 15006 403b9b 15005->15006 15007 402d12 __lock 61 API calls 15006->15007 15008 403bad 15006->15008 15009 403bcb 15007->15009 15011 403bbb __freefls@4 15008->15011 15015 401499 __amsg_exit 61 API calls 15008->15015 15010 403c14 15009->15010 15012 403be2 InterlockedDecrement 15009->15012 15013 403bfc InterlockedIncrement 15009->15013 15037 403c25 15010->15037 15011->14972 15012->15013 15016 403bed 15012->15016 15013->15010 15015->15011 15016->15013 15017 404039 __freefls@4 61 API calls 15016->15017 15018 403bfb 15017->15018 15018->15013 15041 403896 15019->15041 15022 403c69 15024 403c5b 15022->15024 15025 403c6e GetACP 15022->15025 15023 403c4b GetOEMCP 15023->15024 15024->14975 15024->14977 15025->15024 15027 403c2e getSystemCP 73 API calls 15026->15027 15028 403cc6 15027->15028 15029 403d3a setSBUpLow __setmbcp 15028->15029 15030 403cd1 setSBCS setSBUpLow 15028->15030 15031 403d15 IsValidCodePage 15028->15031 15232 403a00 GetCPInfo 15029->15232 15030->14979 15031->15030 15032 403d27 GetCPInfo 15031->15032 15032->15029 15032->15030 15384 402c3a LeaveCriticalSection 15034->15384 15036 403fe9 15036->14977 15040 402c3a LeaveCriticalSection 15037->15040 15039 403c2c 15039->15008 15040->15039 15042 4038a5 15041->15042 15046 4038f2 15041->15046 15043 402546 _LocaleUpdate::_LocaleUpdate 61 API calls 15042->15043 15044 4038aa 15043->15044 15045 4038d2 15044->15045 15049 404828 15044->15049 15045->15046 15048 403b8a _LocaleUpdate::_LocaleUpdate 63 API calls 15045->15048 15046->15022 15046->15023 15048->15046 15050 404834 __freefls@4 15049->15050 15051 402546 _LocaleUpdate::_LocaleUpdate 61 API calls 15050->15051 15052 404839 15051->15052 15053 404867 15052->15053 15055 40484b 15052->15055 15054 402d12 __lock 61 API calls 15053->15054 15056 40486e 15054->15056 15057 402546 _LocaleUpdate::_LocaleUpdate 61 API calls 15055->15057 15064 4047ea 15056->15064 15059 404850 15057->15059 15062 40485e __freefls@4 15059->15062 15063 401499 __amsg_exit 61 API calls 15059->15063 15062->15045 15063->15062 15065 4047ee 15064->15065 15071 404820 15064->15071 15066 4046d8 ___addlocaleref 8 API calls 15065->15066 15065->15071 15067 404801 15066->15067 15067->15071 15075 40475e 15067->15075 15072 404892 15071->15072 15231 402c3a LeaveCriticalSection 15072->15231 15074 404899 15074->15059 15076 4047e6 15075->15076 15077 404767 InterlockedDecrement 15075->15077 15076->15071 15089 404598 15076->15089 15078 404780 15077->15078 15079 40477d InterlockedDecrement 15077->15079 15080 40478a InterlockedDecrement 15078->15080 15081 40478d 15078->15081 15079->15078 15080->15081 15082 404797 InterlockedDecrement 15081->15082 15083 40479a 15081->15083 15082->15083 15084 4047a4 InterlockedDecrement 15083->15084 15086 4047a7 15083->15086 15084->15086 15085 4047bc InterlockedDecrement 15085->15086 15086->15085 15087 4047cc InterlockedDecrement 15086->15087 15088 4047d5 InterlockedDecrement 15086->15088 15087->15086 15088->15076 15090 404619 15089->15090 15092 4045ac 15089->15092 15091 404039 __freefls@4 61 API calls 15090->15091 15093 404666 15090->15093 15094 40463a 15091->15094 15092->15090 15099 4045e0 15092->15099 15102 404039 __freefls@4 61 API calls 15092->15102 15110 40468d 15093->15110 15143 4062d7 15093->15143 15096 404039 __freefls@4 61 API calls 15094->15096 15106 404039 __freefls@4 61 API calls 15099->15106 15118 404601 15099->15118 15100 404039 __freefls@4 61 API calls 15101 4046cc 15109 4045d5 15102->15109 15103 404039 __freefls@4 61 API calls 15103->15110 15104 404039 61 API calls __freefls@4 15104->15110 15112 4045f6 15106->15112 15119 4064a7 15109->15119 15110->15101 15110->15104 15135 406467 15112->15135 15118->15100 15120 4064b0 15119->15120 15134 40652d 15119->15134 15134->15099 15144 4062e4 15143->15144 15145 404686 15143->15145 15146 404039 __freefls@4 61 API calls 15144->15146 15145->15103 15231->15074 15233 403a37 setSBUpLow 15232->15233 15234 403ae0 setSBUpLow 15232->15234 15240 405cce 15233->15240 15234->15029 15241 403896 _LocaleUpdate::_LocaleUpdate 71 API calls 15240->15241 15242 405cdf 15241->15242 15250 405b16 15242->15250 15244 403a9b 15245 405ad3 15244->15245 15246 403896 _LocaleUpdate::_LocaleUpdate 71 API calls 15245->15246 15247 405ae4 15246->15247 15251 405b35 GetStringTypeW 15250->15251 15252 405b60 15250->15252 15254 405b55 GetLastError 15251->15254 15255 405b4d 15251->15255 15253 405c47 15252->15253 15252->15255 15294 406c2c GetLocaleInfoA 15253->15294 15254->15252 15256 405b99 MultiByteToWideChar 15255->15256 15259 405c41 setSBUpLow 15255->15259 15256->15259 15261 405bc6 15256->15261 15258 405c6b 15258->15259 15260 405c98 GetStringTypeA 15258->15260 15298 406c73 15258->15298 15259->15244 15260->15259 15265 405bdb setSBUpLow __alloca_probe_16 15261->15265 15272 405d5d 15261->15272 15263 405c14 MultiByteToWideChar 15265->15259 15265->15263 15273 405e0a 15272->15273 15284 405d6b 15272->15284 15274 403452 __calloc_impl 60 API calls 15273->15274 15280 4017b5 __FF_MSGBANNER 60 API calls 15280->15284 15281 405dce HeapAlloc 15281->15284 15282 4014e3 __mtinitlocknum 3 API calls 15282->15284 15283 405e01 15283->15265 15284->15280 15284->15281 15284->15282 15284->15283 15285 405df5 15284->15285 15287 403452 __calloc_impl 60 API calls 15284->15287 15287->15284 15295 406c5d 15294->15295 15297 406c58 setSBUpLow 15294->15297 15332 406f18 15295->15332 15297->15258 15299 406cb1 GetCPInfo 15298->15299 15302 406d3b setSBUpLow 15298->15302 15335 407186 15332->15335 15336 40719d 15335->15336 15384->15036 15386 402ff5 15385->15386 15388 40300d 15386->15388 15392 4022b3 TlsGetValue 15386->15392 15388->14597 15402 402fa3 15389->15402 15391 402fe8 15391->14599 15393 4022c6 15392->15393 15394 4022e7 GetModuleHandleA 15392->15394 15393->15394 15396 4022d0 TlsGetValue 15393->15396 15395 4022f8 15394->15395 15401 4022df 15394->15401 15397 402247 __mtterm 57 API calls 15395->15397 15398 4022db 15396->15398 15399 4022fd 15397->15399 15398->15394 15398->15401 15400 402301 GetProcAddress 15399->15400 15399->15401 15400->15401 15401->15386 15403 402faf __freefls@4 15402->15403 15410 4014f8 15403->15410 15409 402fd0 __freefls@4 15409->15391 15411 402d12 __lock 61 API calls 15410->15411 15412 4014ff 15411->15412 15413 402ebb 15412->15413 15414 40232a __mtterm 61 API calls 15413->15414 15415 402ecb 15414->15415 15416 40232a __mtterm 61 API calls 15415->15416 15417 402edc 15416->15417 15418 402f5f 15417->15418 15433 40566a 15417->15433 15430 402fd9 15418->15430 15420 4022b3 __init_pointers 61 API calls 15421 402f54 15420->15421 15423 4022b3 __init_pointers 61 API calls 15421->15423 15422 402efa 15426 402f1c 15422->15426 15429 402f45 15422->15429 15446 40414f 15422->15446 15423->15418 15425 40414f __realloc_crt 68 API calls 15427 402f33 15425->15427 15426->15418 15426->15425 15426->15427 15427->15418 15428 4022b3 __init_pointers 61 API calls 15427->15428 15428->15429 15429->15420 15496 401501 15430->15496 15434 405676 __freefls@4 15433->15434 15435 405686 15434->15435 15437 4056a3 15434->15437 15438 402ea8 __mtinitlocknum 61 API calls 15435->15438 15436 4056e4 HeapSize 15442 40569b __freefls@4 15436->15442 15437->15436 15439 402d12 __lock 61 API calls 15437->15439 15440 40568b 15438->15440 15443 4056b3 ___sbh_find_block 15439->15443 15441 402e49 __msize 61 API calls 15440->15441 15441->15442 15442->15422 15451 405704 15443->15451 15450 404153 15446->15450 15448 404195 15448->15426 15449 404176 Sleep 15449->15450 15450->15448 15450->15449 15455 405f3e 15450->15455 15454 402c3a LeaveCriticalSection 15451->15454 15453 4056df 15453->15436 15453->15442 15454->15453 15456 405f4a __freefls@4 15455->15456 15457 405f51 15456->15457 15458 405f5f 15456->15458 15459 405d5d _malloc 61 API calls 15457->15459 15460 405f72 15458->15460 15461 405f66 15458->15461 15463 405f59 _realloc __freefls@4 15459->15463 15468 4060e4 15460->15468 15470 405f7f ___sbh_resize_block ___sbh_find_block 15460->15470 15462 404039 __freefls@4 61 API calls 15461->15462 15462->15463 15463->15450 15464 406117 15466 403452 __calloc_impl 61 API calls 15464->15466 15465 4060e9 HeapReAlloc 15465->15463 15465->15468 15469 40611d 15466->15469 15467 402d12 __lock 61 API calls 15467->15470 15468->15464 15468->15465 15471 40613b 15468->15471 15473 403452 __calloc_impl 61 API calls 15468->15473 15475 406131 15468->15475 15472 402ea8 __mtinitlocknum 61 API calls 15469->15472 15470->15463 15470->15464 15470->15467 15479 40600a HeapAlloc 15470->15479 15480 40605f HeapReAlloc 15470->15480 15482 4050ba ___sbh_alloc_block 5 API calls 15470->15482 15483 4060ca 15470->15483 15484 403452 __calloc_impl 61 API calls 15470->15484 15487 4060ad 15470->15487 15488 4041a0 __VEC_memcpy _realloc 15470->15488 15491 404911 VirtualFree VirtualFree HeapFree ___sbh_free_block 15470->15491 15492 406082 15470->15492 15471->15463 15474 402ea8 __mtinitlocknum 61 API calls 15471->15474 15472->15463 15473->15468 15476 406144 GetLastError 15474->15476 15478 402ea8 __mtinitlocknum 61 API calls 15475->15478 15476->15463 15490 4060b2 15478->15490 15479->15470 15480->15470 15481 4060b7 GetLastError 15481->15463 15482->15470 15483->15463 15485 402ea8 __mtinitlocknum 61 API calls 15483->15485 15484->15470 15486 4060d7 15485->15486 15486->15463 15486->15476 15489 402ea8 __mtinitlocknum 61 API calls 15487->15489 15488->15470 15489->15490 15490->15463 15490->15481 15491->15470 15495 402c3a LeaveCriticalSection 15492->15495 15494 406089 15494->15470 15495->15494 15499 402c3a LeaveCriticalSection 15496->15499 15498 401508 15498->15409 15499->15498 15503 403918 15500->15503 15504 403896 _LocaleUpdate::_LocaleUpdate 71 API calls 15503->15504 15505 403929 15504->15505 15505->14603 15507 40103a 15506->15507 15509 401008 15506->15509 15507->14608 15508 401031 CharNextA 15508->15507 15508->15509 15509->15507 15509->15508 15510 40102a CharNextA 15509->15510 15511 40103f CharNextA 15509->15511 15510->15508 15510->15509 15511->14608 15513 401653 __freefls@4 15512->15513 15514 402d12 __lock 61 API calls 15513->15514 15515 40165a 15514->15515 15517 4016d9 _abort 15515->15517 15518 40167e 15515->15518 15531 401714 15517->15531 15519 40232a __mtterm 61 API calls 15518->15519 15521 401689 15519->15521 15523 40232a __mtterm 61 API calls 15521->15523 15522 401711 __freefls@4 15522->14617 15528 401697 15523->15528 15525 401708 15527 4014e3 __mtinitlocknum 3 API calls 15525->15527 15526 4016c9 _abort 15526->15517 15527->15522 15528->15526 15530 40232a __mtterm 61 API calls 15528->15530 15536 402321 15528->15536 15530->15528 15532 4016f5 15531->15532 15533 40171a 15531->15533 15532->15522 15535 402c3a LeaveCriticalSection 15532->15535 15539 402c3a LeaveCriticalSection 15533->15539 15535->15525 15537 4022b3 __init_pointers 61 API calls 15536->15537 15538 402328 15537->15538 15538->15528 15539->15532 15541 4023e9 15540->15541 15542 4023dd 15540->15542 15544 4023fd TlsFree 15541->15544 15545 40240b 15541->15545 15543 40232a __mtterm 61 API calls 15542->15543 15543->15541 15544->15545 15546 402bff DeleteCriticalSection 15545->15546 15547 402c17 15545->15547 15548 404039 __freefls@4 61 API calls 15546->15548 15549 402c29 DeleteCriticalSection 15547->15549 15550 402696 15547->15550 15548->15545 15549->15547 15550->14488 15552 402321 __init_pointers 61 API calls 15551->15552 15553 40176f __init_pointers 15552->15553 15562 402b8b 15553->15562 15556 4022b3 __init_pointers 61 API calls 15557 4017ab 15556->15557 15557->14638 15559 402ba5 15558->15559 15560 403383 ___crtInitCritSecAndSpinCount 61 API calls 15559->15560 15561 402790 15559->15561 15560->15559 15561->14648 15561->14649 15563 4022b3 __init_pointers 61 API calls 15562->15563 15564 4017a1 15563->15564 15564->15556 15567 401c42 15565->15567 15566 403969 _parse_cmdline 71 API calls 15566->15567 15567->15566 15569 401caf 15567->15569 15568 401dad 15568->14672 15568->14674 15569->15568 15570 403969 71 API calls _parse_cmdline 15569->15570 15570->15569

                                                                                                                Executed Functions

                                                                                                                Function 100134A0 Relevance: 15.1, APIs: 10, Instructions: 58serviceCOMMON
                                                                                                                Download Yara Rule

                                                                                                                Control-flow Graph

                                                                                                                APIs
                                                                                                                • OpenSCManagerA.ADVAPI32(00000000,00000000,000F003F), ref: 100134BE
                                                                                                                • OpenServiceA.ADVAPI32(00000000,?,00010000), ref: 100134D1
                                                                                                                • DeleteService.ADVAPI32(00000000), ref: 100134DE
                                                                                                                • GetLastError.KERNEL32 ref: 100134E4
                                                                                                                • CloseServiceHandle.ADVAPI32(00000000), ref: 100134ED
                                                                                                                • CloseServiceHandle.ADVAPI32(00000000), ref: 100134F6
                                                                                                                • GetLastError.KERNEL32 ref: 100134FE
                                                                                                                • CloseServiceHandle.ADVAPI32(00000000), ref: 10013507
                                                                                                                • GetLastError.KERNEL32 ref: 1001350F
                                                                                                                • SetLastError.KERNEL32(00000000), ref: 10013518
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000023.00000002.2673509223.0000000010001000.00000020.00000001.01000000.00000028.sdmp, Offset: 10000000, based on PE: true
                                                                                                                • Associated: 00000023.00000002.2673483913.0000000010000000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                • Associated: 00000023.00000002.2673541932.0000000010019000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                • Associated: 00000023.00000002.2673575934.000000001001E000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                • Associated: 00000023.00000002.2673609450.0000000010022000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_35_2_10000000_nfregdrv.jbxd
                                                                                                                Similarity
                                                                                                                • API ID: Service$ErrorLast$CloseHandle$Open$DeleteManager
                                                                                                                • String ID:
                                                                                                                • API String ID: 2479149357-0
                                                                                                                • Opcode ID: 0b951e9cdb1a0b26f3be69c1878f1c2782ce42dc9d03292b26ecafa066a6cc1a
                                                                                                                • Instruction ID: 46c2e6c5a61eedaf3fef038684788d392a8c372027cf2a0885eba6b60b5d160f
                                                                                                                • Opcode Fuzzy Hash: 0b951e9cdb1a0b26f3be69c1878f1c2782ce42dc9d03292b26ecafa066a6cc1a
                                                                                                                • Instruction Fuzzy Hash: 9F01F132641624AFE7126BF49C8DB5E3B68EF49F42F058130FB01DA161DAB1E84086B1
                                                                                                                Function 10012F40 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 66registryCOMMON
                                                                                                                Download Yara Rule

                                                                                                                Control-flow Graph

                                                                                                                APIs
                                                                                                                • __snprintf.LIBCMT ref: 10012F6E
                                                                                                                • RegOpenKeyExA.KERNELBASE(80000002,?,00000000,00000003,?,?,?,?,?), ref: 10012F89
                                                                                                                • RegQueryValueExA.ADVAPI32(?,Tag,00000000,?,00000001,?), ref: 10012FD4
                                                                                                                • RegCloseKey.ADVAPI32(?), ref: 10012FFA
                                                                                                                Strings
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000023.00000002.2673509223.0000000010001000.00000020.00000001.01000000.00000028.sdmp, Offset: 10000000, based on PE: true
                                                                                                                • Associated: 00000023.00000002.2673483913.0000000010000000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                • Associated: 00000023.00000002.2673541932.0000000010019000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                • Associated: 00000023.00000002.2673575934.000000001001E000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                • Associated: 00000023.00000002.2673609450.0000000010022000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_35_2_10000000_nfregdrv.jbxd
                                                                                                                Similarity
                                                                                                                • API ID: CloseOpenQueryValue__snprintf
                                                                                                                • String ID: SYSTEM\CurrentControlSet\Services\%s$Tag$Tag
                                                                                                                • API String ID: 906094135-167878906
                                                                                                                • Opcode ID: 6f56ef87285fea69d5a8c9f690d12e05e358ab22d85251f7a7e5ed3c1616b0d0
                                                                                                                • Instruction ID: f9c08eb89e650521aaf22d2235fa5d9325a6f599f2f4c571dbf36a9dd9bf478e
                                                                                                                • Opcode Fuzzy Hash: 6f56ef87285fea69d5a8c9f690d12e05e358ab22d85251f7a7e5ed3c1616b0d0
                                                                                                                • Instruction Fuzzy Hash: 33116DB1A04354AFE328CB64CC4AFEB77E8EB89B40F40481CB74D9A180E774D945C7A2
                                                                                                                Function 10012D70 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 55registryCOMMON
                                                                                                                Download Yara Rule

                                                                                                                Control-flow Graph

                                                                                                                APIs
                                                                                                                • RegOpenKeyExA.KERNELBASE(80000002,SYSTEM\CurrentControlSet\Services\Tcpip6\Parameters,00000000,00000003,?,?,?,10013525,00000000), ref: 10012D86
                                                                                                                • RegQueryValueExA.KERNELBASE ref: 10012DB9
                                                                                                                • RegSetValueExA.KERNELBASE(?,DisabledComponents,00000000,00000004,?,00000004,?), ref: 10012DF7
                                                                                                                • RegCloseKey.KERNELBASE(?), ref: 10012E04
                                                                                                                Strings
                                                                                                                • SYSTEM\CurrentControlSet\Services\Tcpip6\Parameters, xrefs: 10012D7C
                                                                                                                • DisabledComponents, xrefs: 10012DAB
                                                                                                                • DisabledComponents, xrefs: 10012DF1
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000023.00000002.2673509223.0000000010001000.00000020.00000001.01000000.00000028.sdmp, Offset: 10000000, based on PE: true
                                                                                                                • Associated: 00000023.00000002.2673483913.0000000010000000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                • Associated: 00000023.00000002.2673541932.0000000010019000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                • Associated: 00000023.00000002.2673575934.000000001001E000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                • Associated: 00000023.00000002.2673609450.0000000010022000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_35_2_10000000_nfregdrv.jbxd
                                                                                                                Similarity
                                                                                                                • API ID: Value$CloseOpenQuery
                                                                                                                • String ID: DisabledComponents$DisabledComponents$SYSTEM\CurrentControlSet\Services\Tcpip6\Parameters
                                                                                                                • API String ID: 237177642-4216016250
                                                                                                                • Opcode ID: e76360cbcc9baf098a5e93c68d2a24a7b395f91ed9355a7129efde6212d0d687
                                                                                                                • Instruction ID: 9ee4d2c3e57a7063b565cc8fc060191f73725880ea3dbb34ca1c1c45c67cef35
                                                                                                                • Opcode Fuzzy Hash: e76360cbcc9baf098a5e93c68d2a24a7b395f91ed9355a7129efde6212d0d687
                                                                                                                • Instruction Fuzzy Hash: 7911A0B5508312BFE710DB54DD44FAB7BE8EB88B44F41890CF6899A0D0E374C984C756
                                                                                                                Function 10012D00 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 37registryCOMMON
                                                                                                                Download Yara Rule

                                                                                                                Control-flow Graph

                                                                                                                APIs
                                                                                                                • RegOpenKeyExA.KERNELBASE(80000002,SYSTEM\CurrentControlSet\Services\Tcpip\Parameters,00000000,00000002,00000000,00000000,00000000), ref: 10012D15
                                                                                                                • RegSetValueExA.KERNELBASE(00000000,DisableTaskOffload,00000000,00000004,?,00000004,?), ref: 10012D47
                                                                                                                • RegCloseKey.ADVAPI32(?), ref: 10012D54
                                                                                                                Strings
                                                                                                                • SYSTEM\CurrentControlSet\Services\Tcpip\Parameters, xrefs: 10012D0B
                                                                                                                • DisableTaskOffload, xrefs: 10012D3D
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000023.00000002.2673509223.0000000010001000.00000020.00000001.01000000.00000028.sdmp, Offset: 10000000, based on PE: true
                                                                                                                • Associated: 00000023.00000002.2673483913.0000000010000000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                • Associated: 00000023.00000002.2673541932.0000000010019000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                • Associated: 00000023.00000002.2673575934.000000001001E000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                • Associated: 00000023.00000002.2673609450.0000000010022000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_35_2_10000000_nfregdrv.jbxd
                                                                                                                Similarity
                                                                                                                • API ID: CloseOpenValue
                                                                                                                • String ID: DisableTaskOffload$SYSTEM\CurrentControlSet\Services\Tcpip\Parameters
                                                                                                                • API String ID: 779948276-1474643600
                                                                                                                • Opcode ID: b914e9072d492bfd31763df8d8490f62f2f2385f3a95968ca031b7c0720cf9be
                                                                                                                • Instruction ID: 2230c34db065372bc40d34239641de211e9b25fb5ab268f73dea6e655c247ba9
                                                                                                                • Opcode Fuzzy Hash: b914e9072d492bfd31763df8d8490f62f2f2385f3a95968ca031b7c0720cf9be
                                                                                                                • Instruction Fuzzy Hash: BBF0E9716043207FE711EB209C4AF5B37E8AB8CB00F84891CF794DA180E370C958C796
                                                                                                                Function 00401000 Relevance: 3.8, APIs: 3, Instructions: 36COMMON
                                                                                                                Download Yara Rule

                                                                                                                Control-flow Graph

                                                                                                                • Executed
                                                                                                                • Not Executed
                                                                                                                control_flow_graph 36 401000-401006 37 401008-40100e 36->37 38 40103a-40103e 36->38 39 401010-401013 37->39 39->38 40 401015-401019 39->40 41 401031-401038 CharNextA 40->41 42 40101b 40->42 41->38 41->39 43 401020-401024 42->43 43->41 44 401026-401028 43->44 45 40102a-40102f CharNextA 44->45 46 40103f-401044 CharNextA 44->46 45->41 45->43
                                                                                                                APIs
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000023.00000002.2671828313.0000000000401000.00000020.00000001.01000000.00000027.sdmp, Offset: 00400000, based on PE: true
                                                                                                                • Associated: 00000023.00000002.2671732944.0000000000400000.00000002.00000001.01000000.00000027.sdmpDownload File
                                                                                                                • Associated: 00000023.00000002.2671884603.0000000000408000.00000002.00000001.01000000.00000027.sdmpDownload File
                                                                                                                • Associated: 00000023.00000002.2671926254.000000000040A000.00000004.00000001.01000000.00000027.sdmpDownload File
                                                                                                                • Associated: 00000023.00000002.2672063353.000000000040C000.00000002.00000001.01000000.00000027.sdmpDownload File
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_35_2_400000_nfregdrv.jbxd
                                                                                                                Similarity
                                                                                                                • API ID: CharNext
                                                                                                                • String ID:
                                                                                                                • API String ID: 3213498283-0
                                                                                                                • Opcode ID: 7c522331cf8c48b44b5ec6a2051b80fc459d173407debce357d97d96f401c9b2
                                                                                                                • Instruction ID: dde81b71a90f9f684eae9ae77c255fe350d7d91c01edff3817fbd5cfc17a4160
                                                                                                                • Opcode Fuzzy Hash: 7c522331cf8c48b44b5ec6a2051b80fc459d173407debce357d97d96f401c9b2
                                                                                                                • Instruction Fuzzy Hash: 3BE06522A056E216D732162D28107AB568C4FD57E071A457BE8C0F77A5D639CCC642DD
                                                                                                                Function 0040285E Relevance: 3.0, APIs: 2, Instructions: 28memoryCOMMON
                                                                                                                Download Yara Rule

                                                                                                                Control-flow Graph

                                                                                                                • Executed
                                                                                                                • Not Executed
                                                                                                                control_flow_graph 47 40285e-40287c HeapCreate 48 402881-40288e call 402803 47->48 49 40287e-402880 47->49 52 402890-40289d call 40489e 48->52 53 4028b4-4028b7 48->53 52->53 56 40289f-4028b2 HeapDestroy 52->56 56->49
                                                                                                                APIs
                                                                                                                • HeapCreate.KERNELBASE(00000000,00001000,00000000,00401236,00000001), ref: 0040286F
                                                                                                                • HeapDestroy.KERNEL32 ref: 004028A5
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000023.00000002.2671828313.0000000000401000.00000020.00000001.01000000.00000027.sdmp, Offset: 00400000, based on PE: true
                                                                                                                • Associated: 00000023.00000002.2671732944.0000000000400000.00000002.00000001.01000000.00000027.sdmpDownload File
                                                                                                                • Associated: 00000023.00000002.2671884603.0000000000408000.00000002.00000001.01000000.00000027.sdmpDownload File
                                                                                                                • Associated: 00000023.00000002.2671926254.000000000040A000.00000004.00000001.01000000.00000027.sdmpDownload File
                                                                                                                • Associated: 00000023.00000002.2672063353.000000000040C000.00000002.00000001.01000000.00000027.sdmpDownload File
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_35_2_400000_nfregdrv.jbxd
                                                                                                                Similarity
                                                                                                                • API ID: Heap$CreateDestroy
                                                                                                                • String ID:
                                                                                                                • API String ID: 3296620671-0
                                                                                                                • Opcode ID: 6a61f211992a6e18c95607d49fad3f3b072efb0b2f059ec0a30deba2ad50305b
                                                                                                                • Instruction ID: c9b1d8ae43914fce643a3b0feff7cc958f3d34f8e715b1d91c1e9ab3a3c39313
                                                                                                                • Opcode Fuzzy Hash: 6a61f211992a6e18c95607d49fad3f3b072efb0b2f059ec0a30deba2ad50305b
                                                                                                                • Instruction Fuzzy Hash: ABE06576550301DAEB457B715F0DB363594E74074AF10853BF841F51E2FBB88540960D
                                                                                                                Function 100092CF Relevance: 3.0, APIs: 2, Instructions: 28memoryCOMMONLIBRARYCODE
                                                                                                                Download Yara Rule

                                                                                                                Control-flow Graph

                                                                                                                APIs
                                                                                                                • HeapCreate.KERNELBASE(00000000,00001000,00000000,10008AA9,00000001,?,?,00000001,?,?,10008C27,00000001,?,?,1001B608,0000000C), ref: 100092E0
                                                                                                                • HeapDestroy.KERNEL32(?,?,00000001,?,?,10008C27,00000001,?,?,1001B608,0000000C,10008CE1,?), ref: 10009316
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000023.00000002.2673509223.0000000010001000.00000020.00000001.01000000.00000028.sdmp, Offset: 10000000, based on PE: true
                                                                                                                • Associated: 00000023.00000002.2673483913.0000000010000000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                • Associated: 00000023.00000002.2673541932.0000000010019000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                • Associated: 00000023.00000002.2673575934.000000001001E000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                • Associated: 00000023.00000002.2673609450.0000000010022000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_35_2_10000000_nfregdrv.jbxd
                                                                                                                Similarity
                                                                                                                • API ID: Heap$CreateDestroy
                                                                                                                • String ID:
                                                                                                                • API String ID: 3296620671-0
                                                                                                                • Opcode ID: 564c51fca60af66e7a4a00761b05f1ec1e784a5b92eab29dc0ead7a71cea7728
                                                                                                                • Instruction ID: 0c4cb1e0f78fd55b04bfad504b74cc3b14dfc1a1f94936553e122905dbeb7e21
                                                                                                                • Opcode Fuzzy Hash: 564c51fca60af66e7a4a00761b05f1ec1e784a5b92eab29dc0ead7a71cea7728
                                                                                                                • Instruction Fuzzy Hash: 3CE01279654362AEFB41DB308C8976A35E8E7547C6F10C939F415C50B8FBB0C6809A04
                                                                                                                Function 004014E3 Relevance: 3.0, APIs: 2, Instructions: 5COMMONLIBRARYCODE
                                                                                                                Download Yara Rule

                                                                                                                Control-flow Graph

                                                                                                                • Executed
                                                                                                                • Not Executed
                                                                                                                control_flow_graph 67 4014e3-4014f1 call 4014bd ExitProcess
                                                                                                                APIs
                                                                                                                • ___crtCorExitProcess.LIBCMT ref: 004014E7
                                                                                                                  • Part of subcall function 004014BD: GetModuleHandleA.KERNEL32(mscoree.dll,004014EC,?,00405D96,000000FF,0000001E,00000001,00000000,00000000,?,004040D4,?,00000001,?,00402C9C,00000018), ref: 004014C2
                                                                                                                  • Part of subcall function 004014BD: GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 004014D2
                                                                                                                • ExitProcess.KERNEL32 ref: 004014F1
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000023.00000002.2671828313.0000000000401000.00000020.00000001.01000000.00000027.sdmp, Offset: 00400000, based on PE: true
                                                                                                                • Associated: 00000023.00000002.2671732944.0000000000400000.00000002.00000001.01000000.00000027.sdmpDownload File
                                                                                                                • Associated: 00000023.00000002.2671884603.0000000000408000.00000002.00000001.01000000.00000027.sdmpDownload File
                                                                                                                • Associated: 00000023.00000002.2671926254.000000000040A000.00000004.00000001.01000000.00000027.sdmpDownload File
                                                                                                                • Associated: 00000023.00000002.2672063353.000000000040C000.00000002.00000001.01000000.00000027.sdmpDownload File
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_35_2_400000_nfregdrv.jbxd
                                                                                                                Similarity
                                                                                                                • API ID: ExitProcess$AddressHandleModuleProc___crt
                                                                                                                • String ID:
                                                                                                                • API String ID: 2427264223-0
                                                                                                                • Opcode ID: 6c26d35538560624cb0276524913e3c26102e8c22ac44d2ad5d5b3d3ea4d6717
                                                                                                                • Instruction ID: 537dee8b853bd8b800ce6c4827e120e5e31ff7b11606db799f1f5586ed61abf1
                                                                                                                • Opcode Fuzzy Hash: 6c26d35538560624cb0276524913e3c26102e8c22ac44d2ad5d5b3d3ea4d6717
                                                                                                                • Instruction Fuzzy Hash: EBB01230004100AFC6012B10EF0BC0D7B71EF40744F00C47DF088100708F354C54BE05

                                                                                                                Non-executed Functions

                                                                                                                Function 10002060 Relevance: 19.9, APIs: 13, Instructions: 395COMMON
                                                                                                                Download Yara Rule
                                                                                                                APIs
                                                                                                                • EnterCriticalSection.KERNEL32 ref: 100020EF
                                                                                                                • __aullrem.LIBCMT ref: 10002114
                                                                                                                • GetTickCount.KERNEL32 ref: 1000215A
                                                                                                                • LeaveCriticalSection.KERNEL32(1002030C), ref: 10002199
                                                                                                                • EnterCriticalSection.KERNEL32(1002030C), ref: 100021AE
                                                                                                                • GetTickCount.KERNEL32 ref: 10002256
                                                                                                                • LeaveCriticalSection.KERNEL32(1002030C), ref: 10002295
                                                                                                                • EnterCriticalSection.KERNEL32(1002030C), ref: 100022AA
                                                                                                                • EnterCriticalSection.KERNEL32 ref: 1000239F
                                                                                                                • EnterCriticalSection.KERNEL32(?), ref: 100023FE
                                                                                                                • LeaveCriticalSection.KERNEL32(1002030C), ref: 10002498
                                                                                                                • EnterCriticalSection.KERNEL32(1002030C), ref: 100024AD
                                                                                                                • LeaveCriticalSection.KERNEL32(1002030C), ref: 10002563
                                                                                                                  • Part of subcall function 10014ED0: EnterCriticalSection.KERNEL32(10020324,?,?,?,?,?,?,?,?,?,1001536D), ref: 10014F3F
                                                                                                                  • Part of subcall function 10014ED0: WriteFile.KERNEL32(FFFFFFFF,?,00000008,00000000,?), ref: 10014F8F
                                                                                                                  • Part of subcall function 10014ED0: GetLastError.KERNEL32 ref: 10014F99
                                                                                                                  • Part of subcall function 10014ED0: LeaveCriticalSection.KERNEL32(10020324), ref: 10014FAB
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000023.00000002.2673509223.0000000010001000.00000020.00000001.01000000.00000028.sdmp, Offset: 10000000, based on PE: true
                                                                                                                • Associated: 00000023.00000002.2673483913.0000000010000000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                • Associated: 00000023.00000002.2673541932.0000000010019000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                • Associated: 00000023.00000002.2673575934.000000001001E000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                • Associated: 00000023.00000002.2673609450.0000000010022000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_35_2_10000000_nfregdrv.jbxd
                                                                                                                Similarity
                                                                                                                • API ID: CriticalSection$Enter$Leave$CountTick$ErrorFileLastWrite__aullrem
                                                                                                                • String ID:
                                                                                                                • API String ID: 2584342812-0
                                                                                                                • Opcode ID: af9e0746b45dabf02fd2421baf30e015d80efef54aadf8bda24db42c6145cc84
                                                                                                                • Instruction ID: 27e7611ef1cc4cd64037de96806a1b775dfd5a4704548cb2295c2b271f4c6af1
                                                                                                                • Opcode Fuzzy Hash: af9e0746b45dabf02fd2421baf30e015d80efef54aadf8bda24db42c6145cc84
                                                                                                                • Instruction Fuzzy Hash: F8F19A74604742EFE310CF64C984A4AB7F6FF48784F418929E9499BA15E330FD95CBA2
                                                                                                                Function 00401050 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 48windowCOMMON
                                                                                                                Download Yara Rule
                                                                                                                APIs
                                                                                                                  • Part of subcall function 00401000: CharNextA.USER32 ref: 0040102B
                                                                                                                  • Part of subcall function 00401000: CharNextA.USER32 ref: 00401032
                                                                                                                • MessageBoxA.USER32(00000000,Usage: nfregdrv.exe <driver_name> - register windows\system32\drivers\<driver_name>.sys nfregdrv.exe -u <driver_name> - unregister windows\system32\drivers\<driver_name>.sys,nfregdvr,00000000), ref: 004010AE
                                                                                                                • ?nf_registerDriver@nfapi@@YA?AW4_NF_STATUS@@PBD@Z.NFAPI(?), ref: 004010CA
                                                                                                                • ?nf_unRegisterDriver@nfapi@@YA?AW4_NF_STATUS@@PBD@Z.NFAPI(?), ref: 004010DB
                                                                                                                Strings
                                                                                                                • nfregdvr, xrefs: 004010A2
                                                                                                                • Usage: nfregdrv.exe <driver_name> - register windows\system32\drivers\<driver_name>.sys nfregdrv.exe -u <driver_name> - unregister windows\system32\drivers\<driver_name>.sys, xrefs: 004010A7
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000023.00000002.2671828313.0000000000401000.00000020.00000001.01000000.00000027.sdmp, Offset: 00400000, based on PE: true
                                                                                                                • Associated: 00000023.00000002.2671732944.0000000000400000.00000002.00000001.01000000.00000027.sdmpDownload File
                                                                                                                • Associated: 00000023.00000002.2671884603.0000000000408000.00000002.00000001.01000000.00000027.sdmpDownload File
                                                                                                                • Associated: 00000023.00000002.2671926254.000000000040A000.00000004.00000001.01000000.00000027.sdmpDownload File
                                                                                                                • Associated: 00000023.00000002.2672063353.000000000040C000.00000002.00000001.01000000.00000027.sdmpDownload File
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_35_2_400000_nfregdrv.jbxd
                                                                                                                Similarity
                                                                                                                • API ID: CharDriver@nfapi@@Next$?nf_register?nf_unMessageRegister
                                                                                                                • String ID: Usage: nfregdrv.exe <driver_name> - register windows\system32\drivers\<driver_name>.sys nfregdrv.exe -u <driver_name> - unregister windows\system32\drivers\<driver_name>.sys$nfregdvr
                                                                                                                • API String ID: 1889258244-2180452595
                                                                                                                • Opcode ID: 3a882d4fb6fe95bf0d5de4b4e3cf2f64ab34e96ef2f70e27ee227c43f8033b4f
                                                                                                                • Instruction ID: 1ab8e34958d480acc8493b27089cbdf5696b9cf7d697ab9778d1d713517b65dd
                                                                                                                • Opcode Fuzzy Hash: 3a882d4fb6fe95bf0d5de4b4e3cf2f64ab34e96ef2f70e27ee227c43f8033b4f
                                                                                                                • Instruction Fuzzy Hash: 8F01DE705082806AE70163746E057877A806F55755F08C87BF9D4B63E2E6B88898C7BF
                                                                                                                Function 10014000 Relevance: 7.5, APIs: 5, Instructions: 37COMMON
                                                                                                                Download Yara Rule
                                                                                                                APIs
                                                                                                                • EnterCriticalSection.KERNEL32 ref: 10014010
                                                                                                                • LeaveCriticalSection.KERNEL32(1002030C), ref: 10014025
                                                                                                                • DeviceIoControl.KERNEL32(FFFFFFFF,0022019C,00000000,00000000,00000000,00000004,00000000,00000000), ref: 10014049
                                                                                                                • LeaveCriticalSection.KERNEL32(1002030C), ref: 1001405F
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000023.00000002.2673509223.0000000010001000.00000020.00000001.01000000.00000028.sdmp, Offset: 10000000, based on PE: true
                                                                                                                • Associated: 00000023.00000002.2673483913.0000000010000000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                • Associated: 00000023.00000002.2673541932.0000000010019000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                • Associated: 00000023.00000002.2673575934.000000001001E000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                • Associated: 00000023.00000002.2673609450.0000000010022000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_35_2_10000000_nfregdrv.jbxd
                                                                                                                Similarity
                                                                                                                • API ID: CriticalSection$Leave$ControlDeviceEnter
                                                                                                                • String ID:
                                                                                                                • API String ID: 3744975357-0
                                                                                                                • Opcode ID: 4981ae034996778ee2c8bf16bcf631c7842ba69716a9c5caf53513e94cd4e299
                                                                                                                • Instruction ID: 194b0543918d9f7547c24edad603a73f0d8bc4c4cca9a48bf73c364b07b3f58e
                                                                                                                • Opcode Fuzzy Hash: 4981ae034996778ee2c8bf16bcf631c7842ba69716a9c5caf53513e94cd4e299
                                                                                                                • Instruction Fuzzy Hash: E8F09674A10310AFF701EB60ED89B8937A6EB98F12FC2C514F7098A1E1D7B5D95CC662
                                                                                                                Function 004017B5 Relevance: 33.4, APIs: 15, Strings: 4, Instructions: 156fileCOMMONLIBRARYCODE
                                                                                                                Download Yara Rule

                                                                                                                Control-flow Graph

                                                                                                                • Executed
                                                                                                                • Not Executed
                                                                                                                control_flow_graph 303 4017b5-4017bf 304 4017c1-4017c8 303->304 305 4017d0-4017d3 304->305 306 4017ca-4017ce 304->306 307 401950-401954 305->307 308 4017d9-4017e5 call 403850 305->308 306->304 306->305 311 4017eb-4017f5 call 403850 308->311 312 40191c-401928 GetStdHandle 308->312 319 401804-40180a 311->319 320 4017f7-4017fe 311->320 313 40192a-40192d 312->313 314 40194f 312->314 313->314 316 40192f-401949 call 403760 WriteFile 313->316 314->307 316->314 319->314 322 401810-40182b call 4037eb 319->322 320->312 320->319 325 40183a-401856 GetModuleFileNameA 322->325 326 40182d-401837 call 402d4d 322->326 328 401858-40186d call 4037eb 325->328 329 40187e-401889 call 403760 325->329 326->325 328->329 335 40186f-40187b call 402d4d 328->335 336 4018c3 329->336 337 40188b-4018b0 call 403760 call 4036a2 329->337 335->329 338 4018c5-4018d6 call 403631 336->338 337->336 349 4018b2-4018c1 call 402d4d 337->349 347 4018e5-4018f8 call 403631 338->347 348 4018d8-4018e2 call 402d4d 338->348 355 401907-40191a call 403474 347->355 356 4018fa-401904 call 402d4d 347->356 348->347 349->338 355->314 356->355
                                                                                                                APIs
                                                                                                                • _strcpy_s.LIBCMT ref: 00401821
                                                                                                                • __invoke_watson.LIBCMT ref: 00401832
                                                                                                                • GetModuleFileNameA.KERNEL32(00000000,0040B059,00000104), ref: 0040184E
                                                                                                                • _strcpy_s.LIBCMT ref: 00401863
                                                                                                                • __invoke_watson.LIBCMT ref: 00401876
                                                                                                                • _strlen.LIBCMT ref: 0040187F
                                                                                                                • _strlen.LIBCMT ref: 0040188C
                                                                                                                • __invoke_watson.LIBCMT ref: 004018B9
                                                                                                                • _strcat_s.LIBCMT ref: 004018CC
                                                                                                                • __invoke_watson.LIBCMT ref: 004018DD
                                                                                                                • _strcat_s.LIBCMT ref: 004018EE
                                                                                                                • __invoke_watson.LIBCMT ref: 004018FF
                                                                                                                • GetStdHandle.KERNEL32(000000F4,?,?,00000000,77355E70,00000003,00401981,000000FC,00405D85,00000001,00000000,00000000,?,004040D4,?,00000001), ref: 0040191E
                                                                                                                • _strlen.LIBCMT ref: 0040193F
                                                                                                                • WriteFile.KERNEL32(00000000,00000000,00000000,?,00000000,?,004040D4,?,00000001,?,00402C9C,00000018,004094A0,0000000C,00402D2B,?), ref: 00401949
                                                                                                                Strings
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000023.00000002.2671828313.0000000000401000.00000020.00000001.01000000.00000027.sdmp, Offset: 00400000, based on PE: true
                                                                                                                • Associated: 00000023.00000002.2671732944.0000000000400000.00000002.00000001.01000000.00000027.sdmpDownload File
                                                                                                                • Associated: 00000023.00000002.2671884603.0000000000408000.00000002.00000001.01000000.00000027.sdmpDownload File
                                                                                                                • Associated: 00000023.00000002.2671926254.000000000040A000.00000004.00000001.01000000.00000027.sdmpDownload File
                                                                                                                • Associated: 00000023.00000002.2672063353.000000000040C000.00000002.00000001.01000000.00000027.sdmpDownload File
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_35_2_400000_nfregdrv.jbxd
                                                                                                                Similarity
                                                                                                                • API ID: __invoke_watson$_strlen$File_strcat_s_strcpy_s$HandleModuleNameWrite
                                                                                                                • String ID: ...$<program name unknown>$Microsoft Visual C++ Runtime Library$Runtime Error!Program:
                                                                                                                • API String ID: 1879448924-4022980321
                                                                                                                • Opcode ID: 38520d41a68f396a59cc94f311c6a7ce392be311100e9e9c31ac4f97fc74b26a
                                                                                                                • Instruction ID: ac205ba077d332f24294b0c45a0e422cb4ceea3e0f9d8061dc6338a319882752
                                                                                                                • Opcode Fuzzy Hash: 38520d41a68f396a59cc94f311c6a7ce392be311100e9e9c31ac4f97fc74b26a
                                                                                                                • Instruction Fuzzy Hash: 043126E26402057AE6213A265E4AF2F3A4C9B01755F14403BFD45B22F3FA7E9A1181FE
                                                                                                                Function 0040267F Relevance: 29.9, APIs: 12, Strings: 5, Instructions: 109libraryloadermemoryCOMMON
                                                                                                                Download Yara Rule

                                                                                                                Control-flow Graph

                                                                                                                • Executed
                                                                                                                • Not Executed
                                                                                                                control_flow_graph 421 40267f-40268f GetModuleHandleA 422 402691-402699 call 4023d3 421->422 423 40269a-4026e2 GetProcAddress * 4 421->423 425 4026e4-4026eb 423->425 426 4026fa-402719 423->426 425->426 428 4026ed-4026f4 425->428 429 40271e-40272c TlsAlloc 426->429 428->426 430 4026f6-4026f8 428->430 431 402732-40273d TlsSetValue 429->431 432 4027fe 429->432 430->426 430->429 431->432 433 402743-402792 call 401769 call 4022b3 * 4 call 402b9c 431->433 434 402800-402802 432->434 447 402794-4027af call 40232a 433->447 448 4027f9 call 4023d3 433->448 447->448 453 4027b1-4027c3 call 404107 447->453 448->432 453->448 456 4027c5-4027dc call 40232a 453->456 456->448 460 4027de-4027f7 call 402410 GetCurrentThreadId 456->460 460->434
                                                                                                                APIs
                                                                                                                • GetModuleHandleA.KERNEL32(KERNEL32.DLL,?,00401248), ref: 00402685
                                                                                                                • __mtterm.LIBCMT ref: 00402691
                                                                                                                  • Part of subcall function 004023D3: TlsFree.KERNEL32(00000003,004027FE), ref: 004023FE
                                                                                                                  • Part of subcall function 004023D3: DeleteCriticalSection.KERNEL32(00000000,00000000,7622DFB0,00000001,004027FE), ref: 00402C00
                                                                                                                  • Part of subcall function 004023D3: DeleteCriticalSection.KERNEL32(00000003,7622DFB0,00000001,004027FE), ref: 00402C2A
                                                                                                                • GetProcAddress.KERNEL32(00000000,FlsAlloc), ref: 004026A7
                                                                                                                • GetProcAddress.KERNEL32(00000000,FlsGetValue), ref: 004026B4
                                                                                                                • GetProcAddress.KERNEL32(00000000,FlsSetValue), ref: 004026C1
                                                                                                                • GetProcAddress.KERNEL32(00000000,FlsFree), ref: 004026CE
                                                                                                                • TlsAlloc.KERNEL32 ref: 0040271E
                                                                                                                • TlsSetValue.KERNEL32(00000000), ref: 00402739
                                                                                                                • __init_pointers.LIBCMT ref: 00402743
                                                                                                                • __calloc_crt.LIBCMT ref: 004027B8
                                                                                                                • GetCurrentThreadId.KERNEL32 ref: 004027E8
                                                                                                                Strings
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000023.00000002.2671828313.0000000000401000.00000020.00000001.01000000.00000027.sdmp, Offset: 00400000, based on PE: true
                                                                                                                • Associated: 00000023.00000002.2671732944.0000000000400000.00000002.00000001.01000000.00000027.sdmpDownload File
                                                                                                                • Associated: 00000023.00000002.2671884603.0000000000408000.00000002.00000001.01000000.00000027.sdmpDownload File
                                                                                                                • Associated: 00000023.00000002.2671926254.000000000040A000.00000004.00000001.01000000.00000027.sdmpDownload File
                                                                                                                • Associated: 00000023.00000002.2672063353.000000000040C000.00000002.00000001.01000000.00000027.sdmpDownload File
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_35_2_400000_nfregdrv.jbxd
                                                                                                                Similarity
                                                                                                                • API ID: AddressProc$CriticalDeleteSection$AllocCurrentFreeHandleModuleThreadValue__calloc_crt__init_pointers__mtterm
                                                                                                                • String ID: FlsAlloc$FlsFree$FlsGetValue$FlsSetValue$KERNEL32.DLL
                                                                                                                • API String ID: 2125014093-3819984048
                                                                                                                • Opcode ID: 566b6117ed883b32ce1da04161b31b8634341426bd229c3b9e021c861b04e7bb
                                                                                                                • Instruction ID: cf69b49cc4cf955eeb84bbbee0c69ed19c09a43a9505152bb4945c0e988a6b5c
                                                                                                                • Opcode Fuzzy Hash: 566b6117ed883b32ce1da04161b31b8634341426bd229c3b9e021c861b04e7bb
                                                                                                                • Instruction Fuzzy Hash: EF313931900311DADB51AB75AF49A063BA4EB44354B10053FE994B72F2DFB98540DF9E
                                                                                                                Function 10013020 Relevance: 22.8, APIs: 6, Strings: 7, Instructions: 88registryCOMMON
                                                                                                                Download Yara Rule
                                                                                                                APIs
                                                                                                                • __snprintf.LIBCMT ref: 10013094
                                                                                                                • RegOpenKeyExA.ADVAPI32(80000002,?,00000000,00000003,?,?,?,?,?), ref: 100130AF
                                                                                                                • RegSetValueExA.ADVAPI32(?,Group,00000000,00000001,?,00000005), ref: 100130F6
                                                                                                                • RegSetValueExA.ADVAPI32(?,DependOnService,00000000,00000007,?,00000007), ref: 1001310D
                                                                                                                • RegCloseKey.ADVAPI32(?), ref: 10013133
                                                                                                                Strings
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000023.00000002.2673509223.0000000010001000.00000020.00000001.01000000.00000028.sdmp, Offset: 10000000, based on PE: true
                                                                                                                • Associated: 00000023.00000002.2673483913.0000000010000000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                • Associated: 00000023.00000002.2673541932.0000000010019000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                • Associated: 00000023.00000002.2673575934.000000001001E000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                • Associated: 00000023.00000002.2673609450.0000000010022000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_35_2_10000000_nfregdrv.jbxd
                                                                                                                Similarity
                                                                                                                • API ID: Value$CloseOpen__snprintf
                                                                                                                • String ID: DependOnService$Group$Group$NDIS$PNP_TDI$SYSTEM\CurrentControlSet\Services\%s$tcpip
                                                                                                                • API String ID: 1654562893-4206996638
                                                                                                                • Opcode ID: 8e36c738326b6755c6e6de9151109be2b92cdf69e4b2cd075e3ef94430a67263
                                                                                                                • Instruction ID: f39133bfa4f10865251ae0e01663f88c1eeb0859d6cfe85fe8bdc8d9a42c57b8
                                                                                                                • Opcode Fuzzy Hash: 8e36c738326b6755c6e6de9151109be2b92cdf69e4b2cd075e3ef94430a67263
                                                                                                                • Instruction Fuzzy Hash: AF316675618350AFE715CB64CC91FAB77E5AB8D710F40C80CF68897290EA74E984CBD2
                                                                                                                Function 00403474 Relevance: 21.2, APIs: 8, Strings: 4, Instructions: 164libraryloaderCOMMONLIBRARYCODE
                                                                                                                Download Yara Rule
                                                                                                                APIs
                                                                                                                • LoadLibraryA.KERNEL32(USER32.DLL,00000000,00000000,00000314,?,?,?,0040B040,00401917,0040B040,Microsoft Visual C++ Runtime Library,00012010), ref: 004034A1
                                                                                                                • GetProcAddress.KERNEL32(00000000,MessageBoxA), ref: 004034BD
                                                                                                                  • Part of subcall function 004022B3: TlsGetValue.KERNEL32(00000000,00402328,00000000,00403482,00000000,00000000,00000314,?,?,?,0040B040,00401917,0040B040,Microsoft Visual C++ Runtime Library,00012010), ref: 004022C0
                                                                                                                  • Part of subcall function 004022B3: TlsGetValue.KERNEL32(00000006,?,?,?,0040B040,00401917,0040B040,Microsoft Visual C++ Runtime Library,00012010), ref: 004022D7
                                                                                                                • GetProcAddress.KERNEL32(00000000,00000000), ref: 004034DA
                                                                                                                  • Part of subcall function 004022B3: GetModuleHandleA.KERNEL32(KERNEL32.DLL,?,?,?,0040B040,00401917,0040B040,Microsoft Visual C++ Runtime Library,00012010), ref: 004022EC
                                                                                                                  • Part of subcall function 004022B3: GetProcAddress.KERNEL32(00000000,EncodePointer), ref: 00402307
                                                                                                                • GetProcAddress.KERNEL32(00000000,00000000), ref: 004034EF
                                                                                                                • __invoke_watson.LIBCMT ref: 00403510
                                                                                                                  • Part of subcall function 00402D4D: IsDebuggerPresent.KERNEL32(?,?,00000000), ref: 00402DF7
                                                                                                                  • Part of subcall function 00402D4D: SetUnhandledExceptionFilter.KERNEL32(00000000,?,?,00000000), ref: 00402E01
                                                                                                                  • Part of subcall function 00402D4D: UnhandledExceptionFilter.KERNEL32(0040B040,?,?,00000000), ref: 00402E0B
                                                                                                                  • Part of subcall function 00402D4D: GetCurrentProcess.KERNEL32(C000000D,?,?,00000000), ref: 00402E26
                                                                                                                  • Part of subcall function 00402D4D: TerminateProcess.KERNEL32(00000000,?,?,00000000), ref: 00402E2D
                                                                                                                  • Part of subcall function 0040232A: TlsGetValue.KERNEL32(00000000,004023BF,?,004024E4,?,?,0040199A), ref: 00402337
                                                                                                                  • Part of subcall function 0040232A: TlsGetValue.KERNEL32(00000006,?,004024E4,?,?,0040199A), ref: 0040234E
                                                                                                                  • Part of subcall function 0040232A: GetModuleHandleA.KERNEL32(KERNEL32.DLL,?,004024E4,?,?,0040199A), ref: 00402363
                                                                                                                  • Part of subcall function 0040232A: GetProcAddress.KERNEL32(00000000,DecodePointer), ref: 0040237E
                                                                                                                • GetProcAddress.KERNEL32(00000000,GetUserObjectInformationA), ref: 00403524
                                                                                                                • GetProcAddress.KERNEL32(00000000,GetProcessWindowStation), ref: 0040353C
                                                                                                                • __invoke_watson.LIBCMT ref: 004035AF
                                                                                                                Strings
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000023.00000002.2671828313.0000000000401000.00000020.00000001.01000000.00000027.sdmp, Offset: 00400000, based on PE: true
                                                                                                                • Associated: 00000023.00000002.2671732944.0000000000400000.00000002.00000001.01000000.00000027.sdmpDownload File
                                                                                                                • Associated: 00000023.00000002.2671884603.0000000000408000.00000002.00000001.01000000.00000027.sdmpDownload File
                                                                                                                • Associated: 00000023.00000002.2671926254.000000000040A000.00000004.00000001.01000000.00000027.sdmpDownload File
                                                                                                                • Associated: 00000023.00000002.2672063353.000000000040C000.00000002.00000001.01000000.00000027.sdmpDownload File
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_35_2_400000_nfregdrv.jbxd
                                                                                                                Similarity
                                                                                                                • API ID: AddressProc$Value$ExceptionFilterHandleModuleProcessUnhandled__invoke_watson$CurrentDebuggerLibraryLoadPresentTerminate
                                                                                                                • String ID: GetProcessWindowStation$GetUserObjectInformationA$MessageBoxA$USER32.DLL
                                                                                                                • API String ID: 2691309996-1046234306
                                                                                                                • Opcode ID: f1db5f22bdf6dbb55a5fef3c5404ea4e20a60e7af2fc674b508acf6c650a639d
                                                                                                                • Instruction ID: 13767e751e4e8118919b7ef88e5ef330d54a0fa0e132c7187f46cb55eadbc1d1
                                                                                                                • Opcode Fuzzy Hash: f1db5f22bdf6dbb55a5fef3c5404ea4e20a60e7af2fc674b508acf6c650a639d
                                                                                                                • Instruction Fuzzy Hash: FC416271D04205BACF21AFE59E8596F7FACEB44356B14487FE401F22D0DBBD8A408A9D
                                                                                                                Function 00402410 Relevance: 15.8, APIs: 6, Strings: 3, Instructions: 49libraryloaderCOMMONLIBRARYCODE
                                                                                                                Download Yara Rule
                                                                                                                APIs
                                                                                                                • GetModuleHandleA.KERNEL32(KERNEL32.DLL,00409438,0000000C,00402521,00000000,00000000,?,?,0040199A), ref: 00402421
                                                                                                                • GetProcAddress.KERNEL32(?,EncodePointer), ref: 00402455
                                                                                                                • GetProcAddress.KERNEL32(?,DecodePointer), ref: 00402465
                                                                                                                • InterlockedIncrement.KERNEL32(0040A460), ref: 00402487
                                                                                                                • __lock.LIBCMT ref: 0040248F
                                                                                                                • ___addlocaleref.LIBCMT ref: 004024AE
                                                                                                                Strings
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000023.00000002.2671828313.0000000000401000.00000020.00000001.01000000.00000027.sdmp, Offset: 00400000, based on PE: true
                                                                                                                • Associated: 00000023.00000002.2671732944.0000000000400000.00000002.00000001.01000000.00000027.sdmpDownload File
                                                                                                                • Associated: 00000023.00000002.2671884603.0000000000408000.00000002.00000001.01000000.00000027.sdmpDownload File
                                                                                                                • Associated: 00000023.00000002.2671926254.000000000040A000.00000004.00000001.01000000.00000027.sdmpDownload File
                                                                                                                • Associated: 00000023.00000002.2672063353.000000000040C000.00000002.00000001.01000000.00000027.sdmpDownload File
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_35_2_400000_nfregdrv.jbxd
                                                                                                                Similarity
                                                                                                                • API ID: AddressProc$HandleIncrementInterlockedModule___addlocaleref__lock
                                                                                                                • String ID: DecodePointer$EncodePointer$KERNEL32.DLL
                                                                                                                • API String ID: 1036688887-2843748187
                                                                                                                • Opcode ID: 492f236ed60c7165788bb238f70ef5b424b799d510fd4f5d693c5339c7311626
                                                                                                                • Instruction ID: c1e121c7a9f45585e2cf3b5064cbb5a882fb755c8da4f7f00742ea9dc2ffa3f8
                                                                                                                • Opcode Fuzzy Hash: 492f236ed60c7165788bb238f70ef5b424b799d510fd4f5d693c5339c7311626
                                                                                                                • Instruction Fuzzy Hash: C41182719407019ED710AF75DA49B5ABBE4EF44314F10853EE495B32D1CBBC9900CF19
                                                                                                                Function 10003970 Relevance: 12.3, APIs: 8, Instructions: 344COMMON
                                                                                                                Download Yara Rule
                                                                                                                APIs
                                                                                                                • EnterCriticalSection.KERNEL32 ref: 100039B6
                                                                                                                • EnterCriticalSection.KERNEL32(10020168), ref: 10003C89
                                                                                                                • LeaveCriticalSection.KERNEL32(10020168), ref: 10003CBA
                                                                                                                • _malloc.LIBCMT ref: 10003CBE
                                                                                                                • LeaveCriticalSection.KERNEL32(?), ref: 10003CDD
                                                                                                                • LeaveCriticalSection.KERNEL32(10020168), ref: 10003D10
                                                                                                                • LeaveCriticalSection.KERNEL32(?), ref: 10003D80
                                                                                                                • LeaveCriticalSection.KERNEL32(1001AF8C), ref: 10003DA0
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000023.00000002.2673509223.0000000010001000.00000020.00000001.01000000.00000028.sdmp, Offset: 10000000, based on PE: true
                                                                                                                • Associated: 00000023.00000002.2673483913.0000000010000000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                • Associated: 00000023.00000002.2673541932.0000000010019000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                • Associated: 00000023.00000002.2673575934.000000001001E000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                • Associated: 00000023.00000002.2673609450.0000000010022000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_35_2_10000000_nfregdrv.jbxd
                                                                                                                Similarity
                                                                                                                • API ID: CriticalSection$Leave$Enter$_malloc
                                                                                                                • String ID:
                                                                                                                • API String ID: 2624469294-0
                                                                                                                • Opcode ID: 73d3a381d48c90c82b24558e07d01c406c18051549b067fe898d807a957dde11
                                                                                                                • Instruction ID: cb4e14372f68c81d32fb7b051c2ec7f8ea7fe710ba1d4691e8c8f5f753e74d5d
                                                                                                                • Opcode Fuzzy Hash: 73d3a381d48c90c82b24558e07d01c406c18051549b067fe898d807a957dde11
                                                                                                                • Instruction Fuzzy Hash: 84D147755043459FE721EF24C98095AB7E9FF88790F02C91DE8999B249DB31FA00CFA2
                                                                                                                Function 10015830 Relevance: 10.6, APIs: 7, Instructions: 95COMMON
                                                                                                                Download Yara Rule
                                                                                                                APIs
                                                                                                                • EnterCriticalSection.KERNEL32(1002030C), ref: 10015845
                                                                                                                • LeaveCriticalSection.KERNEL32(1002030C), ref: 10015855
                                                                                                                • LeaveCriticalSection.KERNEL32(1002030C), ref: 1001586D
                                                                                                                • EnterCriticalSection.KERNEL32(10020168), ref: 10015874
                                                                                                                • LeaveCriticalSection.KERNEL32(10020168), ref: 100158A4
                                                                                                                • _malloc.LIBCMT ref: 100158A8
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000023.00000002.2673509223.0000000010001000.00000020.00000001.01000000.00000028.sdmp, Offset: 10000000, based on PE: true
                                                                                                                • Associated: 00000023.00000002.2673483913.0000000010000000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                • Associated: 00000023.00000002.2673541932.0000000010019000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                • Associated: 00000023.00000002.2673575934.000000001001E000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                • Associated: 00000023.00000002.2673609450.0000000010022000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_35_2_10000000_nfregdrv.jbxd
                                                                                                                Similarity
                                                                                                                • API ID: CriticalSection$Leave$Enter$_malloc
                                                                                                                • String ID:
                                                                                                                • API String ID: 2624469294-0
                                                                                                                • Opcode ID: af66a572ff308366c586223bea1b859f2b64d82aec888bcbbc6575e257e25f9f
                                                                                                                • Instruction ID: b4838676840f3e74a045a70f2e4b7778d9ead1c68319ad0b4665687bbdc5929c
                                                                                                                • Opcode Fuzzy Hash: af66a572ff308366c586223bea1b859f2b64d82aec888bcbbc6575e257e25f9f
                                                                                                                • Instruction Fuzzy Hash: EC31E532A002148FD711DF2CDC81969B3D6FF84261B59866AE828DF291EB32DC548BD1
                                                                                                                Function 004022B3 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 36libraryloaderCOMMONLIBRARYCODE
                                                                                                                Download Yara Rule
                                                                                                                APIs
                                                                                                                • TlsGetValue.KERNEL32(00000000,00402328,00000000,00403482,00000000,00000000,00000314,?,?,?,0040B040,00401917,0040B040,Microsoft Visual C++ Runtime Library,00012010), ref: 004022C0
                                                                                                                • TlsGetValue.KERNEL32(00000006,?,?,?,0040B040,00401917,0040B040,Microsoft Visual C++ Runtime Library,00012010), ref: 004022D7
                                                                                                                • GetModuleHandleA.KERNEL32(KERNEL32.DLL,?,?,?,0040B040,00401917,0040B040,Microsoft Visual C++ Runtime Library,00012010), ref: 004022EC
                                                                                                                • GetProcAddress.KERNEL32(00000000,EncodePointer), ref: 00402307
                                                                                                                Strings
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000023.00000002.2671828313.0000000000401000.00000020.00000001.01000000.00000027.sdmp, Offset: 00400000, based on PE: true
                                                                                                                • Associated: 00000023.00000002.2671732944.0000000000400000.00000002.00000001.01000000.00000027.sdmpDownload File
                                                                                                                • Associated: 00000023.00000002.2671884603.0000000000408000.00000002.00000001.01000000.00000027.sdmpDownload File
                                                                                                                • Associated: 00000023.00000002.2671926254.000000000040A000.00000004.00000001.01000000.00000027.sdmpDownload File
                                                                                                                • Associated: 00000023.00000002.2672063353.000000000040C000.00000002.00000001.01000000.00000027.sdmpDownload File
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_35_2_400000_nfregdrv.jbxd
                                                                                                                Similarity
                                                                                                                • API ID: Value$AddressHandleModuleProc
                                                                                                                • String ID: EncodePointer$KERNEL32.DLL
                                                                                                                • API String ID: 1929421221-3682587211
                                                                                                                • Opcode ID: 1a385f102c7f14214112f7259b1974e6b0907a5b8e91fbf1077ec2ee8662ada9
                                                                                                                • Instruction ID: 50336ba6c918c6c116f5e3fcbab542df5951bbe2d872b07961eb55563d71e960
                                                                                                                • Opcode Fuzzy Hash: 1a385f102c7f14214112f7259b1974e6b0907a5b8e91fbf1077ec2ee8662ada9
                                                                                                                • Instruction Fuzzy Hash: BFF06D301056129BDA529B74EF08A6B7BA5AF40394B15047AB854F62F4CF78CC11DA6D
                                                                                                                Function 0040232A Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 36libraryloaderCOMMONLIBRARYCODE
                                                                                                                Download Yara Rule
                                                                                                                APIs
                                                                                                                • TlsGetValue.KERNEL32(00000000,004023BF,?,004024E4,?,?,0040199A), ref: 00402337
                                                                                                                • TlsGetValue.KERNEL32(00000006,?,004024E4,?,?,0040199A), ref: 0040234E
                                                                                                                • GetModuleHandleA.KERNEL32(KERNEL32.DLL,?,004024E4,?,?,0040199A), ref: 00402363
                                                                                                                • GetProcAddress.KERNEL32(00000000,DecodePointer), ref: 0040237E
                                                                                                                Strings
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000023.00000002.2671828313.0000000000401000.00000020.00000001.01000000.00000027.sdmp, Offset: 00400000, based on PE: true
                                                                                                                • Associated: 00000023.00000002.2671732944.0000000000400000.00000002.00000001.01000000.00000027.sdmpDownload File
                                                                                                                • Associated: 00000023.00000002.2671884603.0000000000408000.00000002.00000001.01000000.00000027.sdmpDownload File
                                                                                                                • Associated: 00000023.00000002.2671926254.000000000040A000.00000004.00000001.01000000.00000027.sdmpDownload File
                                                                                                                • Associated: 00000023.00000002.2672063353.000000000040C000.00000002.00000001.01000000.00000027.sdmpDownload File
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_35_2_400000_nfregdrv.jbxd
                                                                                                                Similarity
                                                                                                                • API ID: Value$AddressHandleModuleProc
                                                                                                                • String ID: DecodePointer$KERNEL32.DLL
                                                                                                                • API String ID: 1929421221-629428536
                                                                                                                • Opcode ID: b796f7a9d0800bb9e160982425eb8aa8e27173a6ee7dc456a018aa060cd778d7
                                                                                                                • Instruction ID: b3a0eb18012e6aadf2811430fba97e87ad444e4cba862865431688a9bf4f90a9
                                                                                                                • Opcode Fuzzy Hash: b796f7a9d0800bb9e160982425eb8aa8e27173a6ee7dc456a018aa060cd778d7
                                                                                                                • Instruction Fuzzy Hash: A1F01230501623ABD712A734DF08A5B3AA59F41390715413ABC58F62F4DB7CCD12865D
                                                                                                                Function 1000A8A7 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 36libraryloaderCOMMONLIBRARYCODE
                                                                                                                Download Yara Rule
                                                                                                                APIs
                                                                                                                • TlsGetValue.KERNEL32(00000000,1000A91C,00000000,1000EA20,00000000,00000000,00000314,?,?,?,1001F3B0,1000A694,1001F3B0,Microsoft Visual C++ Runtime Library,00012010), ref: 1000A8B4
                                                                                                                • TlsGetValue.KERNEL32(00000002,?,?,?,1001F3B0,1000A694,1001F3B0,Microsoft Visual C++ Runtime Library,00012010), ref: 1000A8CB
                                                                                                                • GetModuleHandleA.KERNEL32(KERNEL32.DLL,?,?,?,1001F3B0,1000A694,1001F3B0,Microsoft Visual C++ Runtime Library,00012010), ref: 1000A8E0
                                                                                                                • GetProcAddress.KERNEL32(00000000,EncodePointer), ref: 1000A8FB
                                                                                                                Strings
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000023.00000002.2673509223.0000000010001000.00000020.00000001.01000000.00000028.sdmp, Offset: 10000000, based on PE: true
                                                                                                                • Associated: 00000023.00000002.2673483913.0000000010000000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                • Associated: 00000023.00000002.2673541932.0000000010019000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                • Associated: 00000023.00000002.2673575934.000000001001E000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                • Associated: 00000023.00000002.2673609450.0000000010022000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_35_2_10000000_nfregdrv.jbxd
                                                                                                                Similarity
                                                                                                                • API ID: Value$AddressHandleModuleProc
                                                                                                                • String ID: EncodePointer$KERNEL32.DLL
                                                                                                                • API String ID: 1929421221-3682587211
                                                                                                                • Opcode ID: 698cc03a02ed437f9e78c1477e8a38eecfbfb8aad5433eb0b7b92186c3789519
                                                                                                                • Instruction ID: caffd8b91c38bffb5cca897b74d77eec42bfe04cae3721fbb3b20170df584618
                                                                                                                • Opcode Fuzzy Hash: 698cc03a02ed437f9e78c1477e8a38eecfbfb8aad5433eb0b7b92186c3789519
                                                                                                                • Instruction Fuzzy Hash: D9F01D30A05626AFFA51DB24CC8895A3BD8DF467D07028624F854E71B8DF30CED29B51
                                                                                                                Function 1000A91E Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 36libraryloaderCOMMONLIBRARYCODE
                                                                                                                Download Yara Rule
                                                                                                                APIs
                                                                                                                • TlsGetValue.KERNEL32(?,1000ACF2,00000000,00000000,10008BC3,00000000,?,?,00000001,?,?,10008C27,00000001,?,?,1001B608), ref: 1000A92B
                                                                                                                • TlsGetValue.KERNEL32(00000002,?,1000ACF2,00000000,00000000,10008BC3,00000000,?,?,00000001,?,?,10008C27,00000001), ref: 1000A942
                                                                                                                • GetModuleHandleA.KERNEL32(KERNEL32.DLL,?,1000ACF2,00000000,00000000,10008BC3,00000000,?,?,00000001,?,?,10008C27,00000001), ref: 1000A957
                                                                                                                • GetProcAddress.KERNEL32(00000000,DecodePointer), ref: 1000A972
                                                                                                                Strings
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000023.00000002.2673509223.0000000010001000.00000020.00000001.01000000.00000028.sdmp, Offset: 10000000, based on PE: true
                                                                                                                • Associated: 00000023.00000002.2673483913.0000000010000000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                • Associated: 00000023.00000002.2673541932.0000000010019000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                • Associated: 00000023.00000002.2673575934.000000001001E000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                • Associated: 00000023.00000002.2673609450.0000000010022000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_35_2_10000000_nfregdrv.jbxd
                                                                                                                Similarity
                                                                                                                • API ID: Value$AddressHandleModuleProc
                                                                                                                • String ID: DecodePointer$KERNEL32.DLL
                                                                                                                • API String ID: 1929421221-629428536
                                                                                                                • Opcode ID: 849bf8aa20e695c811e63e4f389fbd3f38ad5f5727a41dc013945db67583cb91
                                                                                                                • Instruction ID: bd257daf5de9dee36b7a7df8f8d7f9ef99228c3852669747f2885a7cf79806d7
                                                                                                                • Opcode Fuzzy Hash: 849bf8aa20e695c811e63e4f389fbd3f38ad5f5727a41dc013945db67583cb91
                                                                                                                • Instruction Fuzzy Hash: 9FF0F930A056229EEA52DB248C8899A7BD8EF463D07028224F968D7168DB30CDD18A51
                                                                                                                Function 10001818 Relevance: 10.2, APIs: 8, Instructions: 231COMMON
                                                                                                                Download Yara Rule
                                                                                                                APIs
                                                                                                                • LeaveCriticalSection.KERNEL32(1002030C), ref: 100018A4
                                                                                                                • LeaveCriticalSection.KERNEL32(1002030C), ref: 100018E0
                                                                                                                • EnterCriticalSection.KERNEL32(1002030C), ref: 10001916
                                                                                                                • LeaveCriticalSection.KERNEL32(1002030C), ref: 100019BE
                                                                                                                • LeaveCriticalSection.KERNEL32(1002030C), ref: 10001A02
                                                                                                                • EnterCriticalSection.KERNEL32(1002030C), ref: 10001A3C
                                                                                                                • EnterCriticalSection.KERNEL32(?), ref: 10001AA3
                                                                                                                • EnterCriticalSection.KERNEL32(?), ref: 10001AF7
                                                                                                                • EnterCriticalSection.KERNEL32(?), ref: 10001B76
                                                                                                                • LeaveCriticalSection.KERNEL32(1002030C), ref: 10002045
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000023.00000002.2673509223.0000000010001000.00000020.00000001.01000000.00000028.sdmp, Offset: 10000000, based on PE: true
                                                                                                                • Associated: 00000023.00000002.2673483913.0000000010000000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                • Associated: 00000023.00000002.2673541932.0000000010019000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                • Associated: 00000023.00000002.2673575934.000000001001E000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                • Associated: 00000023.00000002.2673609450.0000000010022000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_35_2_10000000_nfregdrv.jbxd
                                                                                                                Similarity
                                                                                                                • API ID: CriticalSection$EnterLeave
                                                                                                                • String ID:
                                                                                                                • API String ID: 3168844106-0
                                                                                                                • Opcode ID: 1148cbf5bdb9481604341125c06b22783845d375c7f4a15b8700bf0034355e6e
                                                                                                                • Instruction ID: 1c7db7b73577996e6f6b7cc1b13f752c77784736a4bb66c20c39e3569af504b5
                                                                                                                • Opcode Fuzzy Hash: 1148cbf5bdb9481604341125c06b22783845d375c7f4a15b8700bf0034355e6e
                                                                                                                • Instruction Fuzzy Hash: 3891D370A04384CFE710CF68C880B9AB7E6FF89384F45855DF8858B256D775E985CB62
                                                                                                                Function 10017880 Relevance: 9.1, APIs: 6, Instructions: 119COMMON
                                                                                                                Download Yara Rule
                                                                                                                APIs
                                                                                                                • EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,10018530,000000FF), ref: 100178C1
                                                                                                                • LeaveCriticalSection.KERNEL32(1002030C,?,?,?,?,?,?,?,?,?,?,?,?,10018530,000000FF), ref: 100178DD
                                                                                                                • LeaveCriticalSection.KERNEL32(1002030C), ref: 10017906
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000023.00000002.2673509223.0000000010001000.00000020.00000001.01000000.00000028.sdmp, Offset: 10000000, based on PE: true
                                                                                                                • Associated: 00000023.00000002.2673483913.0000000010000000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                • Associated: 00000023.00000002.2673541932.0000000010019000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                • Associated: 00000023.00000002.2673575934.000000001001E000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                • Associated: 00000023.00000002.2673609450.0000000010022000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_35_2_10000000_nfregdrv.jbxd
                                                                                                                Similarity
                                                                                                                • API ID: CriticalSection$Leave$Enter
                                                                                                                • String ID:
                                                                                                                • API String ID: 2978645861-0
                                                                                                                • Opcode ID: 4fadeff10b6c9a286b6e83259b0211dd6e584e032f721b146db71c1fbee9745d
                                                                                                                • Instruction ID: 744bdcced945026e525a1d70fd2b130064bd5c13945d0ecf707bb38ae523f875
                                                                                                                • Opcode Fuzzy Hash: 4fadeff10b6c9a286b6e83259b0211dd6e584e032f721b146db71c1fbee9745d
                                                                                                                • Instruction Fuzzy Hash: 9141BF766083488FD700CF68EC8175AB7E9FB48764F10862AFD598B391DB35EA448A91
                                                                                                                Function 100148A0 Relevance: 9.1, APIs: 6, Instructions: 71COMMON
                                                                                                                Download Yara Rule
                                                                                                                APIs
                                                                                                                • EnterCriticalSection.KERNEL32(1002030C,?,?,00000001,?,10016ABE,?,?,-00000067,?,?,?,7734FFB0,00000000), ref: 100148A9
                                                                                                                • LeaveCriticalSection.KERNEL32(1002030C,?,10016ABE,?,?,-00000067,?,?,?,7734FFB0,00000000), ref: 100148BD
                                                                                                                • _memset.LIBCMT ref: 100148E2
                                                                                                                • DeviceIoControl.KERNEL32(FFFFFFFF,00220194,00000000,0000002C,00000000,0000002C,?,00000000), ref: 10014917
                                                                                                                • LeaveCriticalSection.KERNEL32(1002030C), ref: 10014942
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000023.00000002.2673509223.0000000010001000.00000020.00000001.01000000.00000028.sdmp, Offset: 10000000, based on PE: true
                                                                                                                • Associated: 00000023.00000002.2673483913.0000000010000000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                • Associated: 00000023.00000002.2673541932.0000000010019000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                • Associated: 00000023.00000002.2673575934.000000001001E000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                • Associated: 00000023.00000002.2673609450.0000000010022000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_35_2_10000000_nfregdrv.jbxd
                                                                                                                Similarity
                                                                                                                • API ID: CriticalSection$Leave$ControlDeviceEnter_memset
                                                                                                                • String ID:
                                                                                                                • API String ID: 589867189-0
                                                                                                                • Opcode ID: 8ebd72944f7a2a950c9ee27789203da092cdf93c9c74612e77d64f55a2891e3a
                                                                                                                • Instruction ID: c706671d47631c6094ceacd85374c5c19a88f26d1054e66b0f3edaf9514eb2f3
                                                                                                                • Opcode Fuzzy Hash: 8ebd72944f7a2a950c9ee27789203da092cdf93c9c74612e77d64f55a2891e3a
                                                                                                                • Instruction Fuzzy Hash: 971184752043119FE700DF64ECC5F5B77A9EF88765F218629F2199E1D2CB30D9498A60
                                                                                                                Function 00403CA8 Relevance: 7.7, APIs: 5, Instructions: 158COMMONLIBRARYCODE
                                                                                                                Download Yara Rule
                                                                                                                APIs
                                                                                                                • getSystemCP.LIBCMT ref: 00403CC1
                                                                                                                  • Part of subcall function 00403C2E: _LocaleUpdate::_LocaleUpdate.LIBCMT ref: 00403C3B
                                                                                                                  • Part of subcall function 00403C2E: GetOEMCP.KERNEL32(00000000,?,00401DD5), ref: 00403C55
                                                                                                                • setSBCS.LIBCMT ref: 00403CD3
                                                                                                                • IsValidCodePage.KERNEL32(-00000030,00000000,?,00000000,00409560), ref: 00403D19
                                                                                                                • GetCPInfo.KERNEL32(00000000,0040402B), ref: 00403D2C
                                                                                                                • setSBUpLow.LIBCMT ref: 00403E17
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000023.00000002.2671828313.0000000000401000.00000020.00000001.01000000.00000027.sdmp, Offset: 00400000, based on PE: true
                                                                                                                • Associated: 00000023.00000002.2671732944.0000000000400000.00000002.00000001.01000000.00000027.sdmpDownload File
                                                                                                                • Associated: 00000023.00000002.2671884603.0000000000408000.00000002.00000001.01000000.00000027.sdmpDownload File
                                                                                                                • Associated: 00000023.00000002.2671926254.000000000040A000.00000004.00000001.01000000.00000027.sdmpDownload File
                                                                                                                • Associated: 00000023.00000002.2672063353.000000000040C000.00000002.00000001.01000000.00000027.sdmpDownload File
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_35_2_400000_nfregdrv.jbxd
                                                                                                                Similarity
                                                                                                                • API ID: Locale$CodeInfoPageSystemUpdateUpdate::_Valid
                                                                                                                • String ID:
                                                                                                                • API String ID: 364485666-0
                                                                                                                • Opcode ID: f8562f73fbf6c12a93af662bf149bbf5becb5a351e9a22bc92b3aca215f4718f
                                                                                                                • Instruction ID: 7ec157c4a63f4bee73c0373c95dbc61b6731b50ec73e293603ddc6fd57e301c6
                                                                                                                • Opcode Fuzzy Hash: f8562f73fbf6c12a93af662bf149bbf5becb5a351e9a22bc92b3aca215f4718f
                                                                                                                • Instruction Fuzzy Hash: 8451E5719042549BDB15DF29C8806BABFA8EF05306F14817BD885BB2C2D63CDA46CBD9
                                                                                                                Function 10016860 Relevance: 7.6, APIs: 5, Instructions: 111COMMON
                                                                                                                Download Yara Rule
                                                                                                                APIs
                                                                                                                • GetTickCount.KERNEL32 ref: 10016897
                                                                                                                • EnterCriticalSection.KERNEL32 ref: 100168B8
                                                                                                                • ?nf_tcpPostReceive@nfapi@@YA?AW4_NF_STATUS@@_KPBDH@Z.NFAPI(?,?,00000000,00000000), ref: 10016931
                                                                                                                • LeaveCriticalSection.KERNEL32(1002030C), ref: 10016948
                                                                                                                • SetEvent.KERNEL32(?), ref: 100169C9
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000023.00000002.2673509223.0000000010001000.00000020.00000001.01000000.00000028.sdmp, Offset: 10000000, based on PE: true
                                                                                                                • Associated: 00000023.00000002.2673483913.0000000010000000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                • Associated: 00000023.00000002.2673541932.0000000010019000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                • Associated: 00000023.00000002.2673575934.000000001001E000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                • Associated: 00000023.00000002.2673609450.0000000010022000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_35_2_10000000_nfregdrv.jbxd
                                                                                                                Similarity
                                                                                                                • API ID: CriticalSection$?nf_tcpCountEnterEventLeavePostReceive@nfapi@@S@@_Tick
                                                                                                                • String ID:
                                                                                                                • API String ID: 2201467506-0
                                                                                                                • Opcode ID: 3b8d782bd27df50b16dfc65a62725b0131aeeeb5184073b4607cf5be4256a305
                                                                                                                • Instruction ID: 742bec59b4eacf5a62cee880053408559a72dd2c9328244c4bf56ef4399b46ed
                                                                                                                • Opcode Fuzzy Hash: 3b8d782bd27df50b16dfc65a62725b0131aeeeb5184073b4607cf5be4256a305
                                                                                                                • Instruction Fuzzy Hash: E0418B709087819FE310CF24CC84A6ABBEAFB88754F50491DF8D68B651D735ED858B42
                                                                                                                Function 10014090 Relevance: 7.6, APIs: 5, Instructions: 73COMMON
                                                                                                                Download Yara Rule
                                                                                                                APIs
                                                                                                                • EnterCriticalSection.KERNEL32(1002030C), ref: 10014096
                                                                                                                • LeaveCriticalSection.KERNEL32(1002030C), ref: 100140AA
                                                                                                                • DeviceIoControl.KERNEL32(FFFFFFFF,00000000,?,0000025B,00000000,00000000,?,00000000), ref: 10014137
                                                                                                                • LeaveCriticalSection.KERNEL32(1002030C), ref: 10014147
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000023.00000002.2673509223.0000000010001000.00000020.00000001.01000000.00000028.sdmp, Offset: 10000000, based on PE: true
                                                                                                                • Associated: 00000023.00000002.2673483913.0000000010000000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                • Associated: 00000023.00000002.2673541932.0000000010019000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                • Associated: 00000023.00000002.2673575934.000000001001E000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                • Associated: 00000023.00000002.2673609450.0000000010022000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_35_2_10000000_nfregdrv.jbxd
                                                                                                                Similarity
                                                                                                                • API ID: CriticalSection$Leave$ControlDeviceEnter
                                                                                                                • String ID:
                                                                                                                • API String ID: 3744975357-0
                                                                                                                • Opcode ID: c7db852ffef9afacecec687bb358ebba848a58d4b521bdcfc675cc6101f49ccd
                                                                                                                • Instruction ID: 943a08fe69652d90c9d1f998fde71af210911f062dc05d4fd50d64c2a8c94902
                                                                                                                • Opcode Fuzzy Hash: c7db852ffef9afacecec687bb358ebba848a58d4b521bdcfc675cc6101f49ccd
                                                                                                                • Instruction Fuzzy Hash: BE110A76500210AFE705CB68DC89ADB33D9EF88760F118219F6128B1E1EF70DA84C690
                                                                                                                Function 00404039 Relevance: 7.5, APIs: 5, Instructions: 44memoryCOMMONLIBRARYCODE
                                                                                                                Download Yara Rule
                                                                                                                APIs
                                                                                                                • __lock.LIBCMT ref: 00404057
                                                                                                                  • Part of subcall function 00402D12: __mtinitlocknum.LIBCMT ref: 00402D26
                                                                                                                  • Part of subcall function 00402D12: __amsg_exit.LIBCMT ref: 00402D32
                                                                                                                  • Part of subcall function 00402D12: EnterCriticalSection.KERNEL32(?,?,?,00405EA1,00000004,00409600,0000000C,0040411A,?,?,00000000,00000000,00000000,004024F8,00000001,00000214), ref: 00402D3A
                                                                                                                • ___sbh_find_block.LIBCMT ref: 00404062
                                                                                                                • ___sbh_free_block.LIBCMT ref: 00404071
                                                                                                                • HeapFree.KERNEL32(00000000,?,00409580,0000000C,00402CF3,00000000,004094A0,0000000C,00402D2B,?,?,?,00405EA1,00000004,00409600,0000000C), ref: 004040A1
                                                                                                                • GetLastError.KERNEL32(?,00405EA1,00000004,00409600,0000000C,0040411A,?,?,00000000,00000000,00000000,004024F8,00000001,00000214), ref: 004040B2
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000023.00000002.2671828313.0000000000401000.00000020.00000001.01000000.00000027.sdmp, Offset: 00400000, based on PE: true
                                                                                                                • Associated: 00000023.00000002.2671732944.0000000000400000.00000002.00000001.01000000.00000027.sdmpDownload File
                                                                                                                • Associated: 00000023.00000002.2671884603.0000000000408000.00000002.00000001.01000000.00000027.sdmpDownload File
                                                                                                                • Associated: 00000023.00000002.2671926254.000000000040A000.00000004.00000001.01000000.00000027.sdmpDownload File
                                                                                                                • Associated: 00000023.00000002.2672063353.000000000040C000.00000002.00000001.01000000.00000027.sdmpDownload File
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_35_2_400000_nfregdrv.jbxd
                                                                                                                Similarity
                                                                                                                • API ID: CriticalEnterErrorFreeHeapLastSection___sbh_find_block___sbh_free_block__amsg_exit__lock__mtinitlocknum
                                                                                                                • String ID:
                                                                                                                • API String ID: 2714421763-0
                                                                                                                • Opcode ID: c53e33b7dcff97c89c7848c55f26829c9334c78826d435bd8598ab40913ee6d4
                                                                                                                • Instruction ID: bb3a9ea6063299376b196d4342a46263de040b943687fa37fdfcb015542456c3
                                                                                                                • Opcode Fuzzy Hash: c53e33b7dcff97c89c7848c55f26829c9334c78826d435bd8598ab40913ee6d4
                                                                                                                • Instruction Fuzzy Hash: 540184B2941301AADB207BB29E0AB5E37649F80324F10423FF7047A2D2CB7C89449A9C
                                                                                                                Function 100038F0 Relevance: 7.5, APIs: 5, Instructions: 34synchronizationCOMMON
                                                                                                                Download Yara Rule
                                                                                                                APIs
                                                                                                                • EnterCriticalSection.KERNEL32(10020458,0000000A,?,00000000,1001783B), ref: 100038FE
                                                                                                                • LeaveCriticalSection.KERNEL32(10020458), ref: 1000392C
                                                                                                                • WaitForSingleObject.KERNEL32(?,00002710), ref: 1000393A
                                                                                                                • EnterCriticalSection.KERNEL32(10020458), ref: 10003941
                                                                                                                • LeaveCriticalSection.KERNEL32(10020458), ref: 10003963
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000023.00000002.2673509223.0000000010001000.00000020.00000001.01000000.00000028.sdmp, Offset: 10000000, based on PE: true
                                                                                                                • Associated: 00000023.00000002.2673483913.0000000010000000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                • Associated: 00000023.00000002.2673541932.0000000010019000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                • Associated: 00000023.00000002.2673575934.000000001001E000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                • Associated: 00000023.00000002.2673609450.0000000010022000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_35_2_10000000_nfregdrv.jbxd
                                                                                                                Similarity
                                                                                                                • API ID: CriticalSection$EnterLeave$ObjectSingleWait
                                                                                                                • String ID:
                                                                                                                • API String ID: 1755037574-0
                                                                                                                • Opcode ID: 3bb25a39c071496a06b616590bfd4f65b77da877f5bd338bfbeae23c9fbe291f
                                                                                                                • Instruction ID: 4c8c2d80ac1b079380655c5ec4cbb732bc282f0004f1aa78e3f82d5ff21842fc
                                                                                                                • Opcode Fuzzy Hash: 3bb25a39c071496a06b616590bfd4f65b77da877f5bd338bfbeae23c9fbe291f
                                                                                                                • Instruction Fuzzy Hash: 8FF090B1B402655FF704FB98ECD0CA533EAEBCC354760C019FB0593613CA7068069B61
                                                                                                                Function 10014800 Relevance: 6.3, APIs: 5, Instructions: 57COMMON
                                                                                                                Download Yara Rule
                                                                                                                APIs
                                                                                                                • EnterCriticalSection.KERNEL32(1002030C), ref: 1001480D
                                                                                                                • LeaveCriticalSection.KERNEL32(1002030C), ref: 10014821
                                                                                                                • LeaveCriticalSection.KERNEL32(1002030C), ref: 1001483E
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000023.00000002.2673509223.0000000010001000.00000020.00000001.01000000.00000028.sdmp, Offset: 10000000, based on PE: true
                                                                                                                • Associated: 00000023.00000002.2673483913.0000000010000000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                • Associated: 00000023.00000002.2673541932.0000000010019000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                • Associated: 00000023.00000002.2673575934.000000001001E000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                • Associated: 00000023.00000002.2673609450.0000000010022000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_35_2_10000000_nfregdrv.jbxd
                                                                                                                Similarity
                                                                                                                • API ID: CriticalSection$Leave$Enter
                                                                                                                • String ID:
                                                                                                                • API String ID: 2978645861-0
                                                                                                                • Opcode ID: 5b0c05bd3bb3b5db66ab5481f23a3e4c1540d4302acacb0ddc367f69b30fcab4
                                                                                                                • Instruction ID: 77183064e41a1e9205efc12c9dcf8d440c153a8ee4ed2ed3b95b76763cc59ffb
                                                                                                                • Opcode Fuzzy Hash: 5b0c05bd3bb3b5db66ab5481f23a3e4c1540d4302acacb0ddc367f69b30fcab4
                                                                                                                • Instruction Fuzzy Hash: 8401B5366102149FD701DF7CAC04899379AEB89632B114366FE2C872E1DF31D95586D1
                                                                                                                Function 00403B8A Relevance: 6.0, APIs: 4, Instructions: 47COMMONLIBRARYCODE
                                                                                                                Download Yara Rule
                                                                                                                APIs
                                                                                                                  • Part of subcall function 00402546: __amsg_exit.LIBCMT ref: 00402554
                                                                                                                • __amsg_exit.LIBCMT ref: 00403BB6
                                                                                                                • __lock.LIBCMT ref: 00403BC6
                                                                                                                • InterlockedDecrement.KERNEL32(?), ref: 00403BE3
                                                                                                                • InterlockedIncrement.KERNEL32(020B16D8), ref: 00403C0E
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000023.00000002.2671828313.0000000000401000.00000020.00000001.01000000.00000027.sdmp, Offset: 00400000, based on PE: true
                                                                                                                • Associated: 00000023.00000002.2671732944.0000000000400000.00000002.00000001.01000000.00000027.sdmpDownload File
                                                                                                                • Associated: 00000023.00000002.2671884603.0000000000408000.00000002.00000001.01000000.00000027.sdmpDownload File
                                                                                                                • Associated: 00000023.00000002.2671926254.000000000040A000.00000004.00000001.01000000.00000027.sdmpDownload File
                                                                                                                • Associated: 00000023.00000002.2672063353.000000000040C000.00000002.00000001.01000000.00000027.sdmpDownload File
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_35_2_400000_nfregdrv.jbxd
                                                                                                                Similarity
                                                                                                                • API ID: Interlocked__amsg_exit$DecrementIncrement__lock
                                                                                                                • String ID:
                                                                                                                • API String ID: 4129207761-0
                                                                                                                • Opcode ID: 52a3e7971e82fb72f830ee4ccc85c939e43fcece51e1a5e76106840384332467
                                                                                                                • Instruction ID: 4c552d2baa94243f91659daba1be32444af7e91f1612fcd78746f7470628c05b
                                                                                                                • Opcode Fuzzy Hash: 52a3e7971e82fb72f830ee4ccc85c939e43fcece51e1a5e76106840384332467
                                                                                                                • Instruction Fuzzy Hash: 8B01A532900721ABD711BF269906B5ABF74AB00759F14403BE800772D2CB7CAE81DB9E
                                                                                                                Function 004024CF Relevance: 6.0, APIs: 4, Instructions: 45threadCOMMONLIBRARYCODE
                                                                                                                Download Yara Rule
                                                                                                                APIs
                                                                                                                • GetLastError.KERNEL32(?,?,0040199A), ref: 004024D1
                                                                                                                  • Part of subcall function 004023A1: TlsGetValue.KERNEL32(?,004024E4,?,?,0040199A), ref: 004023A8
                                                                                                                  • Part of subcall function 004023A1: TlsSetValue.KERNEL32(00000000,004024E4,?,?,0040199A), ref: 004023C9
                                                                                                                • __calloc_crt.LIBCMT ref: 004024F3
                                                                                                                  • Part of subcall function 00404107: __calloc_impl.LIBCMT ref: 00404115
                                                                                                                  • Part of subcall function 00404107: Sleep.KERNEL32(00000000), ref: 0040412C
                                                                                                                  • Part of subcall function 0040232A: TlsGetValue.KERNEL32(00000000,004023BF,?,004024E4,?,?,0040199A), ref: 00402337
                                                                                                                  • Part of subcall function 0040232A: TlsGetValue.KERNEL32(00000006,?,004024E4,?,?,0040199A), ref: 0040234E
                                                                                                                  • Part of subcall function 00402410: GetModuleHandleA.KERNEL32(KERNEL32.DLL,00409438,0000000C,00402521,00000000,00000000,?,?,0040199A), ref: 00402421
                                                                                                                  • Part of subcall function 00402410: GetProcAddress.KERNEL32(?,EncodePointer), ref: 00402455
                                                                                                                  • Part of subcall function 00402410: GetProcAddress.KERNEL32(?,DecodePointer), ref: 00402465
                                                                                                                  • Part of subcall function 00402410: InterlockedIncrement.KERNEL32(0040A460), ref: 00402487
                                                                                                                  • Part of subcall function 00402410: __lock.LIBCMT ref: 0040248F
                                                                                                                  • Part of subcall function 00402410: ___addlocaleref.LIBCMT ref: 004024AE
                                                                                                                • GetCurrentThreadId.KERNEL32 ref: 00402523
                                                                                                                • SetLastError.KERNEL32(00000000,?,?,0040199A), ref: 0040253B
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000023.00000002.2671828313.0000000000401000.00000020.00000001.01000000.00000027.sdmp, Offset: 00400000, based on PE: true
                                                                                                                • Associated: 00000023.00000002.2671732944.0000000000400000.00000002.00000001.01000000.00000027.sdmpDownload File
                                                                                                                • Associated: 00000023.00000002.2671884603.0000000000408000.00000002.00000001.01000000.00000027.sdmpDownload File
                                                                                                                • Associated: 00000023.00000002.2671926254.000000000040A000.00000004.00000001.01000000.00000027.sdmpDownload File
                                                                                                                • Associated: 00000023.00000002.2672063353.000000000040C000.00000002.00000001.01000000.00000027.sdmpDownload File
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_35_2_400000_nfregdrv.jbxd
                                                                                                                Similarity
                                                                                                                • API ID: Value$AddressErrorLastProc$CurrentHandleIncrementInterlockedModuleSleepThread___addlocaleref__calloc_crt__calloc_impl__lock
                                                                                                                • String ID:
                                                                                                                • API String ID: 1081334783-0
                                                                                                                • Opcode ID: 5ab9714a243f0ffc41694fcd0ac968f58e359ad798ea549c5e95678d0f806d4d
                                                                                                                • Instruction ID: 6e150c00b90b0de194aaa4e6d30466842cabbf0b81775d3192f362ebb9054922
                                                                                                                • Opcode Fuzzy Hash: 5ab9714a243f0ffc41694fcd0ac968f58e359ad798ea549c5e95678d0f806d4d
                                                                                                                • Instruction Fuzzy Hash: B3F0F432000621AAC63227757E0D64B2B50AF50775B21413EF985B61E1CEB88940869D