Edit tour

Windows Analysis Report
PVUfopbGfc.exe

Overview

General Information

Sample name:	PVUfopbGfc.exe renamed because original name is a hash value
Original sample name:	402aacbb8dc07d96733eee2292f709d89d65efbe82d55e0dd4b7764cdde287b5.exe
Analysis ID:	1524840
MD5:	249ed615e8b43896fffd3cb3755c7a0a
SHA1:	1b28a72f6746ad76f7b25ab767ce7b775282fbeb
SHA256:	402aacbb8dc07d96733eee2292f709d89d65efbe82d55e0dd4b7764cdde287b5
Tags:	AciraConsultingIncexeuser-JAMESWT_MHT
Infos:

Detection

LummaC

Score:	76
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Compliance

Score:	52
Range:	0 - 100

Signatures

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Yara detected LummaC Stealer

Yara detected UAC Bypass using CMSTP

C2 URLs / IPs found in malware configuration

Found direct / indirect Syscall (likely to bypass EDR)

Found hidden mapped module (file has been removed from disk)

LummaC encrypted strings found

Maps a DLL or memory area into another process

Modifies the DNS server

NDIS Filter Driver detected (likely used to intercept and sniff network traffic)

Queries sensitive system registry key value via command line tool

Reads the Security eventlog

Reads the System eventlog

Sample uses string decryption to hide its real strings

Suspicious powershell command line found

Switches to a custom stack to bypass stack traces

Uses cmd line tools excessively to alter registry or file data

Uses netsh to modify the Windows network and firewall settings

Writes to foreign memory regions

Adds / modifies Windows certificates

Allocates memory with a write watch (potentially for evading sandboxes)

Binary contains a suspicious time stamp

Checks if the current process is being debugged

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to communicate with device drivers

Contains functionality to delete services

Contains functionality to dynamically determine API calls

Contains functionality to execute programs as a different user

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to query CPU information (cpuid)

Contains functionality to query locales information (e.g. system language)

Contains functionality to read device registry values (via SetupAPI)

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates a start menu entry (Start Menu\Programs\Startup)

Creates driver files

Creates files inside the driver directory

Creates files inside the system directory

Creates or modifies windows services

Deletes files inside the Windows folder

Detected potential crypto function

Drops PE files

Drops PE files to the windows directory (C:\Windows)

Drops certificate files (DER)

Drops files with a non-matching file extension (content does not match file extension)

Enables debug privileges

Enables driver privileges

Enables security privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

Installs a raw input device (often for capturing keystrokes)

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Modifies existing windows services

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

OS version to string mapping found (often used in BOTs)

One or more processes crash

PE file contains executable resources (Code or Archives)

PE file contains sections with non-standard names

Queries device information via Setup API

Queries disk information (often used to detect virtual machines)

Queries information about the installed CPU (vendor, model number etc)

Queries sensitive Operating System Information (via WMI, Win32_ComputerSystem, often done to detect virtual machines)

Queries the installation date of Windows

Queries the product ID of Windows

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Sigma detected: Startup Folder File Write

Sigma detected: Suspicious Copy From or To System Directory

Sigma detected: Tap Installer Execution

Stores files to the Windows start menu directory

Stores large binary data to the registry

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Uses reg.exe to modify the Windows registry

Yara signature match

Classification

Process Tree

System is w10x64

PVUfopbGfc.exe (PID: 6472 cmdline: "C:\Users\user\Desktop\PVUfopbGfc.exe" MD5: 249ED615E8B43896FFFD3CB3755C7A0A)

PVUfopbGfc.tmp (PID: 6632 cmdline: "C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp" /SL5="$1046E,20382094,735744,C:\Users\user\Desktop\PVUfopbGfc.exe" MD5: 259E3EE4646FC251C3513EEF2683479F)

cmd.exe (PID: 2448 cmdline: "C:\Windows\system32\cmd.exe" /C ""C:\Program Files\FastestVPN\Resources\driver\install_tap.bat"" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 5388 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

reg.exe (PID: 3356 cmdline: reg Query "HKLM\Hardware\Description\System\CentralProcessor\0" MD5: 227F63E1D9008B36BDBCC4B397780BE4)

find.exe (PID: 5580 cmdline: find /i "x86" MD5: 4BF76A28D31FC73AA9FC970B22D056AF)

cmd.exe (PID: 6276 cmdline: C:\Windows\system32\cmd.exe /c ver MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

tapinstall.exe (PID: 5568 cmdline: tapinstall.exe remove tap0901 MD5: E313336C82EB265542664CC7A360C5FF)

tapinstall.exe (PID: 1560 cmdline: tapinstall.exe install OemVista.inf tap0901 MD5: E313336C82EB265542664CC7A360C5FF)

cmd.exe (PID: 6640 cmdline: "C:\Windows\system32\cmd.exe" /C ""C:\Program Files\FastestVPN\Resources\sp\install_sp.bat"" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 6648 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

sc.exe (PID: 5596 cmdline: sc stop fastestvpndriver MD5: 3FB5CF71F7E7EB49790CB0E663434D80)

conhost.exe (PID: 6608 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

reg.exe (PID: 180 cmdline: reg Query "HKLM\Hardware\Description\System\CentralProcessor\0" MD5: 227F63E1D9008B36BDBCC4B397780BE4)

find.exe (PID: 5528 cmdline: find /i "x86" MD5: 4BF76A28D31FC73AA9FC970B22D056AF)

reg.exe (PID: 6512 cmdline: reg QUERY "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion" MD5: 227F63E1D9008B36BDBCC4B397780BE4)

find.exe (PID: 5612 cmdline: find /i "Windows 7" MD5: 4BF76A28D31FC73AA9FC970B22D056AF)

xcopy.exe (PID: 3224 cmdline: xcopy /y driver\windows8\amd64\fastestvpndriver.sys C:\Windows\system32\drivers MD5: 39FBFD3AF58238C6F9D4D408C9251FF5)

nfregdrv.exe (PID: 3116 cmdline: release\nfregdrv.exe -u fastestvpndriver MD5: 9333F583E2D32A47276DCEC7C2391FD2)

nfregdrv.exe (PID: 1020 cmdline: release\nfregdrv.exe fastestvpndriver MD5: 9333F583E2D32A47276DCEC7C2391FD2)

sc.exe (PID: 6108 cmdline: "C:\Windows\system32\sc.exe" stop FastestVPNService MD5: 3FB5CF71F7E7EB49790CB0E663434D80)

conhost.exe (PID: 5380 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

FastestVPN.WindowsService.exe (PID: 6276 cmdline: "C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe" --uninstall MD5: 22D4E4267DFE093E5E23C2F3D7741AA4)

WerFault.exe (PID: 6696 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 6276 -s 1076 MD5: C31336C1EFC2CCB44B4326EA793040F2)

sc.exe (PID: 6044 cmdline: "C:\Windows\system32\sc.exe" delete FastestVPNService MD5: 3FB5CF71F7E7EB49790CB0E663434D80)

conhost.exe (PID: 5008 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

FastestVPN.WindowsService.exe (PID: 1272 cmdline: "C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe" --install MD5: 22D4E4267DFE093E5E23C2F3D7741AA4)

subinacl.exe (PID: 6824 cmdline: "C:\Program Files\FastestVPN\subinacl.exe" /service FastestVPNService /GRANT=everyone=TO MD5: 4798226EE22C513302EE57D3AA94398B)

conhost.exe (PID: 5684 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

sc.exe (PID: 5612 cmdline: "C:\Windows\system32\sc.exe" start FastestVPNService MD5: 3FB5CF71F7E7EB49790CB0E663434D80)

conhost.exe (PID: 5756 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

ComDebug.exe (PID: 1220 cmdline: "C:\Program Files\FastestVPN\Resources\ComDebug.exe" MD5: 850A43E323656B86AE665D8B4FD71369)

netsh.exe (PID: 1240 cmdline: C:\Windows\SysWOW64\netsh.exe MD5: 4E89A1A088BE715D6C946E55AB07C7DF)

conhost.exe (PID: 3556 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

Launcher.exe (PID: 5328 cmdline: C:\Users\user\AppData\Local\Temp\Launcher.exe MD5: F43C6B629BAAAAEE1E7FE095A8821631)

FastestVPN.exe (PID: 1976 cmdline: "C:\Program Files\FastestVPN\FastestVPN.exe" MD5: 01CF6EF766C41BB2C99A2CCCDECC69C1)

svchost.exe (PID: 5484 cmdline: C:\Windows\system32\svchost.exe -k DcomLaunch -p -s DeviceInstall MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

drvinst.exe (PID: 2860 cmdline: DrvInst.exe "4" "0" "C:\Users\user\AppData\Local\Temp\{d561b4bd-4963-934e-b2b1-0e0727e36250}\oemvista.inf" "9" "4d14a44ff" "0000000000000160" "WinSta0\Default" "0000000000000158" "208" "c:\program files\fastestvpn\resources\driver\windows10\amd64" MD5: 294990C88B9D1FE0A54A1FA8BF4324D9)

drvinst.exe (PID: 2672 cmdline: DrvInst.exe "2" "211" "ROOT\NET\0000" "C:\Windows\INF\oem4.inf" "oem4.inf:3beb73aff103cc24:tap0901.ndi:9.24.2.601:tap0901," "4d14a44ff" "0000000000000180" MD5: 294990C88B9D1FE0A54A1FA8BF4324D9)

svchost.exe (PID: 1048 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s NetSetupSvc MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

svchost.exe (PID: 1684 cmdline: C:\Windows\System32\svchost.exe -k WerSvcGroup MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

WerFault.exe (PID: 5576 cmdline: C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 6276 -ip 6276 MD5: C31336C1EFC2CCB44B4326EA793040F2)

dllhost.exe (PID: 6276 cmdline: C:\Windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5} MD5: 08EB78E5BE019DF044C26B14703BD1FA)

svchost.exe (PID: 7032 cmdline: C:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

FastestVPN.exe (PID: 6020 cmdline: "C:\Program Files\FastestVPN\FastestVPN.exe" -autorun MD5: 01CF6EF766C41BB2C99A2CCCDECC69C1)

powershell.exe (PID: 5836 cmdline: "powershell" -windowstyle hidden get-wmiobject Win32_ComputerSystemProduct | Select-Object -ExpandProperty UUID MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)

conhost.exe (PID: 3856 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

svchost.exe (PID: 1020 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

FastestVPN.WindowsService.exe (PID: 1408 cmdline: "C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe" MD5: 22D4E4267DFE093E5E23C2F3D7741AA4)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Lumma Stealer, LummaC2 Stealer	Lumma Stealer (aka LummaC2 Stealer) is an information stealer written in C language that has been available through a Malware-as-a-Service (MaaS) model on Russian-speaking forums since at least August 2022. It is believed to have been developed by the threat actor "Shamel", who goes by the alias "Lumma". Lumma Stealer primarily targets cryptocurrency wallets and two-factor authentication (2FA) browser extensions, before ultimately stealing sensitive information from the victim's machine. Once the targeted data is obtained, it is exfiltrated to a C2 server via HTTP POST requests using the user agent "TeslaBrowser/5.5"." The stealer also features a non-resident loader that is capable of delivering additional payloads via EXE, DLL, and PowerShell.	No Attribution	https://0xmrmagnezi.github.io/malware%20analysis/LummaStealer/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/lummac2-breakdown#chrome-extensions-crx https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.cyble.com/2023/01/06/lummac2-stealer-a-potent-threat-to-crypto-users/ https://blog.sekoia.io/exposing-fakebat-loader-distribution-methods-and-adversary-infrastructure/	https://malpedia.caad.fkie.fraunhofer.de/details/win.lumma

Malware Configuration

Threatname: LummaC

{"C2 url": ["bargainnykwo.shop", "benchillppwo.shop", "scatterdshsadyi.shop", "answerrsdo.shop", "bannngwko.shop", "affecthorsedpo.shop", "bouncedgowp.shop", "radiationnopp.shop", "publicitttyps.shop"], "Build id": "long--try"}

Yara Signatures

Dropped Files

Source	Rule	Description	Author	Strings
C:\Program Files\FastestVPN\Resources\is-QOP0D.tmp	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
C:\Program Files\FastestVPN\Resources\is-QOP0D.tmp	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM	Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)	ditekSHen	0x339057:$guid1: {3E5FC7F9-9A51-4367-9063-A120244FBEC7} 0x33db63:$guid1: {3E5FC7F9-9A51-4367-9063-A120244FBEC7} 0x3e5f06:$s1: CoGetObject

Memory Dumps

Source	Rule	Description	Author
00000001.00000003.2675219520.00000000054B0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
Process Memory Space: PVUfopbGfc.tmp PID: 6632	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
decrypted.memstr	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security

Sigma Signatures

System Summary

Sigma detected: Startup Folder File Write

Source: File created

Author: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research): Data: EventID: 11, Image: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp, ProcessId: 6632, TargetFilename: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\FastestVPN.lnk

Sigma detected: Suspicious Copy From or To System Directory

Source: Process started

Author: Florian Roth (Nextron Systems), Markus Neis, Tim Shelton (HAWK.IO), Nasreddine Bencherchali (Nextron Systems): Data: Command: xcopy /y driver\windows8\amd64\fastestvpndriver.sys C:\Windows\system32\drivers, CommandLine: xcopy /y driver\windows8\amd64\fastestvpndriver.sys C:\Windows\system32\drivers, CommandLine|base64offset|contains: ), Image: C:\Windows\System32\xcopy.exe, NewProcessName: C:\Windows\System32\xcopy.exe, OriginalFileName: C:\Windows\System32\xcopy.exe, ParentCommandLine: "C:\Windows\system32\cmd.exe" /C ""C:\Program Files\FastestVPN\Resources\sp\install_sp.bat"", ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 6640, ParentProcessName: cmd.exe, ProcessCommandLine: xcopy /y driver\windows8\amd64\fastestvpndriver.sys C:\Windows\system32\drivers, ProcessId: 3224, ProcessName: xcopy.exe

Sigma detected: Tap Installer Execution

Source: Process started

Author: Daniil Yugoslavskiy, Ian Davis, oscd.community: Data: Command: tapinstall.exe remove tap0901, CommandLine: tapinstall.exe remove tap0901, CommandLine|base64offset|contains: , Image: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exe, NewProcessName: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exe, OriginalFileName: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exe, ParentCommandLine: "C:\Windows\system32\cmd.exe" /C ""C:\Program Files\FastestVPN\Resources\driver\install_tap.bat"", ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 2448, ParentProcessName: cmd.exe, ProcessCommandLine: tapinstall.exe remove tap0901, ProcessId: 5568, ProcessName: tapinstall.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: "powershell" -windowstyle hidden get-wmiobject Win32_ComputerSystemProduct | Select-Object -ExpandProperty UUID, CommandLine: "powershell" -windowstyle hidden get-wmiobject Win32_ComputerSystemProduct | Select-Object -ExpandProperty UUID, CommandLine|base64offset|contains: v,)^, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Program Files\FastestVPN\FastestVPN.exe" -autorun, ParentImage: C:\Program Files\FastestVPN\FastestVPN.exe, ParentProcessId: 6020, ParentProcessName: FastestVPN.exe, ProcessCommandLine: "powershell" -windowstyle hidden get-wmiobject Win32_ComputerSystemProduct | Select-Object -ExpandProperty UUID, ProcessId: 5836, ProcessName: powershell.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\system32\svchost.exe -k DcomLaunch -p -s DeviceInstall, CommandLine: C:\Windows\system32\svchost.exe -k DcomLaunch -p -s DeviceInstall, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 632, ProcessCommandLine: C:\Windows\system32\svchost.exe -k DcomLaunch -p -s DeviceInstall, ProcessId: 5484, ProcessName: svchost.exe

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Found malware configuration

Source: netsh.exe.1240.50.memstrmin

Malware Configuration Extractor: LummaC {"C2 url": ["bargainnykwo.shop", "benchillppwo.shop", "scatterdshsadyi.shop", "answerrsdo.shop", "bannngwko.shop", "affecthorsedpo.shop", "bouncedgowp.shop", "radiationnopp.shop", "publicitttyps.shop"], "Build id": "long--try"}

Multi AV Scanner detection for dropped file

Source: C:\Program Files\FastestVPN\Resources\desktop_drop_plugin.dll (copy)	ReversingLabs: Detection: 62%
Source: C:\Program Files\FastestVPN\Resources\is-JF6RJ.tmp	ReversingLabs: Detection: 62%

Multi AV Scanner detection for submitted file

Source: PVUfopbGfc.exe

ReversingLabs: Detection: 21%

Sample uses string decryption to hide its real strings

Source: 00000032.00000002.2825340131.00000000047B0000.00000004.00001000.00020000.00000000.sdmp	String decryptor: benchillppwo.shop
Source: 00000032.00000002.2825340131.00000000047B0000.00000004.00001000.00020000.00000000.sdmp	String decryptor: publicitttyps.shop
Source: 00000032.00000002.2825340131.00000000047B0000.00000004.00001000.00020000.00000000.sdmp	String decryptor: answerrsdo.shop
Source: 00000032.00000002.2825340131.00000000047B0000.00000004.00001000.00020000.00000000.sdmp	String decryptor: radiationnopp.shop
Source: 00000032.00000002.2825340131.00000000047B0000.00000004.00001000.00020000.00000000.sdmp	String decryptor: affecthorsedpo.shop
Source: 00000032.00000002.2825340131.00000000047B0000.00000004.00001000.00020000.00000000.sdmp	String decryptor: bargainnykwo.shop
Source: 00000032.00000002.2825340131.00000000047B0000.00000004.00001000.00020000.00000000.sdmp	String decryptor: bannngwko.shop
Source: 00000032.00000002.2825340131.00000000047B0000.00000004.00001000.00020000.00000000.sdmp	String decryptor: bouncedgowp.shop
Source: 00000032.00000002.2825340131.00000000047B0000.00000004.00001000.00020000.00000000.sdmp	String decryptor: scatterdshsadyi.shop
Source: 00000032.00000002.2825340131.00000000047B0000.00000004.00001000.00020000.00000000.sdmp	String decryptor: lid=%s&j=%s&ver=4.0
Source: 00000032.00000002.2825340131.00000000047B0000.00000004.00001000.00020000.00000000.sdmp	String decryptor: TeslaBrowser/5.5
Source: 00000032.00000002.2825340131.00000000047B0000.00000004.00001000.00020000.00000000.sdmp	String decryptor: - Screen Resoluton:
Source: 00000032.00000002.2825340131.00000000047B0000.00000004.00001000.00020000.00000000.sdmp	String decryptor: - Physical Installed Memory:
Source: 00000032.00000002.2825340131.00000000047B0000.00000004.00001000.00020000.00000000.sdmp	String decryptor: Workgroup: -
Source: 00000032.00000002.2825340131.00000000047B0000.00000004.00001000.00020000.00000000.sdmp	String decryptor: jMw1IE--VPN

Exploits

Yara detected UAC Bypass using CMSTP

Source: Yara match	File source: 00000001.00000003.2675219520.00000000054B0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: PVUfopbGfc.tmp PID: 6632, type: MEMORYSTR
Source: Yara match	File source: C:\Program Files\FastestVPN\Resources\is-QOP0D.tmp, type: DROPPED

Compliance

Uses 32bit PE files

Source: PVUfopbGfc.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE

Found installer window with terms and condition text

Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Window detected: License AgreementPlease read the following important information before continuing.Please read the following License Agreement. You must accept the terms of this agreement before continuing with the installation.Terms of ServiceThis is an agreement between you and FastestVPN.com for virtual private network communications services related services and features. It is NOT a service for the commission of criminal acts. It is an anonymity and privacy service. You agree not to violate any laws of any jurisdiction you are originating from or terminating into.You agree to protect your user id/password and our system from unauthorized use. You are responsible for all actions that occur on our servers where the login uses your user id/password.You agree not to use the system for sending spam port scanning scanning for open proxies or open relays sending opt-in email unsolicited email or any type or version of email sent in large quantities even if the email is ultimately sent off of another server. You agree not to launch any pop-ups from our service. You agree not to attack in any way shape or form any other computer or network while on our service.Actual service coverage speeds locations and quality may vary. The Service will attempt to be available at all times except for limited periods for maintenance and repair. However the Service may be subject to unavailability for a variety of factors beyond our control including emergencies third party service failures transmission equipment or network problems or limitations interference signal strength and may be interrupted refused limited or curtailed. We are not responsible for data messages or pages lost not delivered delayed or misdirected because of interruptions or performance issues with the Service or communications services or networks (e.g. T-1 lines or the Internet). We may impose usage or Service limits suspend Service or block certain kinds of usage in our sole discretion to protect users or the Service. Network speed is an estimate and is no indication of the speed at which your or the Service sends or receives data. Actual network speed will vary based on configuration compression network congestion and other factors. The accuracy and timeliness of data received is not guaranteed; delays or omissions may occur.We do not log any user activity (sites visited DNS lookups emails etc.) We only log access attempts to our servers (for security and troubleshooting). We do not get involved in any form of censorship. We do not give your personal info to any third parties. We do not cooperate with any requests for information unless we are ordered by a court of competent jurisdiction and the vast majority of these requests would not be from a court of competent jurisdiction. We will protect you to the max and our system is setup to automatically do so. There are hundreds of good reasons for being anonymous and we respect them fully.Hacking cracking distribution of viruses fraudulent activities network sa
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Window detected: License AgreementPlease read the following important information before continuing.Please read the following License Agreement. You must accept the terms of this agreement before continuing with the installation.Terms of ServiceThis is an agreement between you and FastestVPN.com for virtual private network communications services related services and features. It is NOT a service for the commission of criminal acts. It is an anonymity and privacy service. You agree not to violate any laws of any jurisdiction you are originating from or terminating into.You agree to protect your user id/password and our system from unauthorized use. You are responsible for all actions that occur on our servers where the login uses your user id/password.You agree not to use the system for sending spam port scanning scanning for open proxies or open relays sending opt-in email unsolicited email or any type or version of email sent in large quantities even if the email is ultimately sent off of another server. You agree not to launch any pop-ups from our service. You agree not to attack in any way shape or form any other computer or network while on our service.Actual service coverage speeds locations and quality may vary. The Service will attempt to be available at all times except for limited periods for maintenance and repair. However the Service may be subject to unavailability for a variety of factors beyond our control including emergencies third party service failures transmission equipment or network problems or limitations interference signal strength and may be interrupted refused limited or curtailed. We are not responsible for data messages or pages lost not delivered delayed or misdirected because of interruptions or performance issues with the Service or communications services or networks (e.g. T-1 lines or the Internet). We may impose usage or Service limits suspend Service or block certain kinds of usage in our sole discretion to protect users or the Service. Network speed is an estimate and is no indication of the speed at which your or the Service sends or receives data. Actual network speed will vary based on configuration compression network congestion and other factors. The accuracy and timeliness of data received is not guaranteed; delays or omissions may occur.We do not log any user activity (sites visited DNS lookups emails etc.) We only log access attempts to our servers (for security and troubleshooting). We do not get involved in any form of censorship. We do not give your personal info to any third parties. We do not cooperate with any requests for information unless we are ordered by a court of competent jurisdiction and the vast majority of these requests would not be from a court of competent jurisdiction. We will protect you to the max and our system is setup to automatically do so. There are hundreds of good reasons for being anonymous and we respect them fully.Hacking cracking distribution of viruses fraudulent activities network sa
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Window detected: License AgreementPlease read the following important information before continuing.Please read the following License Agreement. You must accept the terms of this agreement before continuing with the installation.Terms of ServiceThis is an agreement between you and FastestVPN.com for virtual private network communications services related services and features. It is NOT a service for the commission of criminal acts. It is an anonymity and privacy service. You agree not to violate any laws of any jurisdiction you are originating from or terminating into.You agree to protect your user id/password and our system from unauthorized use. You are responsible for all actions that occur on our servers where the login uses your user id/password.You agree not to use the system for sending spam port scanning scanning for open proxies or open relays sending opt-in email unsolicited email or any type or version of email sent in large quantities even if the email is ultimately sent off of another server. You agree not to launch any pop-ups from our service. You agree not to attack in any way shape or form any other computer or network while on our service.Actual service coverage speeds locations and quality may vary. The Service will attempt to be available at all times except for limited periods for maintenance and repair. However the Service may be subject to unavailability for a variety of factors beyond our control including emergencies third party service failures transmission equipment or network problems or limitations interference signal strength and may be interrupted refused limited or curtailed. We are not responsible for data messages or pages lost not delivered delayed or misdirected because of interruptions or performance issues with the Service or communications services or networks (e.g. T-1 lines or the Internet). We may impose usage or Service limits suspend Service or block certain kinds of usage in our sole discretion to protect users or the Service. Network speed is an estimate and is no indication of the speed at which your or the Service sends or receives data. Actual network speed will vary based on configuration compression network congestion and other factors. The accuracy and timeliness of data received is not guaranteed; delays or omissions may occur.We do not log any user activity (sites visited DNS lookups emails etc.) We only log access attempts to our servers (for security and troubleshooting). We do not get involved in any form of censorship. We do not give your personal info to any third parties. We do not cooperate with any requests for information unless we are ordered by a court of competent jurisdiction and the vast majority of these requests would not be from a court of competent jurisdiction. We will protect you to the max and our system is setup to automatically do so. There are hundreds of good reasons for being anonymous and we respect them fully.Hacking cracking distribution of viruses fraudulent activities network sa

Creates a directory in C:\Program Files

Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Directory created: C:\Program Files\FastestVPN	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Directory created: C:\Program Files\FastestVPN\unins000.dat	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Directory created: C:\Program Files\FastestVPN\is-1SSK8.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Directory created: C:\Program Files\FastestVPN\is-V02LD.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Directory created: C:\Program Files\FastestVPN\is-F6R4E.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Directory created: C:\Program Files\FastestVPN\is-HC0TS.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Directory created: C:\Program Files\FastestVPN\is-FCV4A.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Directory created: C:\Program Files\FastestVPN\is-2448N.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Directory created: C:\Program Files\FastestVPN\is-50CK2.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Directory created: C:\Program Files\FastestVPN\is-5L7N2.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Directory created: C:\Program Files\FastestVPN\is-3LDP6.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Directory created: C:\Program Files\FastestVPN\is-59D46.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Directory created: C:\Program Files\FastestVPN\is-CKMSD.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Directory created: C:\Program Files\FastestVPN\is-FRGRO.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Directory created: C:\Program Files\FastestVPN\is-BJ8NM.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Directory created: C:\Program Files\FastestVPN\is-PTLVI.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Directory created: C:\Program Files\FastestVPN\is-9ODK7.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Directory created: C:\Program Files\FastestVPN\is-OKMTN.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Directory created: C:\Program Files\FastestVPN\is-QTCOF.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Directory created: C:\Program Files\FastestVPN\is-446MI.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Directory created: C:\Program Files\FastestVPN\is-GFG66.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Directory created: C:\Program Files\FastestVPN\is-QNEIM.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Directory created: C:\Program Files\FastestVPN\is-TIP8B.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Directory created: C:\Program Files\FastestVPN\is-NSK8U.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Directory created: C:\Program Files\FastestVPN\is-LFVH5.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Directory created: C:\Program Files\FastestVPN\is-98KKE.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Directory created: C:\Program Files\FastestVPN\is-5TM82.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Directory created: C:\Program Files\FastestVPN\is-5IUQF.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Directory created: C:\Program Files\FastestVPN\is-AHK7Q.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Directory created: C:\Program Files\FastestVPN\is-K9S0M.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Directory created: C:\Program Files\FastestVPN\is-GRQCB.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Directory created: C:\Program Files\FastestVPN\is-L8FIT.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Directory created: C:\Program Files\FastestVPN\is-4QKGT.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Directory created: C:\Program Files\FastestVPN\is-UORP7.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Directory created: C:\Program Files\FastestVPN\is-1RGTV.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Directory created: C:\Program Files\FastestVPN\is-O5MTV.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Directory created: C:\Program Files\FastestVPN\is-IPA77.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Directory created: C:\Program Files\FastestVPN\is-1FT3O.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Directory created: C:\Program Files\FastestVPN\is-VTVPL.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Directory created: C:\Program Files\FastestVPN\is-05ABD.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Directory created: C:\Program Files\FastestVPN\is-EQOPF.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Directory created: C:\Program Files\FastestVPN\is-UN9A1.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Directory created: C:\Program Files\FastestVPN\is-5EDG5.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Directory created: C:\Program Files\FastestVPN\is-K82F0.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Directory created: C:\Program Files\FastestVPN\is-4EJAE.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Directory created: C:\Program Files\FastestVPN\is-HNNPS.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Directory created: C:\Program Files\FastestVPN\is-RU768.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Directory created: C:\Program Files\FastestVPN\is-21P0F.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Directory created: C:\Program Files\FastestVPN\is-57IGR.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Directory created: C:\Program Files\FastestVPN\is-DTS4U.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Directory created: C:\Program Files\FastestVPN\Resources	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Directory created: C:\Program Files\FastestVPN\Resources\is-5M6KM.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Directory created: C:\Program Files\FastestVPN\Resources\is-JF6RJ.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Directory created: C:\Program Files\FastestVPN\Resources\is-J9ANF.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Directory created: C:\Program Files\FastestVPN\Resources\is-8UK12.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Directory created: C:\Program Files\FastestVPN\Resources\is-UCO86.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Directory created: C:\Program Files\FastestVPN\Resources\is-O5204.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Directory created: C:\Program Files\FastestVPN\Resources\is-EJ1T1.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Directory created: C:\Program Files\FastestVPN\Resources\is-JCL7T.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Directory created: C:\Program Files\FastestVPN\Resources\is-4H11H.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Directory created: C:\Program Files\FastestVPN\Resources\is-Q7RHP.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Directory created: C:\Program Files\FastestVPN\Resources\is-QN5KA.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Directory created: C:\Program Files\FastestVPN\Resources\is-BERNA.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Directory created: C:\Program Files\FastestVPN\Resources\is-4R4LE.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Directory created: C:\Program Files\FastestVPN\Resources\is-TSTOA.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Directory created: C:\Program Files\FastestVPN\Resources\is-QG142.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Directory created: C:\Program Files\FastestVPN\Resources\is-T7NGU.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Directory created: C:\Program Files\FastestVPN\Resources\is-9HBCL.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Directory created: C:\Program Files\FastestVPN\Resources\is-J49VG.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Directory created: C:\Program Files\FastestVPN\Resources\is-71J6V.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Directory created: C:\Program Files\FastestVPN\Resources\is-BTQQJ.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Directory created: C:\Program Files\FastestVPN\Resources\is-MI83V.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Directory created: C:\Program Files\FastestVPN\Resources\is-9BMN3.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Directory created: C:\Program Files\FastestVPN\Resources\is-FO4BS.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Directory created: C:\Program Files\FastestVPN\Resources\is-7L7U1.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Directory created: C:\Program Files\FastestVPN\Resources\is-4JUC4.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Directory created: C:\Program Files\FastestVPN\Resources\is-SADIQ.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Directory created: C:\Program Files\FastestVPN\Resources\is-OJSLF.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Directory created: C:\Program Files\FastestVPN\Resources\is-R9V8V.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Directory created: C:\Program Files\FastestVPN\Resources\is-K889R.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Directory created: C:\Program Files\FastestVPN\Resources\is-PM9AD.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Directory created: C:\Program Files\FastestVPN\Resources\is-KHPQG.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Directory created: C:\Program Files\FastestVPN\Resources\is-5RDD6.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Directory created: C:\Program Files\FastestVPN\Resources\is-QLSLT.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Directory created: C:\Program Files\FastestVPN\Resources\is-71JPL.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Directory created: C:\Program Files\FastestVPN\Resources\is-1155O.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Directory created: C:\Program Files\FastestVPN\Resources\is-QOP0D.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Directory created: C:\Program Files\FastestVPN\Resources\data	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Directory created: C:\Program Files\FastestVPN\Resources\data\is-HMKT1.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Directory created: C:\Program Files\FastestVPN\Resources\data\is-NI40A.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Directory created: C:\Program Files\FastestVPN\Resources\data\is-GM9LU.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Directory created: C:\Program Files\FastestVPN\Resources\data\is-CUGSD.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Directory created: C:\Program Files\FastestVPN\Resources\driver	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Directory created: C:\Program Files\FastestVPN\Resources\driver\is-SAIVV.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Directory created: C:\Program Files\FastestVPN\Resources\driver\is-90S23.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Directory created: C:\Program Files\FastestVPN\Resources\driver\windows	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Directory created: C:\Program Files\FastestVPN\Resources\driver\windows\amd64	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Directory created: C:\Program Files\FastestVPN\Resources\driver\windows\amd64\is-QA9TR.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Directory created: C:\Program Files\FastestVPN\Resources\driver\windows\amd64\is-FKPUT.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Directory created: C:\Program Files\FastestVPN\Resources\driver\windows\amd64\is-PG7JG.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Directory created: C:\Program Files\FastestVPN\Resources\driver\windows\amd64\is-7J76O.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Directory created: C:\Program Files\FastestVPN\Resources\driver\windows\amd64\is-9NM46.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Directory created: C:\Program Files\FastestVPN\Resources\driver\windows\amd64\is-0UT9M.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Directory created: C:\Program Files\FastestVPN\Resources\driver\windows\i386	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Directory created: C:\Program Files\FastestVPN\Resources\driver\windows\i386\is-6HO0C.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Directory created: C:\Program Files\FastestVPN\Resources\driver\windows\i386\is-VSNQ2.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Directory created: C:\Program Files\FastestVPN\Resources\driver\windows\i386\is-O423O.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Directory created: C:\Program Files\FastestVPN\Resources\driver\windows\i386\is-PBM2F.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Directory created: C:\Program Files\FastestVPN\Resources\driver\windows\i386\is-QN43A.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Directory created: C:\Program Files\FastestVPN\Resources\driver\windows\i386\is-EQ5BP.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Directory created: C:\Program Files\FastestVPN\Resources\driver\windows10	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Directory created: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Directory created: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\is-P6RB9.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Directory created: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\is-3MVJ1.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Directory created: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\is-DDCD3.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Directory created: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\is-6LAFJ.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Directory created: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\is-ISUTF.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Directory created: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\is-9C393.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Directory created: C:\Program Files\FastestVPN\Resources\driver\windows10\i386	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Directory created: C:\Program Files\FastestVPN\Resources\driver\windows10\i386\is-0IO2E.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Directory created: C:\Program Files\FastestVPN\Resources\driver\windows10\i386\is-922TB.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Directory created: C:\Program Files\FastestVPN\Resources\driver\windows10\i386\is-SPFH5.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Directory created: C:\Program Files\FastestVPN\Resources\driver\windows10\i386\is-5P6ME.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Directory created: C:\Program Files\FastestVPN\Resources\driver\windows10\i386\is-GNQS3.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Directory created: C:\Program Files\FastestVPN\Resources\driver\windows10\i386\is-T49GN.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Directory created: C:\Program Files\FastestVPN\Resources\sp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Directory created: C:\Program Files\FastestVPN\Resources\sp\is-D3BH1.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Directory created: C:\Program Files\FastestVPN\Resources\sp\is-T3PGP.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Directory created: C:\Program Files\FastestVPN\Resources\sp\driver	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Directory created: C:\Program Files\FastestVPN\Resources\sp\driver\windows7	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Directory created: C:\Program Files\FastestVPN\Resources\sp\driver\windows7\amd64	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Directory created: C:\Program Files\FastestVPN\Resources\sp\driver\windows7\amd64\is-K5R6R.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Directory created: C:\Program Files\FastestVPN\Resources\sp\driver\windows7\i386	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Directory created: C:\Program Files\FastestVPN\Resources\sp\driver\windows7\i386\is-HEM9F.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Directory created: C:\Program Files\FastestVPN\Resources\sp\driver\windows8	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Directory created: C:\Program Files\FastestVPN\Resources\sp\driver\windows8\amd64	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Directory created: C:\Program Files\FastestVPN\Resources\sp\driver\windows8\amd64\is-0G2RR.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Directory created: C:\Program Files\FastestVPN\Resources\sp\driver\windows8\i386	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Directory created: C:\Program Files\FastestVPN\Resources\sp\driver\windows8\i386\is-PE3HT.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Directory created: C:\Program Files\FastestVPN\Resources\sp\release	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Directory created: C:\Program Files\FastestVPN\Resources\sp\release\is-QPO3E.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Directory created: C:\Program Files\FastestVPN\Resources\sp\release\is-1ASBC.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Directory created: C:\Program Files\FastestVPN\Service	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Directory created: C:\Program Files\FastestVPN\Service\is-IBD4C.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Directory created: C:\Program Files\FastestVPN\Service\is-PTINH.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Directory created: C:\Program Files\FastestVPN\Service\is-84F6J.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Directory created: C:\Program Files\FastestVPN\Service\is-SQ7U6.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Directory created: C:\Program Files\FastestVPN\Service\is-2RVHB.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Directory created: C:\Program Files\FastestVPN\Service\is-7I93E.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Directory created: C:\Program Files\FastestVPN\Service\is-902P3.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Directory created: C:\Program Files\FastestVPN\Service\is-QVSDK.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Directory created: C:\Program Files\FastestVPN\Service\is-GL2TH.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Directory created: C:\Program Files\FastestVPN\Service\is-AVARB.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Directory created: C:\Program Files\FastestVPN\Service\is-E9VNL.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Directory created: C:\Program Files\FastestVPN\Service\is-63I9E.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Directory created: C:\Program Files\FastestVPN\Service\is-J59NL.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Directory created: C:\Program Files\FastestVPN\Service\is-6KC91.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Directory created: C:\Program Files\FastestVPN\Service\is-UI3J1.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Directory created: C:\Program Files\FastestVPN\Service\is-OTL5D.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Directory created: C:\Program Files\FastestVPN\Service\is-BI62G.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Directory created: C:\Program Files\FastestVPN\Service\is-17VQ7.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Directory created: C:\Program Files\FastestVPN\Service\is-NF2G1.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Directory created: C:\Program Files\FastestVPN\Service\is-CS1P9.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Directory created: C:\Program Files\FastestVPN\Service\is-9GVKQ.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Directory created: C:\Program Files\FastestVPN\Service\is-JJ40M.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Directory created: C:\Program Files\FastestVPN\Service\is-17D7A.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Directory created: C:\Program Files\FastestVPN\is-0G40P.tmp	Jump to behavior
Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe	Directory created: C:\Program Files\FastestVPN\Service\InstallUtil.InstallLog
Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe	Directory created: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.InstallLog
Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe	Directory created: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.InstallState

Creates a software uninstall entry

Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp

Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\FastestVPN_is1

Jump to behavior

Creates install or setup log file

Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe	File created: C:\Program Files\FastestVPN\Service\InstallUtil.InstallLog
Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe	File created: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.InstallLog

PE / OLE file has a valid certificate

Source: PVUfopbGfc.exe

Static PE information: certificate valid

Uses secure TLS version for HTTPS connections

Source: unknown

HTTPS traffic detected: 104.22.21.170:443 -> 192.168.2.5:49734 version: TLS 1.2

Contains modern PE file flags such as dynamic base (ASLR) or NX

Source: PVUfopbGfc.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Binary contains paths to debug symbols

Source:	Binary string: System.Configuration.Install.pdb source: FastestVPN.WindowsService.exe, 0000001D.00000002.2583865767.0000000003286000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: D:\a\SQLitePCL.raw\SQLitePCL.raw\SQLitePCL.raw\src\SQLitePCLRaw.core\obj\Release\netstandard2.0\SQLitePCLRaw.core.pdb source: FastestVPN.exe, FastestVPN.exe, 00000022.00000002.3351200547.000000000BE32000.00000002.00000001.01000000.0000002E.sdmp
Source:	Binary string: C:\Users\samuli\source\repos\tap-windows6\devcon\x64\Release\devcon.pdb source: tapinstall.exe, 0000000A.00000000.2343669290.00007FF70AA34000.00000002.00000001.01000000.00000008.sdmp, tapinstall.exe, 0000000A.00000002.2345236578.00007FF70AA34000.00000002.00000001.01000000.00000008.sdmp, tapinstall.exe, 0000000B.00000000.2345491583.00007FF70AA34000.00000002.00000001.01000000.00000008.sdmp, tapinstall.exe, 0000000B.00000002.2394906784.00007FF70AA34000.00000002.00000001.01000000.00000008.sdmp
Source:	Binary string: C:\BuildAgent\work\da2c3d9512902c54\Tooling\obj\Release\System.Web.Cors\System.Web.Cors.pdb source: FastestVPN.WindowsService.exe, FastestVPN.WindowsService.exe, 0000002F.00000002.3310997564.0000000004682000.00000002.00000001.01000000.0000004C.sdmp
Source:	Binary string: D:\Sagar Work FastestVPN\FastestVPN-Windows-App\FastestVPN.WindowsService\obj\Release\FastestVPN.WindowsService.pdbe\FastestVPN.WindowsServic source: FastestVPN.WindowsService.exe, 0000001D.00000002.2581965322.0000000000FB9000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: D:\VPN core\FastestVPN-Windows-Core\VPN\obj\Debug\VPN.pdbB3\3 N3_CorDllMainmscoree.dll source: FastestVPN.WindowsService.exe, 0000002F.00000002.3312674428.0000000004752000.00000002.00000001.01000000.0000004E.sdmp
Source:	Binary string: D:\VPN core\FastestVPN-Windows-Core\VPN.Common\obj\Debug\VPN.Common.pdb source: PVUfopbGfc.tmp, 00000001.00000002.2700520104.000000000018C000.00000004.00000010.00020000.00000000.sdmp, PVUfopbGfc.tmp, 00000001.00000003.2675219520.00000000054B0000.00000004.00001000.00020000.00000000.sdmp, FastestVPN.WindowsService.exe, FastestVPN.WindowsService.exe, 0000001D.00000002.2584576821.0000000005782000.00000002.00000001.01000000.0000000F.sdmp
Source:	Binary string: D:\a\SQLitePCL.raw\SQLitePCL.raw\SQLitePCL.raw\src\SQLitePCLRaw.provider.dynamic_cdecl\obj\Release\netstandard2.0\SQLitePCLRaw.provider.dynamic_cdecl.pdb source: FastestVPN.exe, FastestVPN.exe, 00000022.00000002.3352299163.000000000C172000.00000002.00000001.01000000.0000002F.sdmp
Source:	Binary string: /_/artifacts/obj/Microsoft.AspNet.SignalR.Core/Release/net45/Microsoft.AspNet.SignalR.Core.pdbSHA256Z source: FastestVPN.WindowsService.exe, 0000001D.00000002.2584816506.0000000005A92000.00000002.00000001.01000000.0000000E.sdmp, FastestVPN.WindowsService.exe, 0000002F.00000002.3298560141.000000000116F000.00000004.00000020.00020000.00000000.sdmp, FastestVPN.WindowsService.exe, 0000002F.00000002.3304056218.0000000001BCC000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdb source: netsh.exe, 00000032.00000002.2825529110.0000000004E80000.00000004.00000020.00020000.00000000.sdmp, netsh.exe, 00000032.00000002.2825762645.0000000005320000.00000004.00001000.00020000.00000000.sdmp, Launcher.exe, 00000035.00000002.2857233034.00000000023C9000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000035.00000002.2857620610.0000000002860000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: Microsoft.Owin.Cors.pdbSHA256 source: FastestVPN.WindowsService.exe, 0000002F.00000002.3310437304.0000000004662000.00000002.00000001.01000000.00000046.sdmp
Source:	Binary string: E:\nt\dnsrv\sdktools\reskit\content\subinacl\source\obj\i386\subinacl.pdb source: PVUfopbGfc.tmp, 00000001.00000003.2675219520.00000000054B0000.00000004.00001000.00020000.00000000.sdmp, subinacl.exe, subinacl.exe, 0000002B.00000000.2611161261.0000000001001000.00000020.00000001.01000000.00000034.sdmp, subinacl.exe, 0000002B.00000002.2618280142.0000000001001000.00000020.00000001.01000000.00000034.sdmp, is-O5MTV.tmp.1.dr, is-OTL5D.tmp.1.dr
Source:	Binary string: ?&nC:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.pdb# source: FastestVPN.WindowsService.exe, 0000001D.00000002.2581965322.0000000000FB9000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: Microsoft.Owin.Cors.pdb source: FastestVPN.WindowsService.exe, FastestVPN.WindowsService.exe, 0000002F.00000002.3310437304.0000000004662000.00000002.00000001.01000000.00000046.sdmp
Source:	Binary string: winmm.pdbUGP source: netsh.exe, 00000032.00000002.2825340131.00000000047B0000.00000004.00001000.00020000.00000000.sdmp, Launcher.exe, 00000035.00000002.2856862183.00000000007E7000.00000008.00000001.01000000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\symbols\dll\System.Configuration.Install.pdb source: FastestVPN.WindowsService.exe, 0000001D.00000002.2582155531.00000000012F2000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\Sagar Work FastestVPN\FastestVPN-Windows-App\FastestVPN.Common\obj\Release\FastestVPN.Common.pdb source: FastestVPN.WindowsService.exe, FastestVPN.WindowsService.exe, 0000002F.00000002.3307845165.0000000004522000.00000002.00000001.01000000.00000035.sdmp
Source:	Binary string: Microsoft.Owin.Diagnostics.pdbSHA256 source: FastestVPN.WindowsService.exe, 0000002F.00000002.3311828504.0000000004712000.00000002.00000001.01000000.00000049.sdmp
Source:	Binary string: D:\VPN core\FastestVPN-Windows-Core\VPN\obj\Debug\VPN.pdb source: FastestVPN.WindowsService.exe, FastestVPN.WindowsService.exe, 0000002F.00000002.3312674428.0000000004752000.00000002.00000001.01000000.0000004E.sdmp
Source:	Binary string: C:\Windows\Microsoft.NET\Framework\v4.0.30319\spNet.SignalR.Core.pdb561934e089\System.dllLISTj! source: FastestVPN.WindowsService.exe, 0000002F.00000002.3298560141.000000000112D000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: /_/artifacts/obj/Microsoft.AspNet.SignalR.Core/Release/net45/Microsoft.AspNet.SignalR.Core.pdb source: FastestVPN.WindowsService.exe, 0000002F.00000002.3298560141.000000000116F000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\samuli\source\repos\tap-windows6\src\Release\tap0901.pdb source: is-PBM2F.tmp.1.dr
Source:	Binary string: c:\Users\Junaid AK\Desktop\New folder (2)\SingleInstanceApplication\SingleInstanceApplication\obj\Release\SingleInstanceApplication.pdb source: FastestVPN.exe, 00000034.00000002.2693645936.00000000026F2000.00000002.00000001.01000000.00000012.sdmp
Source:	Binary string: C:\Users\Jason A. Donenfeld\Projects\wireguard-nt\Release\amd64\wireguard.pdb source: PVUfopbGfc.tmp, 00000001.00000003.2675219520.00000000054B0000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: Windows\dll\mscorlib.pdbex0 source: FastestVPN.exe, 00000022.00000002.3344745212.000000000B5B6000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: Microsoft.Owin.Hosting.pdbSHA256d"M! source: FastestVPN.WindowsService.exe, 0000002F.00000002.3308225688.0000000004542000.00000002.00000001.01000000.00000037.sdmp
Source:	Binary string: D:\a\SQLitePCL.raw\SQLitePCL.raw\SQLitePCL.raw\src\SQLitePCLRaw.provider.dynamic_cdecl\obj\Release\netstandard2.0\SQLitePCLRaw.provider.dynamic_cdecl.pdbSHA256 source: FastestVPN.exe, 00000022.00000002.3352299163.000000000C172000.00000002.00000001.01000000.0000002F.sdmp
Source:	Binary string: D:\VPN core\FastestVPN-Windows-Core\VPN.OpenVpn\obj\Debug\VPN.OpenVpn.pdbRhlh ^h_CorDllMainmscoree.dll source: FastestVPN.WindowsService.exe, 0000002F.00000002.3312869455.0000000004762000.00000002.00000001.01000000.0000004F.sdmp
Source:	Binary string: D:\a\1\s\SDK\AppCenterAnalytics\Microsoft.AppCenter.Analytics.WindowsDesktop\obj\Microsoft.AppCenter.Analytics.WindowsDesktop\Release\net472\Microsoft.AppCenter.Analytics.pdb source: FastestVPN.exe, FastestVPN.exe, 00000022.00000002.3330206330.0000000006392000.00000002.00000001.01000000.0000002B.sdmp
Source:	Binary string: /_/artifacts/obj/Microsoft.AspNet.SignalR.Core/Release/net45/Microsoft.AspNet.SignalR.Core.pdb source: FastestVPN.WindowsService.exe, FastestVPN.WindowsService.exe, 0000001D.00000002.2584816506.0000000005A92000.00000002.00000001.01000000.0000000E.sdmp, FastestVPN.WindowsService.exe, 0000002F.00000002.3298560141.000000000116F000.00000004.00000020.00020000.00000000.sdmp, FastestVPN.WindowsService.exe, 0000002F.00000002.3304056218.0000000001BCC000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\symbols\exe\FastestVPN.WindowsService.pdb source: FastestVPN.WindowsService.exe, 0000001D.00000002.2582155531.00000000012F2000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: c:\projects\projectsJ\nfsdk2_1.6\bin\release\win32\nfapi.pdb< source: nfregdrv.exe, 00000019.00000002.2407457416.0000000010019000.00000002.00000001.01000000.0000000A.sdmp, nfregdrv.exe, 0000001A.00000002.2409400563.0000000010019000.00000002.00000001.01000000.0000000A.sdmp
Source:	Binary string: Hardcodet.NotifyIcon.Wpf.pdbSHA256[ source: FastestVPN.exe, 00000022.00000002.3327281264.00000000060A2000.00000002.00000001.01000000.0000001F.sdmp
Source:	Binary string: D:\a\1\s\SDK\AppCenterCrashes\Microsoft.AppCenter.Crashes.WindowsDesktop\obj\Microsoft.AppCenter.Crashes.WindowsDesktop\Release\net472\Microsoft.AppCenter.Crashes.pdbSHA256 source: FastestVPN.exe, 00000022.00000002.3330335816.00000000063A2000.00000002.00000001.01000000.0000002C.sdmp
Source:	Binary string: h:\projects\netfilter3\bin\Release\Win32\nfregdrv.pdb )0THi source: nfregdrv.exe, 00000019.00000002.2406977537.0000000000408000.00000002.00000001.01000000.00000009.sdmp, nfregdrv.exe, 00000019.00000000.2405650366.0000000000408000.00000002.00000001.01000000.00000009.sdmp, nfregdrv.exe, 0000001A.00000002.2408828115.0000000000408000.00000002.00000001.01000000.00000009.sdmp, nfregdrv.exe, 0000001A.00000000.2407706394.0000000000408000.00000002.00000001.01000000.00000009.sdmp, is-1ASBC.tmp.1.dr
Source:	Binary string: D:\a\SQLitePCL.raw\SQLitePCL.raw\SQLitePCL.raw\src\SQLitePCLRaw.bundle_green\obj\Release\net461\SQLitePCLRaw.batteries_v2.pdbSHA256x source: FastestVPN.exe, 00000022.00000002.3298315092.000000000108F000.00000004.00000020.00020000.00000000.sdmp, FastestVPN.exe, 00000022.00000002.3349122671.000000000BC52000.00000002.00000001.01000000.0000002D.sdmp
Source:	Binary string: \??\C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.pdbtral source: FastestVPN.WindowsService.exe, 0000001D.00000002.2582155531.00000000012F2000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: mscorlib.pdbmDataDriverData=C:\Windows\System32\Drivers\DriverDataOS=Windows_NTPATHEXT=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSCPROCESSOR_ARCHITECTURE=AMD64ProgramData=C:\ProgramDataPUBLIC=C:\Users\PublicSystemDrive=C:SystemRoot=C:\Windows~ source: FastestVPN.exe, 00000022.00000002.3341691329.000000000B474000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\b\s\w\ir\cache\builder\src\out\host_release\flutter_windows.dll.pdb source: ComDebug.exe, 00000030.00000002.2672367606.00007FF8A80B8000.00000002.00000001.01000000.00000048.sdmp
Source:	Binary string: C:\projects\projectsJ\nfsdk2_1.6\driver_wfp\Win8\Win8Release\x64\netfilter2.pdb source: xcopy.exe, 00000018.00000003.2403159655.00000297A19EA000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdbUGP source: netsh.exe, 00000032.00000002.2825529110.0000000004E80000.00000004.00000020.00020000.00000000.sdmp, netsh.exe, 00000032.00000002.2825762645.0000000005320000.00000004.00001000.00020000.00000000.sdmp, Launcher.exe, 00000035.00000002.2857233034.00000000023C9000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000035.00000002.2857620610.0000000002860000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: h:\projects\netfilter3\bin\Release\Win32\nfregdrv.pdb source: nfregdrv.exe, 00000019.00000002.2406977537.0000000000408000.00000002.00000001.01000000.00000009.sdmp, nfregdrv.exe, 00000019.00000000.2405650366.0000000000408000.00000002.00000001.01000000.00000009.sdmp, nfregdrv.exe, 0000001A.00000002.2408828115.0000000000408000.00000002.00000001.01000000.00000009.sdmp, nfregdrv.exe, 0000001A.00000000.2407706394.0000000000408000.00000002.00000001.01000000.00000009.sdmp, is-1ASBC.tmp.1.dr
Source:	Binary string: ntdll.pdbUGP source: ComDebug.exe, 00000030.00000002.2670309064.0000025FA46F0000.00000004.00000001.00020000.00000000.sdmp, ComDebug.exe, 00000030.00000002.2669964695.0000025FA44F0000.00000004.00000800.00020000.00000000.sdmp, ComDebug.exe, 00000030.00000002.2669735713.0000025FA40F3000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: $]qEC:\Program Files\FastestVPN\Service\Microsoft.AspNet.SignalR.Core.pdb source: FastestVPN.WindowsService.exe, 0000002F.00000002.3304056218.0000000001BCC000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: winmm.pdb source: netsh.exe, 00000032.00000002.2825340131.00000000047B0000.00000004.00001000.00020000.00000000.sdmp, Launcher.exe, 00000035.00000002.2856862183.00000000007E7000.00000008.00000001.01000000.00000000.sdmp
Source:	Binary string: agar Work FastestVPN\FastestVPN-Windows-App\FastestVPN.WindowsService\obj\Release\FastestVPN.WindowsService.pdb source: FastestVPN.WindowsService.exe, 0000001D.00000002.2582155531.00000000012F2000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: $]q!Microsoft.AspNet.SignalR.Core.pdb`,]q)"<>\| source: FastestVPN.WindowsService.exe, 0000002F.00000002.3304056218.0000000001BCC000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: D:\VPN core\FastestVPN-Windows-Core\VPN.Common\obj\Debug\VPN.Common.pdbH source: PVUfopbGfc.tmp, 00000001.00000002.2700520104.000000000018C000.00000004.00000010.00020000.00000000.sdmp, PVUfopbGfc.tmp, 00000001.00000003.2675219520.00000000054B0000.00000004.00001000.00020000.00000000.sdmp, FastestVPN.WindowsService.exe, 0000001D.00000002.2584576821.0000000005782000.00000002.00000001.01000000.0000000F.sdmp
Source:	Binary string: D:\VPN core\FastestVPN-Windows-Core\VPN.WireGuard\obj\Debug\VPN.WireGuard.pdb source: FastestVPN.WindowsService.exe, FastestVPN.WindowsService.exe, 0000002F.00000002.3314037370.00000000047B2000.00000002.00000001.01000000.00000051.sdmp
Source:	Binary string: D:\Sagar Work FastestVPN\FastestVPN-Windows-App\FastestVPN.Data.Local\obj\Release\FastestVPN.Data.Local.pdb source: FastestVPN.exe, FastestVPN.exe, 00000022.00000002.3325295176.0000000005DD2000.00000002.00000001.01000000.0000001D.sdmp
Source:	Binary string: /_/artifacts/obj/Microsoft.Extensions.DependencyInjection.Abstractions/Release/net462/Microsoft.Extensions.DependencyInjection.Abstractions.pdbSHA256 source: FastestVPN.exe, 00000022.00000002.3323696936.0000000005952000.00000002.00000001.01000000.00000015.sdmp
Source:	Binary string: D:\Sagar Work FastestVPN\FastestVPN-Windows-App\FastestVPN.WindowsService\obj\Release\FastestVPN.WindowsService.pdb source: FastestVPN.WindowsService.exe, 0000001D.00000002.2581965322.0000000000FB9000.00000004.00000010.00020000.00000000.sdmp, FastestVPN.WindowsService.exe, 0000001D.00000000.2412885741.0000000000E22000.00000002.00000001.01000000.0000000B.sdmp, FastestVPN.WindowsService.exe, 0000001D.00000002.2583865767.0000000003286000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: E:\A\_work\89\s\corefx\bin\obj\AnyOS.AnyCPU.Release\System.Memory\netstandard\System.Memory.pdbSHA256HXhZm source: FastestVPN.exe, 00000022.00000002.3352911178.000000000C1E2000.00000002.00000001.01000000.00000030.sdmp
Source:	Binary string: Microsoft.Owin.pdbSHA256 source: FastestVPN.WindowsService.exe, 0000002F.00000002.3309349757.0000000004592000.00000002.00000001.01000000.00000038.sdmp
Source:	Binary string: /home/runner/work/Flurl/Flurl/src/Flurl/obj/Release/net472/Flurl.pdb source: FastestVPN.exe, FastestVPN.exe, 00000022.00000002.3351506959.000000000BE72000.00000002.00000001.01000000.00000032.sdmp
Source:	Binary string: /home/runner/work/Flurl/Flurl/src/Flurl/obj/Release/net472/Flurl.pdbSHA256!VN source: FastestVPN.exe, 00000022.00000002.3351506959.000000000BE72000.00000002.00000001.01000000.00000032.sdmp
Source:	Binary string: mscorlib.pdb source: FastestVPN.exe, 00000022.00000002.3298315092.000000000108F000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\VPN core\FastestVPN-Windows-Core\VPN.RAS\obj\Debug\VPN.RAS.pdb source: PVUfopbGfc.tmp, 00000001.00000002.2700520104.000000000018C000.00000004.00000010.00020000.00000000.sdmp, PVUfopbGfc.tmp, 00000001.00000003.2675219520.00000000054B0000.00000004.00001000.00020000.00000000.sdmp, FastestVPN.WindowsService.exe, FastestVPN.WindowsService.exe, 0000002F.00000002.3313739781.00000000047A2000.00000002.00000001.01000000.00000050.sdmp, is-21P0F.tmp.1.dr
Source:	Binary string: /_/artifacts/obj/Microsoft.Extensions.DependencyInjection.Abstractions/Release/net462/Microsoft.Extensions.DependencyInjection.Abstractions.pdb source: FastestVPN.exe, FastestVPN.exe, 00000022.00000002.3323696936.0000000005952000.00000002.00000001.01000000.00000015.sdmp
Source:	Binary string: C:\Windows\FastestVPN.WindowsService.pdbpdbice.pdb </ source: FastestVPN.WindowsService.exe, 0000001D.00000002.2582155531.00000000012F2000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\projects\wpfanimatedgif\WpfAnimatedGif\obj\Release\net40\WpfAnimatedGif.pdbSHA256 source: FastestVPN.exe, 00000022.00000002.3329548380.0000000006312000.00000002.00000001.01000000.00000020.sdmp
Source:	Binary string: D:\a\1\s\SDK\AppCenter\Microsoft.AppCenter.WindowsDesktop\obj\Microsoft.AppCenter.WindowsDesktop\Release\net472\Microsoft.AppCenter.pdb source: FastestVPN.exe, FastestVPN.exe, 00000022.00000002.3330868755.00000000065B2000.00000002.00000001.01000000.0000002A.sdmp
Source:	Binary string: D:\Sagar Work FastestVPN\FastestVPN-Windows-App\FastestVPN.ViewModel\obj\Release\FastestVPN.ViewModel.pdb source: FastestVPN.exe, FastestVPN.exe, 00000022.00000002.3324911285.0000000005D72000.00000002.00000001.01000000.0000001A.sdmp
Source:	Binary string: Microsoft.Owin.Host.HttpListener.pdbSHA256-( source: FastestVPN.WindowsService.exe, 0000002F.00000002.3309864180.00000000045C2000.00000002.00000001.01000000.0000003A.sdmp
Source:	Binary string: D:\repos\main\SSH2\Release\pdbs\BvUpdateLauncher.pdb source: ComDebug.exe, 00000030.00000002.2669578005.0000025FA4009000.00000004.00000020.00020000.00000000.sdmp, netsh.exe, 00000032.00000002.2825661828.0000000005235000.00000004.00000800.00020000.00000000.sdmp, Launcher.exe, 00000035.00000002.2856630470.00000000003A9000.00000002.00000001.01000000.00000057.sdmp, Launcher.exe, 00000035.00000000.2781267206.00000000003A8000.00000002.00000001.01000000.00000057.sdmp, Launcher.exe, 00000035.00000002.2857488192.0000000002774000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: Microsoft.Owin.Security.pdbSHA256U source: FastestVPN.WindowsService.exe, 0000002F.00000002.3311384386.0000000004692000.00000002.00000001.01000000.0000004A.sdmp, is-63I9E.tmp.1.dr
Source:	Binary string: System.pdbN\|2h\|2 Z\|2_CorDllMainmscoree.dll source: FastestVPN.WindowsService.exe, 0000002F.00000002.3298560141.000000000116F000.00000004.00000020.00020000.00000000.sdmp, FastestVPN.WindowsService.exe, 0000002F.00000002.3304056218.0000000001BCC000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: D:\nt-driver-builder\wireguard-nt-0.10\Release\arm64\driver\wireguard.pdb source: PVUfopbGfc.tmp, 00000001.00000003.2675219520.00000000054B0000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: D:\Sagar Work FastestVPN\FastestVPN-Windows-App\FastestVPN.Data.Remote\obj\Release\FastestVPN.Data.Remote.pdb source: FastestVPN.exe, FastestVPN.exe, 00000022.00000002.3325390125.0000000005DE2000.00000002.00000001.01000000.0000001E.sdmp
Source:	Binary string: D:\Sagar Work FastestVPN\FastestVPN-Windows-App\FastestVPN.BLL\obj\Release\FastestVPN.BLL.pdbVepe be_CorDllMainmscoree.dll source: FastestVPN.exe, 00000022.00000002.3325176110.0000000005DC2000.00000002.00000001.01000000.0000001C.sdmp
Source:	Binary string: symbols\exe\FastestVPN.WindowsService.pdb source: FastestVPN.WindowsService.exe, 0000001D.00000002.2581965322.0000000000FB9000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: /_/src/Flurl.Http/obj/Release/net472/Flurl.Http.pdbSHA256 source: FastestVPN.exe, 00000022.00000002.3351847731.000000000BE92000.00000002.00000001.01000000.00000033.sdmp
Source:	Binary string: D:\VPN core\FastestVPN-Windows-Core\VPN.OpenVpn\obj\Debug\VPN.OpenVpn.pdb source: FastestVPN.WindowsService.exe, FastestVPN.WindowsService.exe, 0000002F.00000002.3312869455.0000000004762000.00000002.00000001.01000000.0000004F.sdmp
Source:	Binary string: /_/artifacts/obj/Microsoft.Bcl.AsyncInterfaces/Release/net462/Microsoft.Bcl.AsyncInterfaces.pdbSHA256 source: FastestVPN.exe, 00000022.00000002.3324194724.0000000005D02000.00000002.00000001.01000000.00000016.sdmp
Source:	Binary string: BouncyCastle.Crypto.pdbSHA256 source: FastestVPN.exe, 00000022.00000002.3354869052.000000000DFF2000.00000002.00000001.01000000.00000036.sdmp
Source:	Binary string: Microsoft.Owin.Diagnostics.pdb source: FastestVPN.WindowsService.exe, FastestVPN.WindowsService.exe, 0000002F.00000002.3311828504.0000000004712000.00000002.00000001.01000000.00000049.sdmp
Source:	Binary string: D:\nt-driver-builder\wireguard-nt-0.10\Release\arm64\driver\wireguard.pdbGCTL source: PVUfopbGfc.tmp, 00000001.00000003.2675219520.00000000054B0000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: System.ServiceProcess.pdb source: FastestVPN.WindowsService.exe, 0000001D.00000002.2583865767.0000000003286000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\FastestVPN.WindowsService.pdbL source: FastestVPN.WindowsService.exe, 0000001D.00000002.2582155531.00000000012F2000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: /_/artifacts/obj/Microsoft.Extensions.DependencyInjection/Release/net462/Microsoft.Extensions.DependencyInjection.pdbSHA256 source: FastestVPN.exe, 00000022.00000002.3324336785.0000000005D12000.00000002.00000001.01000000.00000017.sdmp
Source:	Binary string: System.Configuration.Install.pdbxF source: FastestVPN.WindowsService.exe, 0000001D.00000002.2583865767.0000000003286000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: D:\VPN core\FastestVPN-Windows-Core\VPN.WireGuard\obj\Debug\VPN.WireGuard.pdb2;L; >;_CorDllMainmscoree.dll source: FastestVPN.WindowsService.exe, 0000002F.00000002.3314037370.00000000047B2000.00000002.00000001.01000000.00000051.sdmp
Source:	Binary string: E:\nt\dnsrv\sdktools\reskit\content\subinacl\source\obj\i386\subinacl.pdbPa source: PVUfopbGfc.tmp, 00000001.00000003.2675219520.00000000054B0000.00000004.00001000.00020000.00000000.sdmp, subinacl.exe, 0000002B.00000000.2611161261.0000000001001000.00000020.00000001.01000000.00000034.sdmp, subinacl.exe, 0000002B.00000002.2618280142.0000000001001000.00000020.00000001.01000000.00000034.sdmp, is-O5MTV.tmp.1.dr, is-OTL5D.tmp.1.dr
Source:	Binary string: C:\projects\projectsJ\nfsdk2_1.6\driver_wfp\Win8\Win8Release\x64\netfilter2.pdb source: xcopy.exe, 00000018.00000003.2403159655.00000297A19EA000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a\1\s\SDK\AppCenterAnalytics\Microsoft.AppCenter.Analytics.WindowsDesktop\obj\Microsoft.AppCenter.Analytics.WindowsDesktop\Release\net472\Microsoft.AppCenter.Analytics.pdbSHA256 source: FastestVPN.exe, 00000022.00000002.3330206330.0000000006392000.00000002.00000001.01000000.0000002B.sdmp
Source:	Binary string: E:\A\_work\156\s\corefx\bin\obj\AnyOS.AnyCPU.Release\System.Threading.Tasks.Extensions\netfx\System.Threading.Tasks.Extensions.pdb source: FastestVPN.exe, FastestVPN.exe, 00000022.00000002.3324622795.0000000005D32000.00000002.00000001.01000000.00000018.sdmp
Source:	Binary string: D:\Sagar Work FastestVPN\FastestVPN-Windows-App\FastestVPN.Diagnostics\obj\Release\FastestVPN.Diagnostics.pdb source: FastestVPN.exe, FastestVPN.exe, 00000022.00000002.3324712420.0000000005D42000.00000002.00000001.01000000.00000019.sdmp
Source:	Binary string: C:\Users\Jason A. Donenfeld\Projects\wireguard-nt\Release\arm64\setupapihost.pdb source: PVUfopbGfc.tmp, 00000001.00000003.2675219520.00000000054B0000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: c:\projects\projectsJ\nfsdk2_1.6\bin\release\win32\nfapi.pdb source: nfregdrv.exe, 00000019.00000002.2407457416.0000000010019000.00000002.00000001.01000000.0000000A.sdmp, nfregdrv.exe, 0000001A.00000002.2409400563.0000000010019000.00000002.00000001.01000000.0000000A.sdmp
Source:	Binary string: /_/artifacts/obj/Microsoft.Bcl.AsyncInterfaces/Release/net462/Microsoft.Bcl.AsyncInterfaces.pdb source: FastestVPN.exe, FastestVPN.exe, 00000022.00000002.3324194724.0000000005D02000.00000002.00000001.01000000.00000016.sdmp
Source:	Binary string: c:\Users\lodejard\Projects\owin-hosting\src\main\Owin.Startup\obj\Release\Owin.pdb source: FastestVPN.WindowsService.exe, FastestVPN.WindowsService.exe, 0000002F.00000002.3307242028.0000000004242000.00000002.00000001.01000000.00000039.sdmp
Source:	Binary string: Microsoft.Owin.Hosting.pdb source: FastestVPN.WindowsService.exe, FastestVPN.WindowsService.exe, 0000002F.00000002.3308225688.0000000004542000.00000002.00000001.01000000.00000037.sdmp
Source:	Binary string: D:\Sagar Work FastestVPN\FastestVPN-Windows-App\FastestVPN.DependencyInjection\obj\Release\FastestVPN.DI.pdb source: FastestVPN.exe, FastestVPN.exe, 00000022.00000002.3323485610.0000000005842000.00000002.00000001.01000000.00000014.sdmp
Source:	Binary string: D:\a\1\s\SDK\AppCenterCrashes\Microsoft.AppCenter.Crashes.WindowsDesktop\obj\Microsoft.AppCenter.Crashes.WindowsDesktop\Release\net472\Microsoft.AppCenter.Crashes.pdb source: FastestVPN.exe, FastestVPN.exe, 00000022.00000002.3330335816.00000000063A2000.00000002.00000001.01000000.0000002C.sdmp
Source:	Binary string: nTC:\Windows\FastestVPN.WindowsService.pdb source: FastestVPN.WindowsService.exe, 0000001D.00000002.2581965322.0000000000FB9000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: /_/artifacts/obj/Microsoft.Extensions.DependencyInjection/Release/net462/Microsoft.Extensions.DependencyInjection.pdb source: FastestVPN.exe, FastestVPN.exe, 00000022.00000002.3324336785.0000000005D12000.00000002.00000001.01000000.00000017.sdmp
Source:	Binary string: @&n.pdb source: FastestVPN.WindowsService.exe, 0000001D.00000002.2581965322.0000000000FB9000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: c:\Users\Junaid AK\Desktop\New folder (2)\SingleInstanceApplication\SingleInstanceApplication\obj\Release\SingleInstanceApplication.pdb@:^: P:_CorDllMainmscoree.dll source: FastestVPN.exe, 00000034.00000002.2693645936.00000000026F2000.00000002.00000001.01000000.00000012.sdmp
Source:	Binary string: /_/Src/Newtonsoft.Json/obj/Release/net45/Newtonsoft.Json.pdbSHA256 source: PVUfopbGfc.tmp, 00000001.00000003.2675219520.00000000054B0000.00000004.00001000.00020000.00000000.sdmp, FastestVPN.WindowsService.exe, 0000002F.00000002.3314344281.0000000004802000.00000002.00000001.01000000.0000004B.sdmp, is-K9S0M.tmp.1.dr
Source:	Binary string: E:\A\_work\89\s\corefx\bin\obj\AnyOS.AnyCPU.Release\System.Memory\netstandard\System.Memory.pdb source: FastestVPN.exe, FastestVPN.exe, 00000022.00000002.3352911178.000000000C1E2000.00000002.00000001.01000000.00000030.sdmp
Source:	Binary string: C:\projects\wpfanimatedgif\WpfAnimatedGif\obj\Release\net40\WpfAnimatedGif.pdb source: FastestVPN.exe, FastestVPN.exe, 00000022.00000002.3329548380.0000000006312000.00000002.00000001.01000000.00000020.sdmp
Source:	Binary string: D:\Sagar Work FastestVPN\FastestVPN-Windows-App\FastestVPN.BLL\obj\Release\FastestVPN.BLL.pdb source: FastestVPN.exe, FastestVPN.exe, 00000022.00000002.3325176110.0000000005DC2000.00000002.00000001.01000000.0000001C.sdmp
Source:	Binary string: D:\a\SQLitePCL.raw\SQLitePCL.raw\SQLitePCL.raw\src\SQLitePCLRaw.bundle_green\obj\Release\net461\SQLitePCLRaw.batteries_v2.pdb source: FastestVPN.exe, FastestVPN.exe, 00000022.00000002.3298315092.000000000108F000.00000004.00000020.00020000.00000000.sdmp, FastestVPN.exe, 00000022.00000002.3349122671.000000000BC52000.00000002.00000001.01000000.0000002D.sdmp
Source:	Binary string: Microsoft.Owin.Security.pdb source: FastestVPN.WindowsService.exe, FastestVPN.WindowsService.exe, 0000002F.00000002.3311384386.0000000004692000.00000002.00000001.01000000.0000004A.sdmp, is-63I9E.tmp.1.dr
Source:	Binary string: D:\Sagar Work FastestVPN\FastestVPN-Windows-App\FastestVPN.Common\obj\Release\FastestVPN.Common.pdb source: FastestVPN.WindowsService.exe, 0000002F.00000002.3307845165.0000000004522000.00000002.00000001.01000000.00000035.sdmp
Source:	Binary string: /_/Src/Newtonsoft.Json/obj/Release/net45/Newtonsoft.Json.pdb source: PVUfopbGfc.tmp, 00000001.00000003.2675219520.00000000054B0000.00000004.00001000.00020000.00000000.sdmp, FastestVPN.WindowsService.exe, FastestVPN.WindowsService.exe, 0000002F.00000002.3314344281.0000000004802000.00000002.00000001.01000000.0000004B.sdmp, is-K9S0M.tmp.1.dr
Source:	Binary string: \??\C:\Windows\Microsoft.AspNet.SignalR.Core.pdbTV source: FastestVPN.WindowsService.exe, 0000002F.00000002.3298560141.00000000011D3000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: n0C:\Windows\mscorlib.pdb source: FastestVPN.exe, 00000022.00000002.3330592068.00000000065A8000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\symbols\dll\System.ServiceProcess.pdblez source: FastestVPN.WindowsService.exe, 0000001D.00000002.2582155531.00000000012F2000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\VPN core\FastestVPN-Windows-Core\VPN.AdvancedNetwork\obj\Debug\VPN.AdvancedNetwork.pdb source: FastestVPN.WindowsService.exe, FastestVPN.WindowsService.exe, 0000002F.00000002.3312448340.0000000004742000.00000002.00000001.01000000.0000004D.sdmp
Source:	Binary string: D:\Sagar Work FastestVPN\FastestVPN-Windows-App\FastestVPN\obj\Release\FastestVPN.pdb source: FastestVPN.exe, 00000022.00000000.2464852704.0000000000ABD000.00000002.00000001.01000000.00000011.sdmp
Source:	Binary string: \??\C:\Windows\exe\FastestVPN.WindowsService.pdb source: FastestVPN.WindowsService.exe, 0000001D.00000002.2582155531.00000000012F2000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Windows\System.Configuration.Install.pdbpdball.pdb> source: FastestVPN.WindowsService.exe, 0000001D.00000002.2582155531.00000000012F2000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.pdb source: FastestVPN.WindowsService.exe, 0000002F.00000002.3298560141.000000000116F000.00000004.00000020.00020000.00000000.sdmp, FastestVPN.WindowsService.exe, 0000002F.00000002.3304056218.0000000001BCC000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: /_/artifacts/obj/Microsoft.AspNet.SignalR.Core/Release/net45/Microsoft.AspNet.SignalR.Core.pdb@\]q^/_/artifacts/obj/Microsoft.AspNet.SignalR.Core/Release/net45/Microsoft.AspNet.SignalR.Core.pdb source: FastestVPN.WindowsService.exe, 0000002F.00000002.3304056218.0000000001BCC000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: Microsoft.Owin.Host.HttpListener.pdb source: FastestVPN.WindowsService.exe, FastestVPN.WindowsService.exe, 0000002F.00000002.3309864180.00000000045C2000.00000002.00000001.01000000.0000003A.sdmp
Source:	Binary string: $]q^/_/artifacts/obj/Microsoft.AspNet.SignalR.Core/Release/net45/Microsoft.AspNet.SignalR.Core.pdb source: FastestVPN.WindowsService.exe, 0000002F.00000002.3304056218.0000000001BCC000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: D:\nt-driver-builder\wireguard-nt-0.10\Release\amd64\driver\wireguard.pdbGCTL source: PVUfopbGfc.tmp, 00000001.00000003.2675219520.00000000054B0000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: D:\a\1\s\SDK\AppCenter\Microsoft.AppCenter.WindowsDesktop\obj\Microsoft.AppCenter.WindowsDesktop\Release\net472\Microsoft.AppCenter.pdbSHA256 source: FastestVPN.exe, 00000022.00000002.3330868755.00000000065B2000.00000002.00000001.01000000.0000002A.sdmp
Source:	Binary string: D:\Sagar Work FastestVPN\FastestVPN-Windows-App\FastestVPN.Data.Remote\obj\Release\FastestVPN.Data.Remote.pdbb^\|^ n^_CorDllMainmscoree.dll source: FastestVPN.exe, 00000022.00000002.3325390125.0000000005DE2000.00000002.00000001.01000000.0000001E.sdmp
Source:	Binary string: D:\Sagar Work FastestVPN\FastestVPN-Windows-App\FastestVPN.DependencyInjection\obj\Release\FastestVPN.DI.pdbY6s6 e6_CorDllMainmscoree.dll source: FastestVPN.exe, 00000022.00000002.3323485610.0000000005842000.00000002.00000001.01000000.00000014.sdmp
Source:	Binary string: \??\C:\Windows\exe\FastestVPN.WindowsService.pdb3 source: FastestVPN.WindowsService.exe, 0000001D.00000002.2582155531.00000000012F2000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\samuli\source\repos\tap-windows6\src\x64\Release\tap0901.pdb source: drvinst.exe, 0000000D.00000003.2367445197.000001E102C35000.00000004.00000020.00020000.00000000.sdmp, drvinst.exe, 0000000D.00000003.2365465099.000001E102B8C000.00000004.00000020.00020000.00000000.sdmp, drvinst.exe, 0000000D.00000003.2367245171.000001E102C34000.00000004.00000020.00020000.00000000.sdmp, is-7J76O.tmp.1.dr, SET9DE9.tmp.14.dr
Source:	Binary string: ntdll.pdb source: ComDebug.exe, 00000030.00000002.2670309064.0000025FA46F0000.00000004.00000001.00020000.00000000.sdmp, ComDebug.exe, 00000030.00000002.2669964695.0000025FA44F0000.00000004.00000800.00020000.00000000.sdmp, ComDebug.exe, 00000030.00000002.2669735713.0000025FA40F3000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: /_/src/Flurl.Http/obj/Release/net472/Flurl.Http.pdb source: FastestVPN.exe, FastestVPN.exe, 00000022.00000002.3351847731.000000000BE92000.00000002.00000001.01000000.00000033.sdmp
Source:	Binary string: D:\a\SQLitePCL.raw\SQLitePCL.raw\SQLitePCL.raw\src\SQLitePCLRaw.core\obj\Release\netstandard2.0\SQLitePCLRaw.core.pdbSHA256Ci\ source: FastestVPN.exe, 00000022.00000002.3351200547.000000000BE32000.00000002.00000001.01000000.0000002E.sdmp
Source:	Binary string: Microsoft.Owin.pdb source: FastestVPN.WindowsService.exe, FastestVPN.WindowsService.exe, 0000002F.00000002.3309349757.0000000004592000.00000002.00000001.01000000.00000038.sdmp
Source:	Binary string: BouncyCastle.Crypto.pdb source: FastestVPN.exe, FastestVPN.exe, 00000022.00000002.3354869052.000000000DFF2000.00000002.00000001.01000000.00000036.sdmp
Source:	Binary string: D:\nt-driver-builder\wireguard-nt-0.10\Release\amd64\driver\wireguard.pdb source: PVUfopbGfc.tmp, 00000001.00000003.2675219520.00000000054B0000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.pdb source: FastestVPN.WindowsService.exe, 0000001D.00000002.2582155531.00000000012F2000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: Hardcodet.NotifyIcon.Wpf.pdb source: FastestVPN.exe, FastestVPN.exe, 00000022.00000002.3327281264.00000000060A2000.00000002.00000001.01000000.0000001F.sdmp
Source:	Binary string: \??\C:\Windows\FastestVPN.WindowsService.pdbdb] source: FastestVPN.WindowsService.exe, 0000001D.00000002.2582155531.00000000012F2000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\symbols\exe\FastestVPN.WindowsService.pdb00 source: FastestVPN.WindowsService.exe, 0000001D.00000002.2582155531.00000000012F2000.00000004.00000020.00020000.00000000.sdmp

Spreading

Source: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exe	Code function: 10_2_00007FF70AA1ECAC FindFirstFileExW,FindNextFileW,FindClose,	10_2_00007FF70AA1ECAC
Source: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exe	Code function: 10_2_00007FF70AA1E0B0 _invalid_parameter_noinfo,_invalid_parameter_noinfo,FindFirstFileExW,FindNextFileW,FindClose,FindClose,FindClose,	10_2_00007FF70AA1E0B0
Source: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exe	Code function: 10_2_00007FF70AA1E810 FindFirstFileExW,	10_2_00007FF70AA1E810
Source: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exe	Code function: 10_2_00007FF70AA1E0B0 _invalid_parameter_noinfo,_invalid_parameter_noinfo,FindFirstFileExW,FindNextFileW,FindClose,FindClose,FindClose,	10_2_00007FF70AA1E0B0
Source: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exe	Code function: 10_2_00007FF70A9E3630 GetWindowsDirectoryW,FindFirstFileW,FindNextFileW,FindClose,	10_2_00007FF70A9E3630
Source: C:\Program Files\FastestVPN\subinacl.exe	Code function: 43_2_0103172D __EH_prolog,#540,#922,#858,#800,#2910,wcslen,#2910,wcslen,#823,GetLastError,_CxxThrowException,#2910,#2910,swprintf,FindFirstFileW,GetLastError,#825,#2910,FindFirstFileW,wcscmp,wcscmp,wcscmp,#535,#942,#942,#535,#942,#942,#800,FindNextFileW,FindClose,#800,	43_2_0103172D
Source: C:\Program Files\FastestVPN\subinacl.exe	Code function: 43_2_01031DDF __EH_prolog,#540,#925,#858,#800,#2910,wcslen,wcslen,#2910,wcslen,#823,GetLastError,_CxxThrowException,#2910,#2910,swprintf,FindFirstFileW,GetLastError,#825,#2910,FindFirstFileW,wcscmp,wcscmp,#540,#538,#922,#925,#858,#800,#800,#800,#925,#800,#858,#800,FindNextFileW,FindClose,#800,	43_2_01031DDF

Source: C:\Program Files\FastestVPN\Resources\sp\release\nfregdrv.exe

Code function: 25_2_100163B0 GetLogicalDriveStringsW,QueryDosDeviceW,GetDriveTypeW,EnterCriticalSection,LeaveCriticalSection,

25_2_100163B0

Source: C:\Windows\System32\cmd.exe	File opened: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	File opened: C:\Program Files\FastestVPN\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	File opened: C:\Program Files\FastestVPN\Resources\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	File opened: C:\Program Files\FastestVPN\Resources\driver\windows10\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	File opened: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64	Jump to behavior
Source: C:\Windows\System32\cmd.exe	File opened: C:\Program Files\FastestVPN\Resources\driver\	Jump to behavior

Networking

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: bargainnykwo.shop
Source: Malware configuration extractor	URLs: benchillppwo.shop
Source: Malware configuration extractor	URLs: scatterdshsadyi.shop
Source: Malware configuration extractor	URLs: answerrsdo.shop
Source: Malware configuration extractor	URLs: bannngwko.shop
Source: Malware configuration extractor	URLs: affecthorsedpo.shop
Source: Malware configuration extractor	URLs: bouncedgowp.shop
Source: Malware configuration extractor	URLs: radiationnopp.shop
Source: Malware configuration extractor	URLs: publicitttyps.shop

NDIS Filter Driver detected (likely used to intercept and sniff network traffic)

Source: is-K5R6R.tmp.1.dr	Static PE information: Found NDIS imports: FwpsFlowAssociateContext0, FwpsCalloutUnregisterByKey0, FwpmSubLayerAdd0, FwpsQueryPacketInjectionState0, FwpmSubLayerDeleteByKey0, FwpmSubLayerEnum0, FwpmTransactionCommit0, FwpmSubLayerCreateEnumHandle0, FwpmSubLayerDestroyEnumHandle0, FwpmProviderContextDeleteByKey0, FwpmCalloutAdd0, FwpmProviderAdd0, FwpmTransactionAbort0, FwpmEngineOpen0, FwpsAcquireClassifyHandle0, FwpmFilterAdd0, FwpsPendClassify0, FwpsCalloutRegister1, FwpmTransactionBegin0, FwpmEngineClose0, FwpmFreeMemory0, FwpsAcquireWritableLayerDataPointer0, FwpsApplyModifiedLayerData0, FwpsInjectNetworkReceiveAsync0, FwpsFreeCloneNetBufferList0, FwpsInjectionHandleDestroy0, FwpsConstructIpHeaderForTransportPacket0, FwpsAllocateNetBufferAndNetBufferList0, FwpsInjectionHandleCreate0, FwpsInjectTransportReceiveAsync0, FwpsInjectNetworkSendAsync0, FwpsCopyStreamDataToBuffer0, FwpsInjectTransportSendAsync0, FwpsFlowRemoveContext0, FwpsCloneStreamData0, FwpsCompleteClassify0, FwpsStreamInjectAsync0, FwpsReleaseClassifyHandle0, FwpsDiscardClonedStreamData0, FwpmBfeStateGet0, FwpmBfeStateSubscribeChanges0, FwpmBfeStateUnsubscribeChanges0, FwpsFreeNetBufferList0
Source: is-HEM9F.tmp.1.dr	Static PE information: Found NDIS imports: FwpsFreeNetBufferList0, FwpmEngineOpen0, FwpmProviderAdd0, FwpmSubLayerDeleteByKey0, FwpmProviderContextDeleteByKey0, FwpsAcquireClassifyHandle0, FwpsQueryPacketInjectionState0, FwpsFlowAssociateContext0, FwpmSubLayerAdd0, FwpmSubLayerCreateEnumHandle0, FwpmFreeMemory0, FwpmSubLayerEnum0, FwpmSubLayerDestroyEnumHandle0, FwpmCalloutAdd0, FwpmFilterAdd0, FwpmTransactionBegin0, FwpmEngineClose0, FwpmTransactionCommit0, FwpmTransactionAbort0, FwpsCalloutRegister1, FwpsCalloutUnregisterByKey0, FwpsPendClassify0, FwpsInjectionHandleCreate0, FwpsCopyStreamDataToBuffer0, FwpsInjectNetworkReceiveAsync0, FwpsAcquireWritableLayerDataPointer0, FwpsApplyModifiedLayerData0, FwpsAllocateNetBufferAndNetBufferList0, FwpsInjectTransportSendAsync0, FwpsConstructIpHeaderForTransportPacket0, FwpsInjectNetworkSendAsync0, FwpsInjectTransportReceiveAsync0, FwpsFreeCloneNetBufferList0, FwpsInjectionHandleDestroy0, FwpsFlowRemoveContext0, FwpsCloneStreamData0, FwpsCompleteClassify0, FwpsReleaseClassifyHandle0, FwpsDiscardClonedStreamData0, FwpsStreamInjectAsync0, FwpmBfeStateGet0, FwpmBfeStateSubscribeChanges0, FwpmBfeStateUnsubscribeChanges0
Source: is-0G2RR.tmp.1.dr	Static PE information: Found NDIS imports: FwpmFreeMemory0, FwpmEngineOpen0, FwpmEngineClose0, FwpmTransactionBegin0, FwpmTransactionCommit0, FwpmTransactionAbort0, FwpmProviderAdd0, FwpmProviderContextDeleteByKey0, FwpmSubLayerAdd0, FwpmSubLayerDeleteByKey0, FwpmSubLayerCreateEnumHandle0, FwpmSubLayerEnum0, FwpmSubLayerDestroyEnumHandle0, FwpmCalloutAdd0, FwpmFilterAdd0, FwpsFlowAbort0, FwpsInjectionHandleCreate0, FwpsInjectionHandleDestroy0, FwpsRedirectHandleCreate0, FwpsFreeNetBufferList0, FwpsFreeCloneNetBufferList0, FwpsInjectNetworkSendAsync0, FwpsConstructIpHeaderForTransportPacket0, FwpsInjectTransportSendAsync0, FwpsInjectTransportReceiveAsync0, FwpsInjectNetworkReceiveAsync0, FwpsStreamInjectAsync0, FwpsCopyStreamDataToBuffer0, FwpmBfeStateGet0, FwpmBfeStateSubscribeChanges0, FwpmBfeStateUnsubscribeChanges0, FwpsFlowRemoveContext0, FwpsCompleteClassify0, FwpsRedirectHandleDestroy0, FwpsCloneStreamData0, FwpsDiscardClonedStreamData0, FwpsQueryPacketInjectionState0, FwpsApplyModifiedLayerData0, FwpsAcquireWritableLayerDataPointer0, FwpsReleaseClassifyHandle0, FwpsAcquireClassifyHandle0, FwpsFlowAssociateContext0, FwpsCalloutUnregisterByKey0, FwpsPendClassify0, FwpsCalloutRegister1, FwpsAllocateNetBufferAndNetBufferList0
Source: is-PE3HT.tmp.1.dr	Static PE information: Found NDIS imports: FwpmFreeMemory0, FwpmEngineOpen0, FwpmEngineClose0, FwpmTransactionBegin0, FwpmTransactionCommit0, FwpmTransactionAbort0, FwpmProviderAdd0, FwpmProviderContextDeleteByKey0, FwpmSubLayerAdd0, FwpmSubLayerDeleteByKey0, FwpmSubLayerCreateEnumHandle0, FwpmSubLayerEnum0, FwpmSubLayerDestroyEnumHandle0, FwpmCalloutAdd0, FwpmFilterAdd0, FwpsFlowAbort0, FwpsInjectionHandleCreate0, FwpsInjectionHandleDestroy0, FwpsRedirectHandleCreate0, FwpsFreeNetBufferList0, FwpsFreeCloneNetBufferList0, FwpsInjectNetworkSendAsync0, FwpsConstructIpHeaderForTransportPacket0, FwpsInjectTransportSendAsync0, FwpsInjectTransportReceiveAsync0, FwpsInjectNetworkReceiveAsync0, FwpsStreamInjectAsync0, FwpsCopyStreamDataToBuffer0, FwpmBfeStateGet0, FwpmBfeStateSubscribeChanges0, FwpmBfeStateUnsubscribeChanges0, FwpsFlowRemoveContext0, FwpsCompleteClassify0, FwpsRedirectHandleDestroy0, FwpsCloneStreamData0, FwpsDiscardClonedStreamData0, FwpsQueryPacketInjectionState0, FwpsApplyModifiedLayerData0, FwpsAcquireWritableLayerDataPointer0, FwpsReleaseClassifyHandle0, FwpsAcquireClassifyHandle0, FwpsFlowAssociateContext0, FwpsCalloutUnregisterByKey0, FwpsPendClassify0, FwpsCalloutRegister1, FwpsAllocateNetBufferAndNetBufferList0

HTTP GET or POST without a user agent

Source: global traffic

HTTP traffic detected: POST /v2/authenticate HTTP/1.1xplatform: windowsxplatformtoken: _1032024043022Content-Type: application/json; charset=UTF-8Host: api.fastestvpn.comContent-Length: 104Expect: 100-continueAccept-Encoding: gzip, deflateConnection: Keep-Alive

JA3 SSL client fingerprint seen in connection with other malware

Source: Joe Sandbox View

JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e

Source: unknown

UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic

DNS traffic detected: DNS query: api.fastestvpn.com

Source: unknown

Source: svchost.exe, 00000021.00000002.3301147808.00000197506C8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://Passport.NET/STS
Source: svchost.exe, 00000021.00000003.2542019425.0000019750F76000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://Passport.NET/STS09/xmldsig#ripledes-cbcices/SOAPFaultcurity-utility-1.0.xsd
Source: svchost.exe, 00000021.00000003.2555530538.00000197506CF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://Passport.NET/tb
Source: svchost.exe, 00000021.00000002.3302943187.000001975141B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000021.00000002.3300825248.000001975065F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://Passport.NET/tb:pp
Source: svchost.exe, 00000021.00000002.3300907602.0000019750681000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000021.00000002.3303486786.00000197514AD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://Passport.NET/tb_
Source: PVUfopbGfc.tmp, 00000001.00000002.2700520104.000000000018C000.00000004.00000010.00020000.00000000.sdmp, PVUfopbGfc.tmp, 00000001.00000003.2675219520.00000000054B0000.00000004.00001000.00020000.00000000.sdmp, FastestVPN.WindowsService.exe, 0000002A.00000002.2608775109.0000000000ED0000.00000004.00000020.00020000.00000000.sdmp, FastestVPN.WindowsService.exe, 0000002A.00000002.2606870926.0000000000AB7000.00000004.00000020.00020000.00000000.sdmp, is-O5MTV.tmp.1.dr, is-OTL5D.tmp.1.dr, is-1ASBC.tmp.1.dr, is-K889R.tmp.1.dr, is-21P0F.tmp.1.dr, is-71J6V.tmp.1.dr	String found in binary or memory: http://aia.entrust.net/ts2-chain256.p7c01
Source: ComDebug.exe, 00000030.00000002.2672367606.00007FF8A80B8000.00000002.00000001.01000000.00000048.sdmp	String found in binary or memory: http://anglebug.com/1085
Source: ComDebug.exe, 00000030.00000002.2672367606.00007FF8A80B8000.00000002.00000001.01000000.00000048.sdmp	String found in binary or memory: http://anglebug.com/1423136
Source: ComDebug.exe, 00000030.00000002.2672367606.00007FF8A80B8000.00000002.00000001.01000000.00000048.sdmp	String found in binary or memory: http://anglebug.com/1423136dumpTranslatedShadersWrite
Source: ComDebug.exe, 00000030.00000002.2672367606.00007FF8A80B8000.00000002.00000001.01000000.00000048.sdmp	String found in binary or memory: http://anglebug.com/1452
Source: ComDebug.exe, 00000030.00000002.2672367606.00007FF8A80B8000.00000002.00000001.01000000.00000048.sdmp	String found in binary or memory: http://anglebug.com/1452expandIntegerPowExpressionsThe
Source: ComDebug.exe, 00000030.00000002.2672367606.00007FF8A80B8000.00000002.00000001.01000000.00000048.sdmp	String found in binary or memory: http://anglebug.com/1512
Source: ComDebug.exe, 00000030.00000002.2672367606.00007FF8A80B8000.00000002.00000001.01000000.00000048.sdmp	String found in binary or memory: http://anglebug.com/1637
Source: ComDebug.exe, 00000030.00000002.2672367606.00007FF8A80B8000.00000002.00000001.01000000.00000048.sdmp	String found in binary or memory: http://anglebug.com/1936
Source: ComDebug.exe, 00000030.00000002.2672367606.00007FF8A80B8000.00000002.00000001.01000000.00000048.sdmp	String found in binary or memory: http://anglebug.com/2046
Source: ComDebug.exe, 00000030.00000002.2672367606.00007FF8A80B8000.00000002.00000001.01000000.00000048.sdmp	String found in binary or memory: http://anglebug.com/2152
Source: ComDebug.exe, 00000030.00000002.2672367606.00007FF8A80B8000.00000002.00000001.01000000.00000048.sdmp	String found in binary or memory: http://anglebug.com/2152skipVSConstantRegisterZeroIn
Source: ComDebug.exe, 00000030.00000002.2672367606.00007FF8A80B8000.00000002.00000001.01000000.00000048.sdmp	String found in binary or memory: http://anglebug.com/2162
Source: ComDebug.exe, 00000030.00000002.2672367606.00007FF8A80B8000.00000002.00000001.01000000.00000048.sdmp	String found in binary or memory: http://anglebug.com/2273
Source: ComDebug.exe, 00000030.00000002.2672367606.00007FF8A80B8000.00000002.00000001.01000000.00000048.sdmp	String found in binary or memory: http://anglebug.com/2517
Source: ComDebug.exe, 00000030.00000002.2672367606.00007FF8A80B8000.00000002.00000001.01000000.00000048.sdmp	String found in binary or memory: http://anglebug.com/2894
Source: ComDebug.exe, 00000030.00000002.2672367606.00007FF8A80B8000.00000002.00000001.01000000.00000048.sdmp	String found in binary or memory: http://anglebug.com/2970
Source: ComDebug.exe, 00000030.00000002.2672367606.00007FF8A80B8000.00000002.00000001.01000000.00000048.sdmp	String found in binary or memory: http://anglebug.com/2978
Source: ComDebug.exe, 00000030.00000002.2672367606.00007FF8A80B8000.00000002.00000001.01000000.00000048.sdmp	String found in binary or memory: http://anglebug.com/3027
Source: ComDebug.exe, 00000030.00000002.2672367606.00007FF8A80B8000.00000002.00000001.01000000.00000048.sdmp	String found in binary or memory: http://anglebug.com/3045
Source: ComDebug.exe, 00000030.00000002.2672367606.00007FF8A80B8000.00000002.00000001.01000000.00000048.sdmp	String found in binary or memory: http://anglebug.com/3078
Source: ComDebug.exe, 00000030.00000002.2672367606.00007FF8A80B8000.00000002.00000001.01000000.00000048.sdmp	String found in binary or memory: http://anglebug.com/3205
Source: ComDebug.exe, 00000030.00000002.2672367606.00007FF8A80B8000.00000002.00000001.01000000.00000048.sdmp	String found in binary or memory: http://anglebug.com/3206
Source: ComDebug.exe, 00000030.00000002.2672367606.00007FF8A80B8000.00000002.00000001.01000000.00000048.sdmp	String found in binary or memory: http://anglebug.com/3246
Source: ComDebug.exe, 00000030.00000002.2672367606.00007FF8A80B8000.00000002.00000001.01000000.00000048.sdmp	String found in binary or memory: http://anglebug.com/3246allowClearForRobustResourceInitSome
Source: ComDebug.exe, 00000030.00000002.2672367606.00007FF8A80B8000.00000002.00000001.01000000.00000048.sdmp	String found in binary or memory: http://anglebug.com/3452
Source: ComDebug.exe, 00000030.00000002.2672367606.00007FF8A80B8000.00000002.00000001.01000000.00000048.sdmp	String found in binary or memory: http://anglebug.com/3498
Source: ComDebug.exe, 00000030.00000002.2672367606.00007FF8A80B8000.00000002.00000001.01000000.00000048.sdmp	String found in binary or memory: http://anglebug.com/3502
Source: ComDebug.exe, 00000030.00000002.2672367606.00007FF8A80B8000.00000002.00000001.01000000.00000048.sdmp	String found in binary or memory: http://anglebug.com/3577
Source: ComDebug.exe, 00000030.00000002.2672367606.00007FF8A80B8000.00000002.00000001.01000000.00000048.sdmp	String found in binary or memory: http://anglebug.com/3584
Source: ComDebug.exe, 00000030.00000002.2672367606.00007FF8A80B8000.00000002.00000001.01000000.00000048.sdmp	String found in binary or memory: http://anglebug.com/3586
Source: ComDebug.exe, 00000030.00000002.2672367606.00007FF8A80B8000.00000002.00000001.01000000.00000048.sdmp	String found in binary or memory: http://anglebug.com/3623
Source: ComDebug.exe, 00000030.00000002.2672367606.00007FF8A80B8000.00000002.00000001.01000000.00000048.sdmp	String found in binary or memory: http://anglebug.com/3624
Source: ComDebug.exe, 00000030.00000002.2672367606.00007FF8A80B8000.00000002.00000001.01000000.00000048.sdmp	String found in binary or memory: http://anglebug.com/3625
Source: ComDebug.exe, 00000030.00000002.2672367606.00007FF8A80B8000.00000002.00000001.01000000.00000048.sdmp	String found in binary or memory: http://anglebug.com/3682
Source: ComDebug.exe, 00000030.00000002.2672367606.00007FF8A80B8000.00000002.00000001.01000000.00000048.sdmp	String found in binary or memory: http://anglebug.com/3682allowES3OnFL100Allow
Source: ComDebug.exe, 00000030.00000002.2672367606.00007FF8A80B8000.00000002.00000001.01000000.00000048.sdmp	String found in binary or memory: http://anglebug.com/3729
Source: ComDebug.exe, 00000030.00000002.2672367606.00007FF8A80B8000.00000002.00000001.01000000.00000048.sdmp	String found in binary or memory: http://anglebug.com/3832
Source: ComDebug.exe, 00000030.00000002.2672367606.00007FF8A80B8000.00000002.00000001.01000000.00000048.sdmp	String found in binary or memory: http://anglebug.com/3862
Source: ComDebug.exe, 00000030.00000002.2672367606.00007FF8A80B8000.00000002.00000001.01000000.00000048.sdmp	String found in binary or memory: http://anglebug.com/3965
Source: ComDebug.exe, 00000030.00000002.2672367606.00007FF8A80B8000.00000002.00000001.01000000.00000048.sdmp	String found in binary or memory: http://anglebug.com/3970
Source: ComDebug.exe, 00000030.00000002.2672367606.00007FF8A80B8000.00000002.00000001.01000000.00000048.sdmp	String found in binary or memory: http://anglebug.com/3997
Source: ComDebug.exe, 00000030.00000002.2672367606.00007FF8A80B8000.00000002.00000001.01000000.00000048.sdmp	String found in binary or memory: http://anglebug.com/4214
Source: ComDebug.exe, 00000030.00000002.2672367606.00007FF8A80B8000.00000002.00000001.01000000.00000048.sdmp	String found in binary or memory: http://anglebug.com/4267
Source: ComDebug.exe, 00000030.00000002.2672367606.00007FF8A80B8000.00000002.00000001.01000000.00000048.sdmp	String found in binary or memory: http://anglebug.com/4324
Source: ComDebug.exe, 00000030.00000002.2672367606.00007FF8A80B8000.00000002.00000001.01000000.00000048.sdmp	String found in binary or memory: http://anglebug.com/4384
Source: ComDebug.exe, 00000030.00000002.2672367606.00007FF8A80B8000.00000002.00000001.01000000.00000048.sdmp	String found in binary or memory: http://anglebug.com/4405
Source: ComDebug.exe, 00000030.00000002.2672367606.00007FF8A80B8000.00000002.00000001.01000000.00000048.sdmp	String found in binary or memory: http://anglebug.com/4428
Source: ComDebug.exe, 00000030.00000002.2672367606.00007FF8A80B8000.00000002.00000001.01000000.00000048.sdmp	String found in binary or memory: http://anglebug.com/4551
Source: ComDebug.exe, 00000030.00000002.2672367606.00007FF8A80B8000.00000002.00000001.01000000.00000048.sdmp	String found in binary or memory: http://anglebug.com/4633
Source: ComDebug.exe, 00000030.00000002.2672367606.00007FF8A80B8000.00000002.00000001.01000000.00000048.sdmp	String found in binary or memory: http://anglebug.com/4646
Source: ComDebug.exe, 00000030.00000002.2672367606.00007FF8A80B8000.00000002.00000001.01000000.00000048.sdmp	String found in binary or memory: http://anglebug.com/4722
Source: ComDebug.exe, 00000030.00000002.2672367606.00007FF8A80B8000.00000002.00000001.01000000.00000048.sdmp	String found in binary or memory: http://anglebug.com/482
Source: ComDebug.exe, 00000030.00000002.2672367606.00007FF8A80B8000.00000002.00000001.01000000.00000048.sdmp	String found in binary or memory: http://anglebug.com/4836
Source: ComDebug.exe, 00000030.00000002.2672367606.00007FF8A80B8000.00000002.00000001.01000000.00000048.sdmp	String found in binary or memory: http://anglebug.com/4901
Source: ComDebug.exe, 00000030.00000002.2672367606.00007FF8A80B8000.00000002.00000001.01000000.00000048.sdmp	String found in binary or memory: http://anglebug.com/4937
Source: ComDebug.exe, 00000030.00000002.2672367606.00007FF8A80B8000.00000002.00000001.01000000.00000048.sdmp	String found in binary or memory: http://anglebug.com/5007
Source: ComDebug.exe, 00000030.00000002.2672367606.00007FF8A80B8000.00000002.00000001.01000000.00000048.sdmp	String found in binary or memory: http://anglebug.com/5007disableDrawBuffersIndexedDisable
Source: ComDebug.exe, 00000030.00000002.2672367606.00007FF8A80B8000.00000002.00000001.01000000.00000048.sdmp	String found in binary or memory: http://anglebug.com/5055
Source: ComDebug.exe, 00000030.00000002.2672367606.00007FF8A80B8000.00000002.00000001.01000000.00000048.sdmp	String found in binary or memory: http://anglebug.com/5061
Source: ComDebug.exe, 00000030.00000002.2672367606.00007FF8A80B8000.00000002.00000001.01000000.00000048.sdmp	String found in binary or memory: http://anglebug.com/5281
Source: ComDebug.exe, 00000030.00000002.2672367606.00007FF8A80B8000.00000002.00000001.01000000.00000048.sdmp	String found in binary or memory: http://anglebug.com/5371
Source: ComDebug.exe, 00000030.00000002.2672367606.00007FF8A80B8000.00000002.00000001.01000000.00000048.sdmp	String found in binary or memory: http://anglebug.com/5375
Source: ComDebug.exe, 00000030.00000002.2672367606.00007FF8A80B8000.00000002.00000001.01000000.00000048.sdmp	String found in binary or memory: http://anglebug.com/5421
Source: ComDebug.exe, 00000030.00000002.2672367606.00007FF8A80B8000.00000002.00000001.01000000.00000048.sdmp	String found in binary or memory: http://anglebug.com/5430
Source: ComDebug.exe, 00000030.00000002.2672367606.00007FF8A80B8000.00000002.00000001.01000000.00000048.sdmp	String found in binary or memory: http://anglebug.com/5469
Source: ComDebug.exe, 00000030.00000002.2672367606.00007FF8A80B8000.00000002.00000001.01000000.00000048.sdmp	String found in binary or memory: http://anglebug.com/5535
Source: ComDebug.exe, 00000030.00000002.2672367606.00007FF8A80B8000.00000002.00000001.01000000.00000048.sdmp	String found in binary or memory: http://anglebug.com/5577
Source: ComDebug.exe, 00000030.00000002.2672367606.00007FF8A80B8000.00000002.00000001.01000000.00000048.sdmp	String found in binary or memory: http://anglebug.com/5658
Source: ComDebug.exe, 00000030.00000002.2672367606.00007FF8A80B8000.00000002.00000001.01000000.00000048.sdmp	String found in binary or memory: http://anglebug.com/5658forceGlErrorCheckingForce
Source: ComDebug.exe, 00000030.00000002.2672367606.00007FF8A80B8000.00000002.00000001.01000000.00000048.sdmp	String found in binary or memory: http://anglebug.com/5750
Source: ComDebug.exe, 00000030.00000002.2672367606.00007FF8A80B8000.00000002.00000001.01000000.00000048.sdmp	String found in binary or memory: http://anglebug.com/5750forceRobustResourceInitForce-enable
Source: ComDebug.exe, 00000030.00000002.2672367606.00007FF8A80B8000.00000002.00000001.01000000.00000048.sdmp	String found in binary or memory: http://anglebug.com/5881
Source: ComDebug.exe, 00000030.00000002.2672367606.00007FF8A80B8000.00000002.00000001.01000000.00000048.sdmp	String found in binary or memory: http://anglebug.com/5901
Source: ComDebug.exe, 00000030.00000002.2672367606.00007FF8A80B8000.00000002.00000001.01000000.00000048.sdmp	String found in binary or memory: http://anglebug.com/5906
Source: ComDebug.exe, 00000030.00000002.2672367606.00007FF8A80B8000.00000002.00000001.01000000.00000048.sdmp	String found in binary or memory: http://anglebug.com/6041
Source: ComDebug.exe, 00000030.00000002.2672367606.00007FF8A80B8000.00000002.00000001.01000000.00000048.sdmp	String found in binary or memory: http://anglebug.com/6041forceInitShaderVariablesForce-enable
Source: ComDebug.exe, 00000030.00000002.2672367606.00007FF8A80B8000.00000002.00000001.01000000.00000048.sdmp	String found in binary or memory: http://anglebug.com/6048
Source: ComDebug.exe, 00000030.00000002.2672367606.00007FF8A80B8000.00000002.00000001.01000000.00000048.sdmp	String found in binary or memory: http://anglebug.com/6141
Source: ComDebug.exe, 00000030.00000002.2672367606.00007FF8A80B8000.00000002.00000001.01000000.00000048.sdmp	String found in binary or memory: http://anglebug.com/6248
Source: ComDebug.exe, 00000030.00000002.2672367606.00007FF8A80B8000.00000002.00000001.01000000.00000048.sdmp	String found in binary or memory: http://anglebug.com/6439
Source: ComDebug.exe, 00000030.00000002.2672367606.00007FF8A80B8000.00000002.00000001.01000000.00000048.sdmp	String found in binary or memory: http://anglebug.com/6651
Source: ComDebug.exe, 00000030.00000002.2672367606.00007FF8A80B8000.00000002.00000001.01000000.00000048.sdmp	String found in binary or memory: http://anglebug.com/6692
Source: ComDebug.exe, 00000030.00000002.2672367606.00007FF8A80B8000.00000002.00000001.01000000.00000048.sdmp	String found in binary or memory: http://anglebug.com/6755
Source: ComDebug.exe, 00000030.00000002.2672367606.00007FF8A80B8000.00000002.00000001.01000000.00000048.sdmp	String found in binary or memory: http://anglebug.com/6860
Source: ComDebug.exe, 00000030.00000002.2672367606.00007FF8A80B8000.00000002.00000001.01000000.00000048.sdmp	String found in binary or memory: http://anglebug.com/6876
Source: ComDebug.exe, 00000030.00000002.2672367606.00007FF8A80B8000.00000002.00000001.01000000.00000048.sdmp	String found in binary or memory: http://anglebug.com/6878
Source: ComDebug.exe, 00000030.00000002.2672367606.00007FF8A80B8000.00000002.00000001.01000000.00000048.sdmp	String found in binary or memory: http://anglebug.com/6929
Source: ComDebug.exe, 00000030.00000002.2672367606.00007FF8A80B8000.00000002.00000001.01000000.00000048.sdmp	String found in binary or memory: http://anglebug.com/6953
Source: ComDebug.exe, 00000030.00000002.2672367606.00007FF8A80B8000.00000002.00000001.01000000.00000048.sdmp	String found in binary or memory: http://anglebug.com/7036
Source: ComDebug.exe, 00000030.00000002.2672367606.00007FF8A80B8000.00000002.00000001.01000000.00000048.sdmp	String found in binary or memory: http://anglebug.com/7036dumpShaderSourceWrite
Source: ComDebug.exe, 00000030.00000002.2672367606.00007FF8A80B8000.00000002.00000001.01000000.00000048.sdmp	String found in binary or memory: http://anglebug.com/7047
Source: ComDebug.exe, 00000030.00000002.2672367606.00007FF8A80B8000.00000002.00000001.01000000.00000048.sdmp	String found in binary or memory: http://anglebug.com/7172
Source: ComDebug.exe, 00000030.00000002.2672367606.00007FF8A80B8000.00000002.00000001.01000000.00000048.sdmp	String found in binary or memory: http://anglebug.com/7279
Source: ComDebug.exe, 00000030.00000002.2672367606.00007FF8A80B8000.00000002.00000001.01000000.00000048.sdmp	String found in binary or memory: http://anglebug.com/7279cacheCompiledShaderEnable
Source: ComDebug.exe, 00000030.00000002.2672367606.00007FF8A80B8000.00000002.00000001.01000000.00000048.sdmp	String found in binary or memory: http://anglebug.com/7370
Source: ComDebug.exe, 00000030.00000002.2672367606.00007FF8A80B8000.00000002.00000001.01000000.00000048.sdmp	String found in binary or memory: http://anglebug.com/7406
Source: ComDebug.exe, 00000030.00000002.2672367606.00007FF8A80B8000.00000002.00000001.01000000.00000048.sdmp	String found in binary or memory: http://anglebug.com/7488
Source: ComDebug.exe, 00000030.00000002.2672367606.00007FF8A80B8000.00000002.00000001.01000000.00000048.sdmp	String found in binary or memory: http://anglebug.com/7527
Source: ComDebug.exe, 00000030.00000002.2672367606.00007FF8A80B8000.00000002.00000001.01000000.00000048.sdmp	String found in binary or memory: http://anglebug.com/7553
Source: ComDebug.exe, 00000030.00000002.2672367606.00007FF8A80B8000.00000002.00000001.01000000.00000048.sdmp	String found in binary or memory: http://anglebug.com/7556
Source: ComDebug.exe, 00000030.00000002.2672367606.00007FF8A80B8000.00000002.00000001.01000000.00000048.sdmp	String found in binary or memory: http://anglebug.com/7724
Source: ComDebug.exe, 00000030.00000002.2672367606.00007FF8A80B8000.00000002.00000001.01000000.00000048.sdmp	String found in binary or memory: http://anglebug.com/7724disableAnisotropicFilteringDisable
Source: ComDebug.exe, 00000030.00000002.2672367606.00007FF8A80B8000.00000002.00000001.01000000.00000048.sdmp	String found in binary or memory: http://anglebug.com/7760
Source: ComDebug.exe, 00000030.00000002.2672367606.00007FF8A80B8000.00000002.00000001.01000000.00000048.sdmp	String found in binary or memory: http://anglebug.com/7760enableShaderSubstitutionCheck
Source: ComDebug.exe, 00000030.00000002.2672367606.00007FF8A80B8000.00000002.00000001.01000000.00000048.sdmp	String found in binary or memory: http://anglebug.com/7761
Source: ComDebug.exe, 00000030.00000002.2672367606.00007FF8A80B8000.00000002.00000001.01000000.00000048.sdmp	String found in binary or memory: http://anglebug.com/7761disableProgramCachingDisables
Source: ComDebug.exe, 00000030.00000002.2672367606.00007FF8A80B8000.00000002.00000001.01000000.00000048.sdmp	String found in binary or memory: http://anglebug.com/8162
Source: ComDebug.exe, 00000030.00000002.2672367606.00007FF8A80B8000.00000002.00000001.01000000.00000048.sdmp	String found in binary or memory: http://anglebug.com/8172
Source: ComDebug.exe, 00000030.00000002.2672367606.00007FF8A80B8000.00000002.00000001.01000000.00000048.sdmp	String found in binary or memory: http://anglebug.com/8215
Source: ComDebug.exe, 00000030.00000002.2672367606.00007FF8A80B8000.00000002.00000001.01000000.00000048.sdmp	String found in binary or memory: http://anglebug.com/8229
Source: ComDebug.exe, 00000030.00000002.2672367606.00007FF8A80B8000.00000002.00000001.01000000.00000048.sdmp	String found in binary or memory: http://anglebug.com/8280
Source: ComDebug.exe, 00000030.00000002.2672367606.00007FF8A80B8000.00000002.00000001.01000000.00000048.sdmp	String found in binary or memory: http://anglebug.com/8280enableTranslatedShaderSubstitutionCheck
Source: ComDebug.exe, 00000030.00000002.2669360248.0000025FA3DB0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://c0rl.m%L
Source: xcopy.exe, 00000018.00000003.2403159655.00000297A19EA000.00000004.00000020.00020000.00000000.sdmp, ComDebug.exe, 00000030.00000002.2669578005.0000025FA4009000.00000004.00000020.00020000.00000000.sdmp, netsh.exe, 00000032.00000002.2825661828.0000000005235000.00000004.00000800.00020000.00000000.sdmp, Launcher.exe, 00000035.00000002.2857488192.0000000002774000.00000004.00000800.00020000.00000000.sdmp, is-7J76O.tmp.1.dr, is-PBM2F.tmp.1.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDCA-1.crt0
Source: ComDebug.exe, 00000030.00000002.2669578005.0000025FA4009000.00000004.00000020.00020000.00000000.sdmp, netsh.exe, 00000032.00000002.2825661828.0000000005235000.00000004.00000800.00020000.00000000.sdmp, Launcher.exe, 00000035.00000002.2857488192.0000000002774000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDCodeSigningCA-1.crt0
Source: PVUfopbGfc.tmp, 00000001.00000003.2675219520.00000000054B0000.00000004.00001000.00020000.00000000.sdmp, xcopy.exe, 00000018.00000003.2403159655.00000297A19EA000.00000004.00000020.00020000.00000000.sdmp, ComDebug.exe, 00000030.00000002.2669578005.0000025FA4009000.00000004.00000020.00020000.00000000.sdmp, netsh.exe, 00000032.00000002.2825661828.0000000005235000.00000004.00000800.00020000.00000000.sdmp, Launcher.exe, 00000035.00000002.2857488192.0000000002774000.00000004.00000800.00020000.00000000.sdmp, is-7J76O.tmp.1.dr, is-PBM2F.tmp.1.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
Source: PVUfopbGfc.tmp, 00000001.00000003.2675219520.00000000054B0000.00000004.00001000.00020000.00000000.sdmp, ComDebug.exe, 00000030.00000002.2669578005.0000025FA4009000.00000004.00000020.00020000.00000000.sdmp, netsh.exe, 00000032.00000002.2825661828.0000000005235000.00000004.00000800.00020000.00000000.sdmp, Launcher.exe, 00000035.00000002.2857488192.0000000002774000.00000004.00000800.00020000.00000000.sdmp, is-K9S0M.tmp.1.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: PVUfopbGfc.tmp, 00000001.00000003.2675219520.00000000054B0000.00000004.00001000.00020000.00000000.sdmp, is-K9S0M.tmp.1.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertCSRSA4096RootG5.crt0E
Source: PVUfopbGfc.tmp, 00000001.00000003.2675219520.00000000054B0000.00000004.00001000.00020000.00000000.sdmp, xcopy.exe, 00000018.00000003.2403159655.00000297A19EA000.00000004.00000020.00020000.00000000.sdmp, is-7J76O.tmp.1.dr, is-PBM2F.tmp.1.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertEVCodeSigningCA-SHA2.crt0
Source: PVUfopbGfc.tmp, 00000001.00000003.2675219520.00000000054B0000.00000004.00001000.00020000.00000000.sdmp, xcopy.exe, 00000018.00000003.2403159655.00000297A19EA000.00000004.00000020.00020000.00000000.sdmp, is-7J76O.tmp.1.dr, is-PBM2F.tmp.1.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertHighAssuranceEVRootCA.crt0
Source: PVUfopbGfc.tmp, 00000001.00000003.2675219520.00000000054B0000.00000004.00001000.00020000.00000000.sdmp, ComDebug.exe, 00000030.00000002.2669578005.0000025FA4009000.00000004.00000020.00020000.00000000.sdmp, netsh.exe, 00000032.00000002.2825661828.0000000005235000.00000004.00000800.00020000.00000000.sdmp, Launcher.exe, 00000035.00000002.2857488192.0000000002774000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDTimestampingCA.crt0
Source: PVUfopbGfc.tmp, 00000001.00000002.2700520104.000000000018C000.00000004.00000010.00020000.00000000.sdmp, PVUfopbGfc.tmp, 00000001.00000003.2675219520.00000000054B0000.00000004.00001000.00020000.00000000.sdmp, FastestVPN.exe, 00000022.00000002.3331690013.0000000008C0C000.00000004.00000020.00020000.00000000.sdmp, FastestVPN.exe, 00000022.00000002.3344745212.000000000B5B6000.00000004.00000020.00020000.00000000.sdmp, FastestVPN.WindowsService.exe, 0000002A.00000002.2608877205.00000000027F5000.00000004.00000800.00020000.00000000.sdmp, FastestVPN.WindowsService.exe, 0000002A.00000002.2606870926.0000000000AB7000.00000004.00000020.00020000.00000000.sdmp, is-O5MTV.tmp.1.dr, is-OTL5D.tmp.1.dr, is-21P0F.tmp.1.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crt0
Source: PVUfopbGfc.tmp, 00000001.00000003.2675219520.00000000054B0000.00000004.00001000.00020000.00000000.sdmp, ComDebug.exe, 00000030.00000002.2669578005.0000025FA4009000.00000004.00000020.00020000.00000000.sdmp, netsh.exe, 00000032.00000002.2825661828.0000000005235000.00000004.00000800.00020000.00000000.sdmp, Launcher.exe, 00000035.00000002.2857488192.0000000002774000.00000004.00000800.00020000.00000000.sdmp, is-K9S0M.tmp.1.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: PVUfopbGfc.tmp, 00000001.00000002.2700520104.000000000018C000.00000004.00000010.00020000.00000000.sdmp, PVUfopbGfc.tmp, 00000001.00000003.2675219520.00000000054B0000.00000004.00001000.00020000.00000000.sdmp, FastestVPN.WindowsService.exe, 0000001D.00000002.2583865767.0000000003286000.00000004.00000800.00020000.00000000.sdmp, ComDebug.exe, 00000030.00000002.2669578005.0000025FA4009000.00000004.00000020.00020000.00000000.sdmp, netsh.exe, 00000032.00000002.2825661828.0000000005235000.00000004.00000800.00020000.00000000.sdmp, Launcher.exe, 00000035.00000002.2857488192.0000000002774000.00000004.00000800.00020000.00000000.sdmp, is-O5MTV.tmp.1.dr, is-OTL5D.tmp.1.dr, is-K9S0M.tmp.1.dr, is-21P0F.tmp.1.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: PVUfopbGfc.tmp, 00000001.00000003.2675219520.00000000054B0000.00000004.00001000.00020000.00000000.sdmp, is-K9S0M.tmp.1.dr	String found in binary or memory: http://cacerts.digicert.com/NETFoundationProjectsCodeSigningCA2.crt0
Source: ComDebug.exe, 00000030.00000002.2672367606.00007FF8A80B8000.00000002.00000001.01000000.00000048.sdmp	String found in binary or memory: http://crbug.com/1094869
Source: ComDebug.exe, 00000030.00000002.2672367606.00007FF8A80B8000.00000002.00000001.01000000.00000048.sdmp	String found in binary or memory: http://crbug.com/110263
Source: ComDebug.exe, 00000030.00000002.2672367606.00007FF8A80B8000.00000002.00000001.01000000.00000048.sdmp	String found in binary or memory: http://crbug.com/1144207
Source: ComDebug.exe, 00000030.00000002.2672367606.00007FF8A80B8000.00000002.00000001.01000000.00000048.sdmp	String found in binary or memory: http://crbug.com/1171371
Source: ComDebug.exe, 00000030.00000002.2672367606.00007FF8A80B8000.00000002.00000001.01000000.00000048.sdmp	String found in binary or memory: http://crbug.com/1181068
Source: ComDebug.exe, 00000030.00000002.2672367606.00007FF8A80B8000.00000002.00000001.01000000.00000048.sdmp	String found in binary or memory: http://crbug.com/1181193
Source: ComDebug.exe, 00000030.00000002.2672367606.00007FF8A80B8000.00000002.00000001.01000000.00000048.sdmp	String found in binary or memory: http://crbug.com/1420130
Source: ComDebug.exe, 00000030.00000002.2672367606.00007FF8A80B8000.00000002.00000001.01000000.00000048.sdmp	String found in binary or memory: http://crbug.com/1434317
Source: ComDebug.exe, 00000030.00000002.2672367606.00007FF8A80B8000.00000002.00000001.01000000.00000048.sdmp	String found in binary or memory: http://crbug.com/1456243
Source: ComDebug.exe, 00000030.00000002.2672367606.00007FF8A80B8000.00000002.00000001.01000000.00000048.sdmp	String found in binary or memory: http://crbug.com/308366
Source: ComDebug.exe, 00000030.00000002.2672367606.00007FF8A80B8000.00000002.00000001.01000000.00000048.sdmp	String found in binary or memory: http://crbug.com/403957
Source: ComDebug.exe, 00000030.00000002.2672367606.00007FF8A80B8000.00000002.00000001.01000000.00000048.sdmp	String found in binary or memory: http://crbug.com/550292
Source: ComDebug.exe, 00000030.00000002.2672367606.00007FF8A80B8000.00000002.00000001.01000000.00000048.sdmp	String found in binary or memory: http://crbug.com/565179
Source: ComDebug.exe, 00000030.00000002.2672367606.00007FF8A80B8000.00000002.00000001.01000000.00000048.sdmp	String found in binary or memory: http://crbug.com/642227
Source: ComDebug.exe, 00000030.00000002.2672367606.00007FF8A80B8000.00000002.00000001.01000000.00000048.sdmp	String found in binary or memory: http://crbug.com/642605
Source: ComDebug.exe, 00000030.00000002.2672367606.00007FF8A80B8000.00000002.00000001.01000000.00000048.sdmp	String found in binary or memory: http://crbug.com/644669
Source: ComDebug.exe, 00000030.00000002.2672367606.00007FF8A80B8000.00000002.00000001.01000000.00000048.sdmp	String found in binary or memory: http://crbug.com/650547
Source: ComDebug.exe, 00000030.00000002.2672367606.00007FF8A80B8000.00000002.00000001.01000000.00000048.sdmp	String found in binary or memory: http://crbug.com/672380
Source: ComDebug.exe, 00000030.00000002.2672367606.00007FF8A80B8000.00000002.00000001.01000000.00000048.sdmp	String found in binary or memory: http://crbug.com/709351
Source: ComDebug.exe, 00000030.00000002.2672367606.00007FF8A80B8000.00000002.00000001.01000000.00000048.sdmp	String found in binary or memory: http://crbug.com/797243
Source: ComDebug.exe, 00000030.00000002.2672367606.00007FF8A80B8000.00000002.00000001.01000000.00000048.sdmp	String found in binary or memory: http://crbug.com/809422
Source: ComDebug.exe, 00000030.00000002.2672367606.00007FF8A80B8000.00000002.00000001.01000000.00000048.sdmp	String found in binary or memory: http://crbug.com/830046
Source: ComDebug.exe, 00000030.00000002.2672367606.00007FF8A80B8000.00000002.00000001.01000000.00000048.sdmp	String found in binary or memory: http://crbug.com/849576
Source: ComDebug.exe, 00000030.00000002.2672367606.00007FF8A80B8000.00000002.00000001.01000000.00000048.sdmp	String found in binary or memory: http://crbug.com/883276
Source: ComDebug.exe, 00000030.00000002.2672367606.00007FF8A80B8000.00000002.00000001.01000000.00000048.sdmp	String found in binary or memory: http://crbug.com/927470
Source: ComDebug.exe, 00000030.00000002.2672367606.00007FF8A80B8000.00000002.00000001.01000000.00000048.sdmp	String found in binary or memory: http://crbug.com/941620
Source: ComDebug.exe, 00000030.00000002.2672367606.00007FF8A80B8000.00000002.00000001.01000000.00000048.sdmp	String found in binary or memory: http://crbug.com/941620allowTranslateUniformBlockToStructuredBufferThere
Source: PVUfopbGfc.tmp, 00000001.00000003.2675219520.00000000054B0000.00000004.00001000.00020000.00000000.sdmp, ComDebug.exe, 00000030.00000002.2669578005.0000025FA4009000.00000004.00000020.00020000.00000000.sdmp, netsh.exe, 00000032.00000002.2825661828.0000000005235000.00000004.00000800.00020000.00000000.sdmp, Launcher.exe, 00000035.00000002.2857488192.0000000002774000.00000004.00000800.00020000.00000000.sdmp, is-1ASBC.tmp.1.dr, is-K889R.tmp.1.dr, is-71J6V.tmp.1.dr	String found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl04
Source: PVUfopbGfc.tmp, 00000001.00000002.2700520104.000000000018C000.00000004.00000010.00020000.00000000.sdmp, PVUfopbGfc.tmp, 00000001.00000003.2675219520.00000000054B0000.00000004.00001000.00020000.00000000.sdmp, FastestVPN.WindowsService.exe, 0000002A.00000002.2608775109.0000000000ED0000.00000004.00000020.00020000.00000000.sdmp, is-O5MTV.tmp.1.dr, is-OTL5D.tmp.1.dr, is-1ASBC.tmp.1.dr, is-K889R.tmp.1.dr, is-21P0F.tmp.1.dr, is-71J6V.tmp.1.dr	String found in binary or memory: http://crl.entrust.net/csbr1.crl0
Source: FastestVPN.WindowsService.exe, 0000002A.00000002.2606870926.0000000000AB7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.entrust.net/g2ca.c1
Source: PVUfopbGfc.tmp, 00000001.00000002.2700520104.000000000018C000.00000004.00000010.00020000.00000000.sdmp, PVUfopbGfc.tmp, 00000001.00000003.2675219520.00000000054B0000.00000004.00001000.00020000.00000000.sdmp, FastestVPN.WindowsService.exe, 0000002A.00000002.2608775109.0000000000ED0000.00000004.00000020.00020000.00000000.sdmp, is-O5MTV.tmp.1.dr, is-OTL5D.tmp.1.dr, is-1ASBC.tmp.1.dr, is-K889R.tmp.1.dr, is-21P0F.tmp.1.dr, is-71J6V.tmp.1.dr	String found in binary or memory: http://crl.entrust.net/g2ca.crl0
Source: PVUfopbGfc.tmp, 00000001.00000002.2700520104.000000000018C000.00000004.00000010.00020000.00000000.sdmp, PVUfopbGfc.tmp, 00000001.00000003.2675219520.00000000054B0000.00000004.00001000.00020000.00000000.sdmp, FastestVPN.WindowsService.exe, 0000002A.00000002.2608775109.0000000000ED0000.00000004.00000020.00020000.00000000.sdmp, FastestVPN.WindowsService.exe, 0000002A.00000002.2606870926.0000000000AB7000.00000004.00000020.00020000.00000000.sdmp, is-O5MTV.tmp.1.dr, is-OTL5D.tmp.1.dr, is-1ASBC.tmp.1.dr, is-K889R.tmp.1.dr, is-21P0F.tmp.1.dr, is-71J6V.tmp.1.dr	String found in binary or memory: http://crl.entrust.net/ts2ca.crl0
Source: PVUfopbGfc.tmp, 00000001.00000003.2675219520.00000000054B0000.00000004.00001000.00020000.00000000.sdmp, ComDebug.exe, 00000030.00000003.2658642223.0000025FA3CF1000.00000004.00000020.00020000.00000000.sdmp, ComDebug.exe, 00000030.00000003.2658999518.0000025FA3CF1000.00000004.00000020.00020000.00000000.sdmp, ComDebug.exe, 00000030.00000003.2656545355.0000025FA3CF1000.00000004.00000020.00020000.00000000.sdmp, ComDebug.exe, 00000030.00000003.2656053801.0000025FA3F72000.00000004.00000020.00020000.00000000.sdmp, ComDebug.exe, 00000030.00000003.2655997626.0000025FA3CF2000.00000004.00000020.00020000.00000000.sdmp, ComDebug.exe, 00000030.00000003.2641290540.0000025FA46F0000.00000004.00000001.00020000.00000000.sdmp, is-QN5KA.tmp.1.dr, file_selector_windows_plugin.dll.48.dr, is-QG142.tmp.1.dr, is-1ASBC.tmp.1.dr, is-K889R.tmp.1.dr, is-71J6V.tmp.1.dr	String found in binary or memory: http://crl.sectigo.com/SectigoPublicCodeSigningCAEVR36.crl0
Source: PVUfopbGfc.tmp, 00000001.00000003.2675219520.00000000054B0000.00000004.00001000.00020000.00000000.sdmp, ComDebug.exe, 00000030.00000002.2669578005.0000025FA4009000.00000004.00000020.00020000.00000000.sdmp, netsh.exe, 00000032.00000002.2825661828.0000000005235000.00000004.00000800.00020000.00000000.sdmp, Launcher.exe, 00000035.00000002.2857488192.0000000002774000.00000004.00000800.00020000.00000000.sdmp, is-1ASBC.tmp.1.dr, is-K889R.tmp.1.dr, is-71J6V.tmp.1.dr	String found in binary or memory: http://crl.sectigo.com/SectigoPublicCodeSigningRootR46.crl0
Source: ComDebug.exe, 00000030.00000003.2658642223.0000025FA3CF1000.00000004.00000020.00020000.00000000.sdmp, ComDebug.exe, 00000030.00000003.2658999518.0000025FA3CF1000.00000004.00000020.00020000.00000000.sdmp, ComDebug.exe, 00000030.00000003.2656545355.0000025FA3CF1000.00000004.00000020.00020000.00000000.sdmp, ComDebug.exe, 00000030.00000003.2656053801.0000025FA3F72000.00000004.00000020.00020000.00000000.sdmp, ComDebug.exe, 00000030.00000003.2655997626.0000025FA3CF2000.00000004.00000020.00020000.00000000.sdmp, ComDebug.exe, 00000030.00000003.2641290540.0000025FA46F0000.00000004.00000001.00020000.00000000.sdmp, is-QN5KA.tmp.1.dr, file_selector_windows_plugin.dll.48.dr, is-QG142.tmp.1.dr	String found in binary or memory: http://crl.sectigo.com/SectigoRSATimeStampingCA.crl0t
Source: svchost.exe, 00000021.00000002.3301375524.00000197506D3000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000021.00000003.2448782040.00000197506DB000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000026.00000002.3304311299.000001A809400000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: FastestVPN.exe, 00000022.00000002.3344745212.000000000B5B6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.xrampsecurity.com/XGCA.crl0
Source: xcopy.exe, 00000018.00000003.2403159655.00000297A19EA000.00000004.00000020.00020000.00000000.sdmp, ComDebug.exe, 00000030.00000002.2669578005.0000025FA4009000.00000004.00000020.00020000.00000000.sdmp, netsh.exe, 00000032.00000002.2825661828.0000000005235000.00000004.00000800.00020000.00000000.sdmp, Launcher.exe, 00000035.00000002.2857488192.0000000002774000.00000004.00000800.00020000.00000000.sdmp, is-7J76O.tmp.1.dr, is-PBM2F.tmp.1.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDCA-1.crl08
Source: PVUfopbGfc.tmp, 00000001.00000003.2675219520.00000000054B0000.00000004.00001000.00020000.00000000.sdmp, ComDebug.exe, 00000030.00000002.2669578005.0000025FA4009000.00000004.00000020.00020000.00000000.sdmp, netsh.exe, 00000032.00000002.2825661828.0000000005235000.00000004.00000800.00020000.00000000.sdmp, Launcher.exe, 00000035.00000002.2857488192.0000000002774000.00000004.00000800.00020000.00000000.sdmp, is-K9S0M.tmp.1.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: xcopy.exe, 00000018.00000003.2403159655.00000297A19EA000.00000004.00000020.00020000.00000000.sdmp, ComDebug.exe, 00000030.00000002.2669578005.0000025FA4009000.00000004.00000020.00020000.00000000.sdmp, netsh.exe, 00000032.00000002.2825661828.0000000005235000.00000004.00000800.00020000.00000000.sdmp, Launcher.exe, 00000035.00000002.2857488192.0000000002774000.00000004.00000800.00020000.00000000.sdmp, is-7J76O.tmp.1.dr, is-PBM2F.tmp.1.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: PVUfopbGfc.tmp, 00000001.00000003.2675219520.00000000054B0000.00000004.00001000.00020000.00000000.sdmp, ComDebug.exe, 00000030.00000002.2669578005.0000025FA4009000.00000004.00000020.00020000.00000000.sdmp, netsh.exe, 00000032.00000002.2825661828.0000000005235000.00000004.00000800.00020000.00000000.sdmp, Launcher.exe, 00000035.00000002.2857488192.0000000002774000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0P
Source: PVUfopbGfc.tmp, 00000001.00000003.2675219520.00000000054B0000.00000004.00001000.00020000.00000000.sdmp, is-K9S0M.tmp.1.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertCSRSA4096RootG5.crl0
Source: PVUfopbGfc.tmp, 00000001.00000003.2675219520.00000000054B0000.00000004.00001000.00020000.00000000.sdmp, xcopy.exe, 00000018.00000003.2403159655.00000297A19EA000.00000004.00000020.00020000.00000000.sdmp, is-7J76O.tmp.1.dr, is-PBM2F.tmp.1.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertHighAssuranceEVRootCA.crl0
Source: PVUfopbGfc.tmp, 00000001.00000002.2700520104.000000000018C000.00000004.00000010.00020000.00000000.sdmp, PVUfopbGfc.tmp, 00000001.00000003.2675219520.00000000054B0000.00000004.00001000.00020000.00000000.sdmp, FastestVPN.exe, 00000022.00000002.3331690013.0000000008C0C000.00000004.00000020.00020000.00000000.sdmp, FastestVPN.exe, 00000022.00000002.3344745212.000000000B5B6000.00000004.00000020.00020000.00000000.sdmp, FastestVPN.WindowsService.exe, 0000002A.00000002.2608877205.00000000027F5000.00000004.00000800.00020000.00000000.sdmp, FastestVPN.WindowsService.exe, 0000002A.00000002.2606870926.0000000000AB7000.00000004.00000020.00020000.00000000.sdmp, is-O5MTV.tmp.1.dr, is-OTL5D.tmp.1.dr, is-21P0F.tmp.1.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0S
Source: PVUfopbGfc.tmp, 00000001.00000003.2675219520.00000000054B0000.00000004.00001000.00020000.00000000.sdmp, ComDebug.exe, 00000030.00000002.2669578005.0000025FA4009000.00000004.00000020.00020000.00000000.sdmp, netsh.exe, 00000032.00000002.2825661828.0000000005235000.00000004.00000800.00020000.00000000.sdmp, Launcher.exe, 00000035.00000002.2857488192.0000000002774000.00000004.00000800.00020000.00000000.sdmp, is-K9S0M.tmp.1.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: PVUfopbGfc.tmp, 00000001.00000003.2675219520.00000000054B0000.00000004.00001000.00020000.00000000.sdmp, ComDebug.exe, 00000030.00000002.2669578005.0000025FA4009000.00000004.00000020.00020000.00000000.sdmp, netsh.exe, 00000032.00000002.2825661828.0000000005235000.00000004.00000800.00020000.00000000.sdmp, Launcher.exe, 00000035.00000002.2857488192.0000000002774000.00000004.00000800.00020000.00000000.sdmp, is-O5MTV.tmp.1.dr, is-OTL5D.tmp.1.dr, is-K9S0M.tmp.1.dr, is-21P0F.tmp.1.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: PVUfopbGfc.tmp, 00000001.00000003.2675219520.00000000054B0000.00000004.00001000.00020000.00000000.sdmp, xcopy.exe, 00000018.00000003.2403159655.00000297A19EA000.00000004.00000020.00020000.00000000.sdmp, is-7J76O.tmp.1.dr, is-PBM2F.tmp.1.dr	String found in binary or memory: http://crl3.digicert.com/EVCodeSigningSHA2-g1.crl07
Source: PVUfopbGfc.tmp, 00000001.00000003.2675219520.00000000054B0000.00000004.00001000.00020000.00000000.sdmp, is-K9S0M.tmp.1.dr	String found in binary or memory: http://crl3.digicert.com/NETFoundationProjectsCodeSigningCA2.crl0F
Source: ComDebug.exe, 00000030.00000002.2669578005.0000025FA4009000.00000004.00000020.00020000.00000000.sdmp, netsh.exe, 00000032.00000002.2825661828.0000000005235000.00000004.00000800.00020000.00000000.sdmp, Launcher.exe, 00000035.00000002.2857488192.0000000002774000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/assured-cs-g1.crl00
Source: PVUfopbGfc.tmp, 00000001.00000003.2675219520.00000000054B0000.00000004.00001000.00020000.00000000.sdmp, ComDebug.exe, 00000030.00000002.2669578005.0000025FA4009000.00000004.00000020.00020000.00000000.sdmp, netsh.exe, 00000032.00000002.2825661828.0000000005235000.00000004.00000800.00020000.00000000.sdmp, Launcher.exe, 00000035.00000002.2857488192.0000000002774000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/sha2-assured-ts.crl02
Source: xcopy.exe, 00000018.00000003.2403159655.00000297A19EA000.00000004.00000020.00020000.00000000.sdmp, ComDebug.exe, 00000030.00000002.2669578005.0000025FA4009000.00000004.00000020.00020000.00000000.sdmp, netsh.exe, 00000032.00000002.2825661828.0000000005235000.00000004.00000800.00020000.00000000.sdmp, Launcher.exe, 00000035.00000002.2857488192.0000000002774000.00000004.00000800.00020000.00000000.sdmp, is-7J76O.tmp.1.dr, is-PBM2F.tmp.1.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDCA-1.crl0w
Source: xcopy.exe, 00000018.00000003.2403159655.00000297A19EA000.00000004.00000020.00020000.00000000.sdmp, ComDebug.exe, 00000030.00000002.2669578005.0000025FA4009000.00000004.00000020.00020000.00000000.sdmp, netsh.exe, 00000032.00000002.2825661828.0000000005235000.00000004.00000800.00020000.00000000.sdmp, Launcher.exe, 00000035.00000002.2857488192.0000000002774000.00000004.00000800.00020000.00000000.sdmp, is-7J76O.tmp.1.dr, is-PBM2F.tmp.1.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: PVUfopbGfc.tmp, 00000001.00000003.2675219520.00000000054B0000.00000004.00001000.00020000.00000000.sdmp, ComDebug.exe, 00000030.00000002.2669578005.0000025FA4009000.00000004.00000020.00020000.00000000.sdmp, netsh.exe, 00000032.00000002.2825661828.0000000005235000.00000004.00000800.00020000.00000000.sdmp, Launcher.exe, 00000035.00000002.2857488192.0000000002774000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: PVUfopbGfc.tmp, 00000001.00000003.2675219520.00000000054B0000.00000004.00001000.00020000.00000000.sdmp, xcopy.exe, 00000018.00000003.2403159655.00000297A19EA000.00000004.00000020.00020000.00000000.sdmp, is-7J76O.tmp.1.dr, is-PBM2F.tmp.1.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertHighAssuranceEVRootCA.crl0
Source: PVUfopbGfc.tmp, 00000001.00000002.2700520104.000000000018C000.00000004.00000010.00020000.00000000.sdmp, PVUfopbGfc.tmp, 00000001.00000003.2675219520.00000000054B0000.00000004.00001000.00020000.00000000.sdmp, FastestVPN.exe, 00000022.00000002.3331690013.0000000008C0C000.00000004.00000020.00020000.00000000.sdmp, FastestVPN.exe, 00000022.00000002.3344745212.000000000B5B6000.00000004.00000020.00020000.00000000.sdmp, FastestVPN.WindowsService.exe, 0000002A.00000002.2608877205.00000000027F5000.00000004.00000800.00020000.00000000.sdmp, FastestVPN.WindowsService.exe, 0000002A.00000002.2606870926.0000000000AB7000.00000004.00000020.00020000.00000000.sdmp, is-O5MTV.tmp.1.dr, is-OTL5D.tmp.1.dr, is-21P0F.tmp.1.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0
Source: PVUfopbGfc.tmp, 00000001.00000003.2675219520.00000000054B0000.00000004.00001000.00020000.00000000.sdmp, xcopy.exe, 00000018.00000003.2403159655.00000297A19EA000.00000004.00000020.00020000.00000000.sdmp, is-7J76O.tmp.1.dr, is-PBM2F.tmp.1.dr	String found in binary or memory: http://crl4.digicert.com/EVCodeSigningSHA2-g1.crl0K
Source: PVUfopbGfc.tmp, 00000001.00000003.2675219520.00000000054B0000.00000004.00001000.00020000.00000000.sdmp, is-K9S0M.tmp.1.dr	String found in binary or memory: http://crl4.digicert.com/NETFoundationProjectsCodeSigningCA2.crl0=
Source: ComDebug.exe, 00000030.00000002.2669578005.0000025FA4009000.00000004.00000020.00020000.00000000.sdmp, netsh.exe, 00000032.00000002.2825661828.0000000005235000.00000004.00000800.00020000.00000000.sdmp, Launcher.exe, 00000035.00000002.2857488192.0000000002774000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/assured-cs-g1.crl0L
Source: PVUfopbGfc.tmp, 00000001.00000003.2675219520.00000000054B0000.00000004.00001000.00020000.00000000.sdmp, ComDebug.exe, 00000030.00000002.2669578005.0000025FA4009000.00000004.00000020.00020000.00000000.sdmp, netsh.exe, 00000032.00000002.2825661828.0000000005235000.00000004.00000800.00020000.00000000.sdmp, Launcher.exe, 00000035.00000002.2857488192.0000000002774000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/sha2-assured-ts.crl0
Source: PVUfopbGfc.tmp, 00000001.00000003.2675219520.00000000054B0000.00000004.00001000.00020000.00000000.sdmp, ComDebug.exe, 00000030.00000003.2658642223.0000025FA3CF1000.00000004.00000020.00020000.00000000.sdmp, ComDebug.exe, 00000030.00000003.2658999518.0000025FA3CF1000.00000004.00000020.00020000.00000000.sdmp, ComDebug.exe, 00000030.00000003.2656545355.0000025FA3CF1000.00000004.00000020.00020000.00000000.sdmp, ComDebug.exe, 00000030.00000003.2656053801.0000025FA3F72000.00000004.00000020.00020000.00000000.sdmp, ComDebug.exe, 00000030.00000003.2655997626.0000025FA3CF2000.00000004.00000020.00020000.00000000.sdmp, ComDebug.exe, 00000030.00000003.2641290540.0000025FA46F0000.00000004.00000001.00020000.00000000.sdmp, is-QN5KA.tmp.1.dr, file_selector_windows_plugin.dll.48.dr, is-QG142.tmp.1.dr, is-1ASBC.tmp.1.dr, is-K889R.tmp.1.dr, is-71J6V.tmp.1.dr	String found in binary or memory: http://crt.sectigo.com/SectigoPublicCodeSigningCAEVR36.crt0#
Source: PVUfopbGfc.tmp, 00000001.00000003.2675219520.00000000054B0000.00000004.00001000.00020000.00000000.sdmp, ComDebug.exe, 00000030.00000002.2669578005.0000025FA4009000.00000004.00000020.00020000.00000000.sdmp, netsh.exe, 00000032.00000002.2825661828.0000000005235000.00000004.00000800.00020000.00000000.sdmp, Launcher.exe, 00000035.00000002.2857488192.0000000002774000.00000004.00000800.00020000.00000000.sdmp, is-1ASBC.tmp.1.dr, is-K889R.tmp.1.dr, is-71J6V.tmp.1.dr	String found in binary or memory: http://crt.sectigo.com/SectigoPublicCodeSigningRootR46.p7c0#
Source: ComDebug.exe, 00000030.00000003.2658642223.0000025FA3CF1000.00000004.00000020.00020000.00000000.sdmp, ComDebug.exe, 00000030.00000003.2658999518.0000025FA3CF1000.00000004.00000020.00020000.00000000.sdmp, ComDebug.exe, 00000030.00000003.2656545355.0000025FA3CF1000.00000004.00000020.00020000.00000000.sdmp, ComDebug.exe, 00000030.00000003.2656053801.0000025FA3F72000.00000004.00000020.00020000.00000000.sdmp, ComDebug.exe, 00000030.00000003.2655997626.0000025FA3CF2000.00000004.00000020.00020000.00000000.sdmp, ComDebug.exe, 00000030.00000003.2641290540.0000025FA46F0000.00000004.00000001.00020000.00000000.sdmp, is-QN5KA.tmp.1.dr, file_selector_windows_plugin.dll.48.dr, is-QG142.tmp.1.dr	String found in binary or memory: http://crt.sectigo.com/SectigoRSATimeStampingCA.crt0#
Source: FastestVPN.exe, 00000022.00000002.3331690013.0000000008C26000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: FastestVPN.exe, 00000022.00000002.3342464783.000000000B552000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en8?7
Source: FastestVPN.exe, 00000022.00000002.3305231314.00000000031FA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/FastestVPN;component/Assets/Fonts/outfit-variablefont_wght.ttf
Source: FastestVPN.exe, 00000022.00000002.3305231314.00000000031FA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/FastestVPN;component/Assets/Fonts/outfit-variablefont_wght.ttfd
Source: svchost.exe, 00000021.00000003.2542019425.0000019750F76000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-
Source: svchost.exe, 00000021.00000003.2542019425.0000019750F76000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xs
Source: svchost.exe, 00000021.00000003.2554874023.0000019750F79000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000021.00000003.2555530538.00000197506CF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd
Source: svchost.exe, 00000021.00000003.2515025768.0000019750F0F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000021.00000003.2541963970.0000019750F0E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000021.00000003.2502614487.0000019750F0E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000021.00000003.2485031511.0000019750F0E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000021.00000003.2485860339.0000019750F0E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000021.00000003.2482424566.0000019750F0E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000021.00000003.2484074276.0000019750F0F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000021.00000003.2542242711.0000019750F0E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000021.00000003.2541905024.0000019750F0E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000021.00000003.2514709235.0000019750F0E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000021.00000003.2541777762.0000019750F0E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000021.00000003.2570912887.0000019750F0E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000021.00000003.2849328017.0000019750F0E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000021.00000003.2485114424.0000019750F0E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000021.00000003.2514995683.0000019750F0F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000021.00000003.2483362613.0000019750F0E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000021.00000003.2485516356.0000019750F0E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000021.00000003.2515057313.0000019750F0F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000021.00000003.2555792443.0000019750F0E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000021.00000003.2514967036.0000019750F0E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000021.00000003.2570806401.0000019750F0E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsdAA
Source: svchost.exe, 00000021.00000003.2501552028.0000019750F29000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsdAAAAAA
Source: svchost.exe, 00000021.00000003.2533154446.0000019750F6D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000021.00000003.2533181374.0000019750F77000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000021.00000003.2542019425.0000019750F76000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsdes
Source: svchost.exe, 00000021.00000003.2452981401.0000019750F52000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsdjbJ
Source: svchost.exe, 00000021.00000003.2542019425.0000019750F76000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000021.00000002.3302496212.0000019750F82000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd
Source: svchost.exe, 00000021.00000003.2515025768.0000019750F0F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000021.00000003.2541963970.0000019750F0E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000021.00000003.2502614487.0000019750F0E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000021.00000003.2485031511.0000019750F0E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000021.00000003.2485860339.0000019750F0E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000021.00000003.2482424566.0000019750F0E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000021.00000003.2484074276.0000019750F0F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000021.00000003.2542242711.0000019750F0E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000021.00000003.2541905024.0000019750F0E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000021.00000003.2514709235.0000019750F0E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000021.00000003.2541777762.0000019750F0E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000021.00000003.2570912887.0000019750F0E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000021.00000003.2849328017.0000019750F0E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000021.00000003.2485114424.0000019750F0E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000021.00000003.2514995683.0000019750F0F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000021.00000003.2483362613.0000019750F0E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000021.00000003.2485516356.0000019750F0E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000021.00000003.2515057313.0000019750F0F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000021.00000003.2555792443.0000019750F0E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000021.00000003.2514967036.0000019750F0E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000021.00000003.2570806401.0000019750F0E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsdA
Source: svchost.exe, 00000021.00000003.2501552028.0000019750F29000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsdAAAA
Source: svchost.exe, 00000021.00000003.2501552028.0000019750F29000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsdAAAAA
Source: svchost.exe, 00000021.00000003.2554874023.0000019750F79000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsdP
Source: svchost.exe, 00000021.00000003.2452981401.0000019750F52000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsdmlns:
Source: svchost.exe, 00000021.00000003.2849192138.0000019750F6E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsdxV
Source: svchost.exe, 00000021.00000002.3302943187.000001975141B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/XX/oasis-2004XX-wss-saml-token-profile-1.0#SAMLAssertionID
Source: svchost.exe, 00000026.00000003.2482684273.000001A809250000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: FastestVPN.exe, 00000022.00000002.3342464783.000000000B584000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://fedir.comsign.co.il/crl/ComSignSecuredCA.crl0
Source: FastestVPN.exe, FastestVPN.exe, 00000022.00000002.3325390125.0000000005DE2000.00000002.00000001.01000000.0000001E.sdmp	String found in binary or memory: http://ip-api.com/json
Source: ComDebug.exe, 00000030.00000002.2672367606.00007FF8A80B8000.00000002.00000001.01000000.00000048.sdmp	String found in binary or memory: http://issuetracker.google.com/200067929
Source: FastestVPN.WindowsService.exe, 0000002F.00000002.3314344281.0000000004802000.00000002.00000001.01000000.0000004B.sdmp, is-K9S0M.tmp.1.dr	String found in binary or memory: http://james.newtonking.com/projects/json
Source: ComDebug.exe, 00000030.00000002.2672367606.00007FF8A80B8000.00000002.00000001.01000000.00000048.sdmp	String found in binary or memory: http://labs.creativecommons.org/licenses/zero-waive/1.0/us/legalcodeRegularVersion
Source: powershell.exe, 00000023.00000002.2497354949.000000000649B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://nuget.org/NuGet.exe
Source: PVUfopbGfc.tmp, 00000001.00000003.2675219520.00000000054B0000.00000004.00001000.00020000.00000000.sdmp, ComDebug.exe, 00000030.00000002.2669578005.0000025FA4009000.00000004.00000020.00020000.00000000.sdmp, netsh.exe, 00000032.00000002.2825661828.0000000005235000.00000004.00000800.00020000.00000000.sdmp, Launcher.exe, 00000035.00000002.2857488192.0000000002774000.00000004.00000800.00020000.00000000.sdmp, is-1ASBC.tmp.1.dr, is-K889R.tmp.1.dr, is-71J6V.tmp.1.dr	String found in binary or memory: http://ocsp.comodoca.com0
Source: ComDebug.exe, 00000030.00000002.2669360248.0000025FA3DB0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.co
Source: PVUfopbGfc.tmp, 00000001.00000002.2700520104.000000000018C000.00000004.00000010.00020000.00000000.sdmp, PVUfopbGfc.tmp, 00000001.00000003.2675219520.00000000054B0000.00000004.00001000.00020000.00000000.sdmp, FastestVPN.exe, 00000022.00000002.3331690013.0000000008C0C000.00000004.00000020.00020000.00000000.sdmp, FastestVPN.exe, 00000022.00000002.3344745212.000000000B5B6000.00000004.00000020.00020000.00000000.sdmp, FastestVPN.WindowsService.exe, 0000002A.00000002.2608877205.00000000027F5000.00000004.00000800.00020000.00000000.sdmp, FastestVPN.WindowsService.exe, 0000002A.00000002.2606870926.0000000000AB7000.00000004.00000020.00020000.00000000.sdmp, is-O5MTV.tmp.1.dr, is-OTL5D.tmp.1.dr, is-21P0F.tmp.1.dr	String found in binary or memory: http://ocsp.digicert.com0
Source: PVUfopbGfc.tmp, 00000001.00000002.2700520104.000000000018C000.00000004.00000010.00020000.00000000.sdmp, PVUfopbGfc.tmp, 00000001.00000003.2675219520.00000000054B0000.00000004.00001000.00020000.00000000.sdmp, xcopy.exe, 00000018.00000003.2403159655.00000297A19EA000.00000004.00000020.00020000.00000000.sdmp, FastestVPN.WindowsService.exe, 0000001D.00000002.2583865767.0000000003286000.00000004.00000800.00020000.00000000.sdmp, ComDebug.exe, 00000030.00000002.2669578005.0000025FA4009000.00000004.00000020.00020000.00000000.sdmp, netsh.exe, 00000032.00000002.2825661828.0000000005235000.00000004.00000800.00020000.00000000.sdmp, Launcher.exe, 00000035.00000002.2857488192.0000000002774000.00000004.00000800.00020000.00000000.sdmp, is-O5MTV.tmp.1.dr, is-OTL5D.tmp.1.dr, is-7J76O.tmp.1.dr, is-PBM2F.tmp.1.dr, is-K9S0M.tmp.1.dr, is-21P0F.tmp.1.dr	String found in binary or memory: http://ocsp.digicert.com0A
Source: PVUfopbGfc.tmp, 00000001.00000003.2675219520.00000000054B0000.00000004.00001000.00020000.00000000.sdmp, xcopy.exe, 00000018.00000003.2403159655.00000297A19EA000.00000004.00000020.00020000.00000000.sdmp, ComDebug.exe, 00000030.00000002.2669578005.0000025FA4009000.00000004.00000020.00020000.00000000.sdmp, netsh.exe, 00000032.00000002.2825661828.0000000005235000.00000004.00000800.00020000.00000000.sdmp, Launcher.exe, 00000035.00000002.2857488192.0000000002774000.00000004.00000800.00020000.00000000.sdmp, is-7J76O.tmp.1.dr, is-PBM2F.tmp.1.dr, is-K9S0M.tmp.1.dr	String found in binary or memory: http://ocsp.digicert.com0C
Source: PVUfopbGfc.tmp, 00000001.00000003.2675219520.00000000054B0000.00000004.00001000.00020000.00000000.sdmp, xcopy.exe, 00000018.00000003.2403159655.00000297A19EA000.00000004.00000020.00020000.00000000.sdmp, is-7J76O.tmp.1.dr, is-PBM2F.tmp.1.dr	String found in binary or memory: http://ocsp.digicert.com0H
Source: PVUfopbGfc.tmp, 00000001.00000003.2675219520.00000000054B0000.00000004.00001000.00020000.00000000.sdmp, xcopy.exe, 00000018.00000003.2403159655.00000297A19EA000.00000004.00000020.00020000.00000000.sdmp, is-7J76O.tmp.1.dr, is-PBM2F.tmp.1.dr	String found in binary or memory: http://ocsp.digicert.com0I
Source: ComDebug.exe, 00000030.00000002.2669578005.0000025FA4009000.00000004.00000020.00020000.00000000.sdmp, netsh.exe, 00000032.00000002.2825661828.0000000005235000.00000004.00000800.00020000.00000000.sdmp, Launcher.exe, 00000035.00000002.2857488192.0000000002774000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0L
Source: PVUfopbGfc.tmp, 00000001.00000003.2675219520.00000000054B0000.00000004.00001000.00020000.00000000.sdmp, ComDebug.exe, 00000030.00000002.2669578005.0000025FA4009000.00000004.00000020.00020000.00000000.sdmp, netsh.exe, 00000032.00000002.2825661828.0000000005235000.00000004.00000800.00020000.00000000.sdmp, Launcher.exe, 00000035.00000002.2857488192.0000000002774000.00000004.00000800.00020000.00000000.sdmp, is-K9S0M.tmp.1.dr	String found in binary or memory: http://ocsp.digicert.com0O
Source: PVUfopbGfc.tmp, 00000001.00000003.2675219520.00000000054B0000.00000004.00001000.00020000.00000000.sdmp, ComDebug.exe, 00000030.00000002.2669578005.0000025FA4009000.00000004.00000020.00020000.00000000.sdmp, netsh.exe, 00000032.00000002.2825661828.0000000005235000.00000004.00000800.00020000.00000000.sdmp, Launcher.exe, 00000035.00000002.2857488192.0000000002774000.00000004.00000800.00020000.00000000.sdmp, is-K9S0M.tmp.1.dr	String found in binary or memory: http://ocsp.digicert.com0X
Source: PVUfopbGfc.tmp, 00000001.00000002.2700520104.000000000018C000.00000004.00000010.00020000.00000000.sdmp, PVUfopbGfc.tmp, 00000001.00000003.2675219520.00000000054B0000.00000004.00001000.00020000.00000000.sdmp, FastestVPN.WindowsService.exe, 0000002A.00000002.2608775109.0000000000ED0000.00000004.00000020.00020000.00000000.sdmp, FastestVPN.WindowsService.exe, 0000002A.00000002.2606870926.0000000000AB7000.00000004.00000020.00020000.00000000.sdmp, is-O5MTV.tmp.1.dr, is-OTL5D.tmp.1.dr, is-1ASBC.tmp.1.dr, is-K889R.tmp.1.dr, is-21P0F.tmp.1.dr, is-71J6V.tmp.1.dr	String found in binary or memory: http://ocsp.entrust.net00
Source: PVUfopbGfc.tmp, 00000001.00000002.2700520104.000000000018C000.00000004.00000010.00020000.00000000.sdmp, PVUfopbGfc.tmp, 00000001.00000003.2675219520.00000000054B0000.00000004.00001000.00020000.00000000.sdmp, FastestVPN.WindowsService.exe, 0000002A.00000002.2608775109.0000000000ED0000.00000004.00000020.00020000.00000000.sdmp, is-O5MTV.tmp.1.dr, is-OTL5D.tmp.1.dr, is-1ASBC.tmp.1.dr, is-K889R.tmp.1.dr, is-21P0F.tmp.1.dr, is-71J6V.tmp.1.dr	String found in binary or memory: http://ocsp.entrust.net01
Source: PVUfopbGfc.tmp, 00000001.00000002.2700520104.000000000018C000.00000004.00000010.00020000.00000000.sdmp, PVUfopbGfc.tmp, 00000001.00000003.2675219520.00000000054B0000.00000004.00001000.00020000.00000000.sdmp, FastestVPN.WindowsService.exe, 0000002A.00000002.2608775109.0000000000ED0000.00000004.00000020.00020000.00000000.sdmp, FastestVPN.WindowsService.exe, 0000002A.00000002.2606870926.0000000000AB7000.00000004.00000020.00020000.00000000.sdmp, is-O5MTV.tmp.1.dr, is-OTL5D.tmp.1.dr, is-1ASBC.tmp.1.dr, is-K889R.tmp.1.dr, is-21P0F.tmp.1.dr, is-71J6V.tmp.1.dr	String found in binary or memory: http://ocsp.entrust.net03
Source: ComDebug.exe, 00000030.00000003.2658999518.0000025FA3CF1000.00000004.00000020.00020000.00000000.sdmp, ComDebug.exe, 00000030.00000002.2669578005.0000025FA4009000.00000004.00000020.00020000.00000000.sdmp, ComDebug.exe, 00000030.00000003.2656545355.0000025FA3CF1000.00000004.00000020.00020000.00000000.sdmp, ComDebug.exe, 00000030.00000003.2656053801.0000025FA3F72000.00000004.00000020.00020000.00000000.sdmp, ComDebug.exe, 00000030.00000003.2655997626.0000025FA3CF2000.00000004.00000020.00020000.00000000.sdmp, ComDebug.exe, 00000030.00000003.2641290540.0000025FA46F0000.00000004.00000001.00020000.00000000.sdmp, netsh.exe, 00000032.00000002.2825661828.0000000005235000.00000004.00000800.00020000.00000000.sdmp, Launcher.exe, 00000035.00000002.2857488192.0000000002774000.00000004.00000800.00020000.00000000.sdmp, is-QN5KA.tmp.1.dr, file_selector_windows_plugin.dll.48.dr, is-QG142.tmp.1.dr, is-1ASBC.tmp.1.dr, is-K889R.tmp.1.dr, is-71J6V.tmp.1.dr	String found in binary or memory: http://ocsp.sectigo.com0
Source: PVUfopbGfc.tmp, 00000001.00000003.2675219520.00000000054B0000.00000004.00001000.00020000.00000000.sdmp, is-1ASBC.tmp.1.dr, is-K889R.tmp.1.dr, is-71J6V.tmp.1.dr	String found in binary or memory: http://ocsp.sectigo.com0.
Source: svchost.exe, 00000021.00000002.3302943187.000001975141B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000021.00000003.2520630226.0000019751404000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://passport.net/tb
Source: powershell.exe, 00000023.00000002.2491969070.0000000005582000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://pesterbdd.com/images/Pester.png
Source: FastestVPN.WindowsService.exe, 0000002A.00000002.2608877205.00000000027F5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.datacontract.org
Source: FastestVPN.WindowsService.exe, 0000002A.00000002.2608877205.00000000027F5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.datacontract.org/2004/07/
Source: FastestVPN.WindowsService.exe, 0000002A.00000002.2608877205.00000000027F5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.datacontract.org/2004/07/System.ServiceProcess
Source: FastestVPN.WindowsService.exe, 0000002A.00000002.2608877205.00000000027F5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.datacontract.org/2004/07/System.ServiceProcessd
Source: FastestVPN.exe, 00000022.00000002.3305231314.0000000002EB1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/encoding/
Source: svchost.exe, 00000021.00000003.2485031511.0000019750F0E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000021.00000003.2482424566.0000019750F0E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000021.00000003.2484074276.0000019750F0F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000021.00000003.2485114424.0000019750F0E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000021.00000003.2483362613.0000019750F0E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000021.00000002.3302224787.0000019750F5F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/envelope/
Source: svchost.exe, 00000021.00000002.3302127607.0000019750F37000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000021.00000003.2502574094.0000019750F3B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing/role/anonymous
Source: svchost.exe, 00000021.00000002.3302070338.0000019750F13000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000021.00000003.2849011574.0000019750F74000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000021.00000003.2490193566.0000019750F66000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/09/policy
Source: svchost.exe, 00000021.00000003.2533154446.0000019750F6D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000021.00000003.2849192138.0000019750F6E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000021.00000003.2490193566.0000019750F66000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000021.00000002.3302371401.0000019750F6F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/09/policy=80600
Source: svchost.exe, 00000021.00000002.3302070338.0000019750F13000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000021.00000003.2849011574.0000019750F74000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000021.00000002.3302224787.0000019750F5F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/sc
Source: svchost.exe, 00000021.00000002.3302127607.0000019750F37000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/scce
Source: svchost.exe, 00000021.00000002.3302127607.0000019750F37000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000021.00000003.2541777762.0000019750F0E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000021.00000003.2849328017.0000019750F0E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000021.00000003.2858748001.0000019750F66000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000021.00000002.3302070338.0000019750F13000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000021.00000003.2526630515.0000019750F5A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000021.00000003.2502574094.0000019750F3B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000021.00000003.2849011574.0000019750F74000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000021.00000003.2490193566.0000019750F66000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000021.00000003.2526603315.0000019750F52000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000021.00000002.3302224787.0000019750F5F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust
Source: svchost.exe, 00000021.00000003.2555530538.00000197506CF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/Issue
Source: svchost.exe, 00000021.00000003.2533154446.0000019750F6D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/Issue02
Source: svchost.exe, 00000021.00000003.2490193566.0000019750F66000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/Issuels
Source: svchost.exe, 00000021.00000003.2849192138.0000019750F6E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000021.00000002.3302371401.0000019750F6F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/Issuesue
Source: svchost.exe, 00000021.00000003.2533154446.0000019750F6D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/Issuesue1
Source: svchost.exe, 00000021.00000002.3301375524.00000197506D3000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000021.00000003.2533154446.0000019750F6D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000021.00000003.2849192138.0000019750F6E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000021.00000003.2526630515.0000019750F5A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000021.00000003.2502574094.0000019750F3B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000021.00000003.2490193566.0000019750F66000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000021.00000002.3302371401.0000019750F6F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000021.00000003.2526603315.0000019750F52000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RST/Issue
Source: svchost.exe, 00000021.00000003.2533154446.0000019750F6D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000021.00000003.2849192138.0000019750F6E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000021.00000002.3302371401.0000019750F6F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/Issue
Source: FastestVPN.exe, 00000022.00000002.3305231314.0000000002EB1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000023.00000002.2491969070.0000000005431000.00000004.00000800.00020000.00000000.sdmp, FastestVPN.WindowsService.exe, FastestVPN.WindowsService.exe, 0000002F.00000002.3304056218.0000000001B76000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: FastestVPN.exe, 00000022.00000002.3305231314.0000000002EB1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/wsdl/
Source: FastestVPN.WindowsService.exe, FastestVPN.WindowsService.exe, 0000001D.00000002.2584816506.0000000005A92000.00000002.00000001.01000000.0000000E.sdmp	String found in binary or memory: http://signalr.net/
Source: ComDebug.exe, 00000030.00000002.2669578005.0000025FA4009000.00000004.00000020.00020000.00000000.sdmp, netsh.exe, 00000032.00000002.2825661828.0000000005235000.00000004.00000800.00020000.00000000.sdmp, Launcher.exe, 00000035.00000002.2857488192.0000000002774000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://sv.symcb.com/sv.crl0a
Source: ComDebug.exe, 00000030.00000002.2669578005.0000025FA4009000.00000004.00000020.00020000.00000000.sdmp, netsh.exe, 00000032.00000002.2825661828.0000000005235000.00000004.00000800.00020000.00000000.sdmp, Launcher.exe, 00000035.00000002.2857488192.0000000002774000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://sv.symcd.com0&
Source: FastestVPN.exe, FastestVPN.exe, 00000022.00000002.3305231314.0000000002EB1000.00000004.00000800.00020000.00000000.sdmp, FastestVPN.exe, 00000022.00000002.3351506959.000000000BE72000.00000002.00000001.01000000.00000032.sdmp	String found in binary or memory: http://temp.com
Source: FastestVPN.exe, FastestVPN.exe, 00000022.00000002.3305231314.0000000002EB1000.00000004.00000800.00020000.00000000.sdmp, FastestVPN.exe, 00000022.00000002.3351506959.000000000BE72000.00000002.00000001.01000000.00000032.sdmp	String found in binary or memory: http://temp.com/
Source: FastestVPN.exe, 00000022.00000002.3305231314.0000000002EB1000.00000004.00000800.00020000.00000000.sdmp, FastestVPN.exe, 00000022.00000000.2464852704.0000000000ABD000.00000002.00000001.01000000.00000011.sdmp, FastestVPN.exe, 00000022.00000002.3329548380.0000000006312000.00000002.00000001.01000000.00000020.sdmp	String found in binary or memory: http://wpfanimatedgif.codeplex.com
Source: powershell.exe, 00000023.00000002.2491969070.0000000005582000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0.html
Source: PVUfopbGfc.tmp, 00000001.00000002.2700520104.000000000018C000.00000004.00000010.00020000.00000000.sdmp, PVUfopbGfc.tmp, 00000001.00000003.2675219520.00000000054B0000.00000004.00001000.00020000.00000000.sdmp, FastestVPN.exe, 00000022.00000002.3331690013.0000000008C0C000.00000004.00000020.00020000.00000000.sdmp, FastestVPN.exe, 00000022.00000002.3344745212.000000000B5B6000.00000004.00000020.00020000.00000000.sdmp, FastestVPN.WindowsService.exe, 0000002A.00000002.2608877205.00000000027F5000.00000004.00000800.00020000.00000000.sdmp, FastestVPN.WindowsService.exe, 0000002A.00000002.2606870926.0000000000AB7000.00000004.00000020.00020000.00000000.sdmp, is-O5MTV.tmp.1.dr, is-OTL5D.tmp.1.dr, is-K9S0M.tmp.1.dr, is-21P0F.tmp.1.dr	String found in binary or memory: http://www.digicert.com/CPS0
Source: PVUfopbGfc.tmp, 00000001.00000003.2675219520.00000000054B0000.00000004.00001000.00020000.00000000.sdmp, xcopy.exe, 00000018.00000003.2403159655.00000297A19EA000.00000004.00000020.00020000.00000000.sdmp, ComDebug.exe, 00000030.00000002.2669578005.0000025FA4009000.00000004.00000020.00020000.00000000.sdmp, netsh.exe, 00000032.00000002.2825661828.0000000005235000.00000004.00000800.00020000.00000000.sdmp, Launcher.exe, 00000035.00000002.2857488192.0000000002774000.00000004.00000800.00020000.00000000.sdmp, is-7J76O.tmp.1.dr, is-PBM2F.tmp.1.dr	String found in binary or memory: http://www.digicert.com/ssl-cps-repository.htm0
Source: PVUfopbGfc.tmp, 00000001.00000002.2700520104.000000000018C000.00000004.00000010.00020000.00000000.sdmp, PVUfopbGfc.tmp, 00000001.00000003.2675219520.00000000054B0000.00000004.00001000.00020000.00000000.sdmp, FastestVPN.WindowsService.exe, 0000002A.00000002.2608775109.0000000000ED0000.00000004.00000020.00020000.00000000.sdmp, is-O5MTV.tmp.1.dr, is-OTL5D.tmp.1.dr, is-1ASBC.tmp.1.dr, is-K889R.tmp.1.dr, is-21P0F.tmp.1.dr, is-71J6V.tmp.1.dr	String found in binary or memory: http://www.entrust.net/rpa0
Source: PVUfopbGfc.tmp, 00000001.00000002.2700520104.000000000018C000.00000004.00000010.00020000.00000000.sdmp, PVUfopbGfc.tmp, 00000001.00000003.2675219520.00000000054B0000.00000004.00001000.00020000.00000000.sdmp, FastestVPN.WindowsService.exe, 0000002A.00000002.2608775109.0000000000ED0000.00000004.00000020.00020000.00000000.sdmp, FastestVPN.WindowsService.exe, 0000002A.00000002.2606870926.0000000000AB7000.00000004.00000020.00020000.00000000.sdmp, is-O5MTV.tmp.1.dr, is-OTL5D.tmp.1.dr, is-1ASBC.tmp.1.dr, is-K889R.tmp.1.dr, is-21P0F.tmp.1.dr, is-71J6V.tmp.1.dr	String found in binary or memory: http://www.entrust.net/rpa03
Source: FastestVPN.exe, FastestVPN.exe, 00000022.00000002.3327433102.00000000060BA000.00000002.00000001.01000000.0000001F.sdmp, FastestVPN.exe, 00000022.00000002.3327281264.00000000060A2000.00000002.00000001.01000000.0000001F.sdmp	String found in binary or memory: http://www.hardcodet.net/projects/wpf-notifyicon
Source: FastestVPN.exe, 00000022.00000002.3327281264.00000000060A2000.00000002.00000001.01000000.0000001F.sdmp	String found in binary or memory: http://www.hardcodet.net/taskbar
Source: ComDebug.exe, 00000030.00000002.2669578005.0000025FA3FB2000.00000004.00000020.00020000.00000000.sdmp, netsh.exe, 00000032.00000002.2825661828.00000000051EC000.00000004.00000800.00020000.00000000.sdmp, Launcher.exe, 00000035.00000002.2857488192.000000000272B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.info-zip.org/
Source: powershell.exe, 00000023.00000002.2503961408.0000000007BEC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.microsoft.co
Source: ComDebug.exe, 00000030.00000002.2669578005.0000025FA4009000.00000004.00000020.00020000.00000000.sdmp, netsh.exe, 00000032.00000002.2825661828.0000000005235000.00000004.00000800.00020000.00000000.sdmp, Launcher.exe, 00000035.00000002.2857488192.0000000002774000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.vmware.com/0
Source: FastestVPN.WindowsService.exe, 0000002A.00000002.2608877205.00000000027F5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.w3.o
Source: ComDebug.exe, 00000030.00000002.2672367606.00007FF8A80B8000.00000002.00000001.01000000.00000048.sdmp	String found in binary or memory: http://www.w3c.orghttp://dev.w3.org/CSS/fonts/ahem/COPYING
Source: svchost.exe, 00000021.00000003.2438224753.0000019750F3B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000021.00000002.3300708756.0000019750645000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000021.00000003.2438294098.0000019750F63000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000021.00000003.2438269726.0000019750F40000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://account.live.com/InlineSignup.aspx?iww=1&id=80502
Source: svchost.exe, 00000021.00000003.2438583076.0000019750F56000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000021.00000003.2438073307.0000019750F52000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000021.00000003.2438294098.0000019750F63000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000021.00000003.2438372704.0000019750F2C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000021.00000002.3300825248.000001975065F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://account.live.com/Wizard/Password/Change?id=80601
Source: svchost.exe, 00000021.00000003.2438224753.0000019750F3B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000021.00000003.2438269726.0000019750F40000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://account.live.com/Wizard/Password/Change?id=806011
Source: svchost.exe, 00000021.00000003.2438583076.0000019750F56000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000021.00000003.2438073307.0000019750F52000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://account.live.com/inlinesignup.aspx?iww=1&id=80601
Source: svchost.exe, 00000021.00000003.2438073307.0000019750F52000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://account.live.com/inlinesignup.aspx?iww=1&id=80603
Source: svchost.exe, 00000021.00000003.2438073307.0000019750F52000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://account.live.com/inlinesignup.aspx?iww=1&id=80604
Source: svchost.exe, 00000021.00000003.2438073307.0000019750F52000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000021.00000003.2438372704.0000019750F2C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://account.live.com/inlinesignup.aspx?iww=1&id=80605
Source: svchost.exe, 00000021.00000003.2438224753.0000019750F3B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000021.00000002.3300708756.0000019750645000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000021.00000003.2438294098.0000019750F63000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000021.00000003.2438269726.0000019750F40000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://account.live.com/inlinesignup.aspx?iww=1&id=80600
Source: svchost.exe, 00000021.00000003.2438224753.0000019750F3B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000021.00000002.3300708756.0000019750645000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000021.00000003.2438294098.0000019750F63000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000021.00000003.2438269726.0000019750F40000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://account.live.com/inlinesignup.aspx?iww=1&id=80601
Source: svchost.exe, 00000021.00000003.2438224753.0000019750F3B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000021.00000003.2438294098.0000019750F63000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000021.00000003.2438269726.0000019750F40000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000021.00000002.3300825248.000001975065F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://account.live.com/inlinesignup.aspx?iww=1&id=80603
Source: svchost.exe, 00000021.00000003.2438294098.0000019750F63000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000021.00000002.3300825248.000001975065F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://account.live.com/inlinesignup.aspx?iww=1&id=80604
Source: svchost.exe, 00000021.00000003.2438294098.0000019750F63000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000021.00000002.3300825248.000001975065F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://account.live.com/inlinesignup.aspx?iww=1&id=80605
Source: svchost.exe, 00000021.00000003.2438224753.0000019750F3B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000021.00000003.2438073307.0000019750F52000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000021.00000003.2438372704.0000019750F2C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000021.00000003.2502574094.0000019750F3B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000021.00000003.2438269726.0000019750F40000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000021.00000003.2438249849.0000019750F57000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://account.live.com/msangcwam
Source: svchost.exe, 00000021.00000002.3300708756.0000019750645000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://account.live.com/msangcwamvice
Source: powershell.exe, 00000023.00000002.2491969070.0000000005431000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/pscore6lB
Source: ComDebug.exe, 00000030.00000002.2672367606.00007FF8A80B8000.00000002.00000001.01000000.00000048.sdmp	String found in binary or memory: https://anglebug.com/4674
Source: ComDebug.exe, 00000030.00000002.2672367606.00007FF8A80B8000.00000002.00000001.01000000.00000048.sdmp	String found in binary or memory: https://anglebug.com/4830
Source: ComDebug.exe, 00000030.00000002.2672367606.00007FF8A80B8000.00000002.00000001.01000000.00000048.sdmp	String found in binary or memory: https://anglebug.com/4849
Source: ComDebug.exe, 00000030.00000002.2672367606.00007FF8A80B8000.00000002.00000001.01000000.00000048.sdmp	String found in binary or memory: https://anglebug.com/4966
Source: ComDebug.exe, 00000030.00000002.2672367606.00007FF8A80B8000.00000002.00000001.01000000.00000048.sdmp	String found in binary or memory: https://anglebug.com/5140
Source: ComDebug.exe, 00000030.00000002.2672367606.00007FF8A80B8000.00000002.00000001.01000000.00000048.sdmp	String found in binary or memory: https://anglebug.com/5536
Source: ComDebug.exe, 00000030.00000002.2672367606.00007FF8A80B8000.00000002.00000001.01000000.00000048.sdmp	String found in binary or memory: https://anglebug.com/5845
Source: ComDebug.exe, 00000030.00000002.2672367606.00007FF8A80B8000.00000002.00000001.01000000.00000048.sdmp	String found in binary or memory: https://anglebug.com/6574
Source: ComDebug.exe, 00000030.00000002.2672367606.00007FF8A80B8000.00000002.00000001.01000000.00000048.sdmp	String found in binary or memory: https://anglebug.com/7161
Source: ComDebug.exe, 00000030.00000002.2672367606.00007FF8A80B8000.00000002.00000001.01000000.00000048.sdmp	String found in binary or memory: https://anglebug.com/7162
Source: ComDebug.exe, 00000030.00000002.2672367606.00007FF8A80B8000.00000002.00000001.01000000.00000048.sdmp	String found in binary or memory: https://anglebug.com/7246
Source: ComDebug.exe, 00000030.00000002.2672367606.00007FF8A80B8000.00000002.00000001.01000000.00000048.sdmp	String found in binary or memory: https://anglebug.com/7246enableCaptureLimitsSet
Source: ComDebug.exe, 00000030.00000002.2672367606.00007FF8A80B8000.00000002.00000001.01000000.00000048.sdmp	String found in binary or memory: https://anglebug.com/7308
Source: ComDebug.exe, 00000030.00000002.2672367606.00007FF8A80B8000.00000002.00000001.01000000.00000048.sdmp	String found in binary or memory: https://anglebug.com/7319
Source: ComDebug.exe, 00000030.00000002.2672367606.00007FF8A80B8000.00000002.00000001.01000000.00000048.sdmp	String found in binary or memory: https://anglebug.com/7320
Source: ComDebug.exe, 00000030.00000002.2672367606.00007FF8A80B8000.00000002.00000001.01000000.00000048.sdmp	String found in binary or memory: https://anglebug.com/7369
Source: ComDebug.exe, 00000030.00000002.2672367606.00007FF8A80B8000.00000002.00000001.01000000.00000048.sdmp	String found in binary or memory: https://anglebug.com/7382
Source: ComDebug.exe, 00000030.00000002.2672367606.00007FF8A80B8000.00000002.00000001.01000000.00000048.sdmp	String found in binary or memory: https://anglebug.com/7405
Source: ComDebug.exe, 00000030.00000002.2672367606.00007FF8A80B8000.00000002.00000001.01000000.00000048.sdmp	String found in binary or memory: https://anglebug.com/7489
Source: ComDebug.exe, 00000030.00000002.2672367606.00007FF8A80B8000.00000002.00000001.01000000.00000048.sdmp	String found in binary or memory: https://anglebug.com/7604
Source: ComDebug.exe, 00000030.00000002.2672367606.00007FF8A80B8000.00000002.00000001.01000000.00000048.sdmp	String found in binary or memory: https://anglebug.com/7714
Source: ComDebug.exe, 00000030.00000002.2672367606.00007FF8A80B8000.00000002.00000001.01000000.00000048.sdmp	String found in binary or memory: https://anglebug.com/7847
Source: ComDebug.exe, 00000030.00000002.2672367606.00007FF8A80B8000.00000002.00000001.01000000.00000048.sdmp	String found in binary or memory: https://anglebug.com/7899
Source: FastestVPN.exe, 00000022.00000002.3305231314.0000000002EB1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.fastestvpn.com
Source: FastestVPN.exe, FastestVPN.exe, 00000022.00000002.3324911285.0000000005D72000.00000002.00000001.01000000.0000001A.sdmp	String found in binary or memory: https://api.fastestvpn.com//v2/chat
Source: FastestVPN.exe, FastestVPN.exe, 00000022.00000002.3305231314.0000000002EB1000.00000004.00000800.00020000.00000000.sdmp, FastestVPN.exe, 00000022.00000002.3325390125.0000000005DE2000.00000002.00000001.01000000.0000001E.sdmp	String found in binary or memory: https://api.fastestvpn.com/v2
Source: FastestVPN.exe, 00000022.00000002.3305231314.0000000002EB1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.fastestvpn.com/v2/authenticate
Source: FastestVPN.exe, 00000022.00000002.3305231314.0000000002EB1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.fastestvpn.com/v2/authenticateWN
Source: ComDebug.exe, 00000030.00000002.2672367606.00007FF8A80B8000.00000002.00000001.01000000.00000048.sdmp	String found in binary or memory: https://chromium.googlesource.com/angle/angle/
Source: powershell.exe, 00000023.00000002.2497354949.000000000649B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/
Source: powershell.exe, 00000023.00000002.2497354949.000000000649B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/Icon
Source: powershell.exe, 00000023.00000002.2497354949.000000000649B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/License
Source: ComDebug.exe, 00000030.00000002.2672367606.00007FF8A80B8000.00000002.00000001.01000000.00000048.sdmp	String found in binary or memory: https://crbug.com/1042393
Source: ComDebug.exe, 00000030.00000002.2672367606.00007FF8A80B8000.00000002.00000001.01000000.00000048.sdmp	String found in binary or memory: https://crbug.com/1046462
Source: ComDebug.exe, 00000030.00000002.2672367606.00007FF8A80B8000.00000002.00000001.01000000.00000048.sdmp	String found in binary or memory: https://crbug.com/1060012
Source: ComDebug.exe, 00000030.00000002.2672367606.00007FF8A80B8000.00000002.00000001.01000000.00000048.sdmp	String found in binary or memory: https://crbug.com/1091824
Source: ComDebug.exe, 00000030.00000002.2672367606.00007FF8A80B8000.00000002.00000001.01000000.00000048.sdmp	String found in binary or memory: https://crbug.com/1137851
Source: ComDebug.exe, 00000030.00000002.2672367606.00007FF8A80B8000.00000002.00000001.01000000.00000048.sdmp	String found in binary or memory: https://crbug.com/1300575
Source: ComDebug.exe, 00000030.00000002.2672367606.00007FF8A80B8000.00000002.00000001.01000000.00000048.sdmp	String found in binary or memory: https://crbug.com/1356053
Source: ComDebug.exe, 00000030.00000002.2672367606.00007FF8A80B8000.00000002.00000001.01000000.00000048.sdmp	String found in binary or memory: https://crbug.com/593024
Source: ComDebug.exe, 00000030.00000002.2672367606.00007FF8A80B8000.00000002.00000001.01000000.00000048.sdmp	String found in binary or memory: https://crbug.com/593024selectViewInGeometryShaderThe
Source: ComDebug.exe, 00000030.00000002.2672367606.00007FF8A80B8000.00000002.00000001.01000000.00000048.sdmp	String found in binary or memory: https://crbug.com/650547
Source: ComDebug.exe, 00000030.00000002.2672367606.00007FF8A80B8000.00000002.00000001.01000000.00000048.sdmp	String found in binary or memory: https://crbug.com/650547callClearTwiceUsing
Source: ComDebug.exe, 00000030.00000002.2672367606.00007FF8A80B8000.00000002.00000001.01000000.00000048.sdmp	String found in binary or memory: https://crbug.com/655534
Source: ComDebug.exe, 00000030.00000002.2672367606.00007FF8A80B8000.00000002.00000001.01000000.00000048.sdmp	String found in binary or memory: https://crbug.com/655534useSystemMemoryForConstantBuffersCopying
Source: ComDebug.exe, 00000030.00000002.2672367606.00007FF8A80B8000.00000002.00000001.01000000.00000048.sdmp	String found in binary or memory: https://crbug.com/705865
Source: ComDebug.exe, 00000030.00000002.2672367606.00007FF8A80B8000.00000002.00000001.01000000.00000048.sdmp	String found in binary or memory: https://crbug.com/710443
Source: ComDebug.exe, 00000030.00000002.2672367606.00007FF8A80B8000.00000002.00000001.01000000.00000048.sdmp	String found in binary or memory: https://crbug.com/811661
Source: ComDebug.exe, 00000030.00000002.2672367606.00007FF8A80B8000.00000002.00000001.01000000.00000048.sdmp	String found in binary or memory: https://crbug.com/848952
Source: ComDebug.exe, 00000030.00000002.2669578005.0000025FA4009000.00000004.00000020.00020000.00000000.sdmp, netsh.exe, 00000032.00000002.2825661828.0000000005235000.00000004.00000800.00020000.00000000.sdmp, Launcher.exe, 00000035.00000002.2857488192.0000000002774000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://d.symcb.com/cps0%
Source: ComDebug.exe, 00000030.00000002.2669578005.0000025FA4009000.00000004.00000020.00020000.00000000.sdmp, netsh.exe, 00000032.00000002.2825661828.0000000005235000.00000004.00000800.00020000.00000000.sdmp, Launcher.exe, 00000035.00000002.2857488192.0000000002774000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://d.symcb.com/rpa0
Source: ComDebug.exe, 00000030.00000002.2672367606.00007FF8A80B8000.00000002.00000001.01000000.00000048.sdmp	String found in binary or memory: https://dartbug.com/52121.
Source: ComDebug.exe, 00000030.00000002.2672367606.00007FF8A80B8000.00000002.00000001.01000000.00000048.sdmp	String found in binary or memory: https://dartbug.com/52121.Dart_WaitForEventwaitForEventSync
Source: ComDebug.exe, 00000030.00000002.2672367606.00007FF8A80B8000.00000002.00000001.01000000.00000048.sdmp	String found in binary or memory: https://dartbug.com/52121.enable_deprecated_wait_fordart::../../third_party/dart/runtime/vm/dart_api
Source: FastestVPN.exe, FastestVPN.exe, 00000022.00000002.3324911285.0000000005D72000.00000002.00000001.01000000.0000001A.sdmp	String found in binary or memory: https://fastestvpn.com/
Source: FastestVPN.exe, FastestVPN.exe, 00000022.00000002.3324911285.0000000005D72000.00000002.00000001.01000000.0000001A.sdmp	String found in binary or memory: https://fastestvpn.com/about
Source: FastestVPN.exe, FastestVPN.exe, 00000022.00000002.3324911285.0000000005D72000.00000002.00000001.01000000.0000001A.sdmp	String found in binary or memory: https://fastestvpn.com/buy-vpn
Source: FastestVPN.exe, FastestVPN.exe, 00000022.00000002.3324911285.0000000005D72000.00000002.00000001.01000000.0000001A.sdmp	String found in binary or memory: https://fastestvpn.com/buy-vpn?device=windows
Source: FastestVPN.exe, FastestVPN.exe, 00000022.00000002.3324911285.0000000005D72000.00000002.00000001.01000000.0000001A.sdmp	String found in binary or memory: https://fastestvpn.com/faq?device=windows
Source: FastestVPN.exe, FastestVPN.exe, 00000022.00000002.3324911285.0000000005D72000.00000002.00000001.01000000.0000001A.sdmp	String found in binary or memory: https://fastestvpn.com/password/reset
Source: FastestVPN.exe, FastestVPN.exe, 00000022.00000002.3324911285.0000000005D72000.00000002.00000001.01000000.0000001A.sdmp	String found in binary or memory: https://fastestvpn.com/privacy-policy
Source: FastestVPN.exe, FastestVPN.exe, 00000022.00000002.3324911285.0000000005D72000.00000002.00000001.01000000.0000001A.sdmp	String found in binary or memory: https://fastestvpn.com/terms-of-service?device=windows
Source: FastestVPN.exe	String found in binary or memory: https://fastestvpn.com/upgrade?t=ndelyNN7yduAc
Source: FastestVPN.exe, 00000022.00000002.3325176110.0000000005DC2000.00000002.00000001.01000000.0000001C.sdmp	String found in binary or memory: https://fastestvpn.com/upgrade?t=ndelyNN7yduAc5Enjoy
Source: svchost.exe, 00000026.00000003.2482684273.000001A8092C3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://g.live.com/odclientsettings/Prod/C:
Source: svchost.exe, 00000026.00000003.2482684273.000001A809250000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2.C:
Source: PVUfopbGfc.tmp, 00000001.00000003.2675219520.00000000054B0000.00000004.00001000.00020000.00000000.sdmp, FastestVPN.WindowsService.exe, FastestVPN.WindowsService.exe, 0000002F.00000002.3314344281.0000000004802000.00000002.00000001.01000000.0000004B.sdmp, is-K9S0M.tmp.1.dr	String found in binary or memory: https://github.com/JamesNK/Newtonsoft.Json
Source: FastestVPN.WindowsService.exe, 0000002F.00000002.3304056218.0000000001BCC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/JamesNK/Newtonsoft.Jsond
Source: FastestVPN.exe, 00000022.00000000.2464852704.00000000008F2000.00000002.00000001.01000000.00000011.sdmp, FastestVPN.exe, 00000022.00000002.3338344676.0000000009112000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Outfitio/Outfit-Fonts)
Source: powershell.exe, 00000023.00000002.2491969070.0000000005582000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Pester/Pester
Source: FastestVPN.WindowsService.exe, FastestVPN.WindowsService.exe, 0000001D.00000002.2584816506.0000000005A92000.00000002.00000001.01000000.0000000E.sdmp	String found in binary or memory: https://github.com/SignalR/SignalR/tree/7f53f266daf1aad3dabb1b6d7a71d4c1501ec8dc
Source: FastestVPN.WindowsService.exe, 0000002F.00000002.3304056218.0000000001BCC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/SignalR/SignalR/tree/7f53f266daf1aad3dabb1b6d7a71d4c1501ec8dcd
Source: FastestVPN.WindowsService.exe, FastestVPN.WindowsService.exe, 0000002F.00000002.3309349757.0000000004592000.00000002.00000001.01000000.00000038.sdmp, FastestVPN.WindowsService.exe, 0000002F.00000002.3309864180.00000000045C2000.00000002.00000001.01000000.0000003A.sdmp, FastestVPN.WindowsService.exe, 0000002F.00000002.3311384386.0000000004692000.00000002.00000001.01000000.0000004A.sdmp, FastestVPN.WindowsService.exe, 0000002F.00000002.3308225688.0000000004542000.00000002.00000001.01000000.00000037.sdmp, FastestVPN.WindowsService.exe, 0000002F.00000002.3310437304.0000000004662000.00000002.00000001.01000000.00000046.sdmp, FastestVPN.WindowsService.exe, 0000002F.00000002.3311828504.0000000004712000.00000002.00000001.01000000.00000049.sdmp, is-63I9E.tmp.1.dr	String found in binary or memory: https://github.com/aspnet/AspNetKatana
Source: FastestVPN.WindowsService.exe, 0000002F.00000002.3304056218.0000000001BCC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/aspnet/AspNetKatanad
Source: ComDebug.exe, 00000030.00000002.2672367606.00007FF8A80B8000.00000002.00000001.01000000.00000048.sdmp	String found in binary or memory: https://github.com/dart-lang/sdk/blob/master/runtime/docs/compiler/aot/entry_point_pragma.md
Source: FastestVPN.exe	String found in binary or memory: https://github.com/dotnet/corefx/tree/7601f4f6225089ff
Source: FastestVPN.exe, FastestVPN.exe, 00000022.00000002.3324622795.0000000005D32000.00000002.00000001.01000000.00000018.sdmp	String found in binary or memory: https://github.com/dotnet/corefx/tree/7601f4f6225089ffb291dc7d58293c7bbf5c5d4f
Source: FastestVPN.exe, 00000022.00000002.3324622795.0000000005D32000.00000002.00000001.01000000.00000018.sdmp, FastestVPN.exe, 00000022.00000002.3352829401.000000000C1D2000.00000002.00000001.01000000.00000031.sdmp	String found in binary or memory: https://github.com/dotnet/corefx/tree/7601f4f6225089ffb291dc7d58293c7bbf5c5d4f8
Source: FastestVPN.exe	String found in binary or memory: https://github.com/dotnet/corefx/tree/c6cf790234e
Source: FastestVPN.exe, FastestVPN.exe, 00000022.00000002.3352911178.000000000C1E2000.00000002.00000001.01000000.00000030.sdmp	String found in binary or memory: https://github.com/dotnet/corefx/tree/c6cf790234e063b855fcdb50f3fb1b3cfac73275
Source: FastestVPN.exe, 00000022.00000002.3352911178.000000000C1E2000.00000002.00000001.01000000.00000030.sdmp	String found in binary or memory: https://github.com/dotnet/corefx/tree/c6cf790234e063b855fcdb50f3fb1b3cfac732758
Source: FastestVPN.exe, FastestVPN.exe, 00000022.00000002.3324336785.0000000005D12000.00000002.00000001.01000000.00000017.sdmp, FastestVPN.exe, 00000022.00000002.3324194724.0000000005D02000.00000002.00000001.01000000.00000016.sdmp, FastestVPN.exe, 00000022.00000002.3323696936.0000000005952000.00000002.00000001.01000000.00000015.sdmp	String found in binary or memory: https://github.com/dotnet/runtime
Source: FastestVPN.exe, FastestVPN.exe, 00000022.00000002.3352299163.000000000C172000.00000002.00000001.01000000.0000002F.sdmp, FastestVPN.exe, 00000022.00000002.3349122671.000000000BC52000.00000002.00000001.01000000.0000002D.sdmp, FastestVPN.exe, 00000022.00000002.3351200547.000000000BE32000.00000002.00000001.01000000.0000002E.sdmp	String found in binary or memory: https://github.com/ericsink/SQLitePCL.raw
Source: FastestVPN.exe, 00000022.00000002.3352299163.000000000C172000.00000002.00000001.01000000.0000002F.sdmp	String found in binary or memory: https://github.com/ericsink/SQLitePCL.rawH
Source: FastestVPN.exe, 00000022.00000002.3351200547.000000000BE32000.00000002.00000001.01000000.0000002E.sdmp	String found in binary or memory: https://github.com/ericsink/SQLitePCL.rawX
Source: ComDebug.exe, 00000030.00000002.2672367606.00007FF8A80B8000.00000002.00000001.01000000.00000048.sdmp	String found in binary or memory: https://github.com/flutter/flutter/issues.
Source: ComDebug.exe, 00000030.00000002.2672367606.00007FF8A80B8000.00000002.00000001.01000000.00000048.sdmp	String found in binary or memory: https://github.com/flutter/flutter/issues.Invalid
Source: FastestVPN.exe, FastestVPN.exe, 00000022.00000002.3327281264.00000000060A2000.00000002.00000001.01000000.0000001F.sdmp	String found in binary or memory: https://github.com/hardcodet/wpf-notifyicon
Source: FastestVPN.exe, 00000022.00000002.3327281264.00000000060A2000.00000002.00000001.01000000.0000001F.sdmp	String found in binary or memory: https://github.com/hardcodet/wpf-notifyicon.
Source: FastestVPN.exe, FastestVPN.exe, 00000022.00000002.3351506959.000000000BE72000.00000002.00000001.01000000.00000032.sdmp, FastestVPN.exe, 00000022.00000002.3351847731.000000000BE92000.00000002.00000001.01000000.00000033.sdmp	String found in binary or memory: https://github.com/tmenier/Flurl.git
Source: FastestVPN.exe, 00000022.00000002.3351506959.000000000BE72000.00000002.00000001.01000000.00000032.sdmp, FastestVPN.exe, 00000022.00000002.3351847731.000000000BE92000.00000002.00000001.01000000.00000033.sdmp	String found in binary or memory: https://github.com/tmenier/Flurl.git5
Source: powershell.exe, 00000023.00000002.2491969070.0000000005582000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://go.micro
Source: FastestVPN.exe, FastestVPN.exe, 00000022.00000002.3330868755.00000000065B2000.00000002.00000001.01000000.0000002A.sdmp	String found in binary or memory: https://in.appcenter.ms
Source: FastestVPN.exe, 00000022.00000002.3330868755.00000000065B2000.00000002.00000001.01000000.0000002A.sdmp	String found in binary or memory: https://in.appcenter.ms./logs?api-version=1.0.0
Source: ComDebug.exe, 00000030.00000002.2672367606.00007FF8A80B8000.00000002.00000001.01000000.00000048.sdmp	String found in binary or memory: https://issuetracker.google.com/161903006
Source: ComDebug.exe, 00000030.00000002.2672367606.00007FF8A80B8000.00000002.00000001.01000000.00000048.sdmp	String found in binary or memory: https://issuetracker.google.com/166809097
Source: ComDebug.exe, 00000030.00000002.2672367606.00007FF8A80B8000.00000002.00000001.01000000.00000048.sdmp	String found in binary or memory: https://issuetracker.google.com/184850002
Source: ComDebug.exe, 00000030.00000002.2672367606.00007FF8A80B8000.00000002.00000001.01000000.00000048.sdmp	String found in binary or memory: https://issuetracker.google.com/187425444
Source: ComDebug.exe, 00000030.00000002.2672367606.00007FF8A80B8000.00000002.00000001.01000000.00000048.sdmp	String found in binary or memory: https://issuetracker.google.com/220069903
Source: ComDebug.exe, 00000030.00000002.2672367606.00007FF8A80B8000.00000002.00000001.01000000.00000048.sdmp	String found in binary or memory: https://issuetracker.google.com/220069903emulatePixelLocalStorageEmulate
Source: ComDebug.exe, 00000030.00000002.2672367606.00007FF8A80B8000.00000002.00000001.01000000.00000048.sdmp	String found in binary or memory: https://issuetracker.google.com/229267970
Source: ComDebug.exe, 00000030.00000002.2672367606.00007FF8A80B8000.00000002.00000001.01000000.00000048.sdmp	String found in binary or memory: https://issuetracker.google.com/250706693
Source: ComDebug.exe, 00000030.00000002.2672367606.00007FF8A80B8000.00000002.00000001.01000000.00000048.sdmp	String found in binary or memory: https://issuetracker.google.com/253522366
Source: ComDebug.exe, 00000030.00000002.2672367606.00007FF8A80B8000.00000002.00000001.01000000.00000048.sdmp	String found in binary or memory: https://issuetracker.google.com/255411748
Source: ComDebug.exe, 00000030.00000002.2672367606.00007FF8A80B8000.00000002.00000001.01000000.00000048.sdmp	String found in binary or memory: https://issuetracker.google.com/258207403
Source: ComDebug.exe, 00000030.00000002.2672367606.00007FF8A80B8000.00000002.00000001.01000000.00000048.sdmp	String found in binary or memory: https://issuetracker.google.com/274859104
Source: ComDebug.exe, 00000030.00000002.2672367606.00007FF8A80B8000.00000002.00000001.01000000.00000048.sdmp	String found in binary or memory: https://issuetracker.google.com/284462263
Source: ComDebug.exe, 00000030.00000002.2672367606.00007FF8A80B8000.00000002.00000001.01000000.00000048.sdmp	String found in binary or memory: https://issuetracker.google.com/issues/166475273
Source: PVUfopbGfc.exe, 00000000.00000000.2036244476.0000000000401000.00000020.00000001.01000000.00000003.sdmp	String found in binary or memory: https://jrsoftware.org/ishelp/index.php?topic=setupcmdlineSetupU
Source: svchost.exe, 00000021.00000002.3300708756.0000019750645000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.ecur
Source: svchost.exe, 00000021.00000003.2438294098.0000019750F63000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000021.00000002.3300825248.000001975065F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ApproveSession.srf
Source: svchost.exe, 00000021.00000003.2438224753.0000019750F3B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000021.00000003.2438269726.0000019750F40000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ApproveSession.srfe.com
Source: svchost.exe, 00000021.00000003.2438583076.0000019750F56000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000021.00000003.2438073307.0000019750F52000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/IfExists.srf?uiflavor=4&id=80600
Source: svchost.exe, 00000021.00000003.2438583076.0000019750F56000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000021.00000003.2438073307.0000019750F52000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/IfExists.srf?uiflavor=4&id=80601
Source: svchost.exe, 00000021.00000003.2438334304.0000019750F6B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000021.00000003.2438294098.0000019750F63000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000021.00000002.3300825248.000001975065F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/IfExists.srf?uiflavor=4&id=80502
Source: svchost.exe, 00000021.00000003.2438334304.0000019750F6B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000021.00000003.2438294098.0000019750F63000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000021.00000002.3300825248.000001975065F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/IfExists.srf?uiflavor=4&id=80600
Source: svchost.exe, 00000021.00000003.2438334304.0000019750F6B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000021.00000003.2438294098.0000019750F63000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000021.00000003.2438372704.0000019750F2C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000021.00000002.3300825248.000001975065F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/IfExists.srf?uiflavor=4&id=80601
Source: svchost.exe, 00000021.00000003.2438224753.0000019750F3B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000021.00000002.3300708756.0000019750645000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000021.00000003.2438269726.0000019750F40000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ListSessions.srf
Source: svchost.exe, 00000021.00000003.2438294098.0000019750F63000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000021.00000002.3300825248.000001975065F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ManageApprover.srf
Source: svchost.exe, 00000021.00000003.2438224753.0000019750F3B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000021.00000003.2438269726.0000019750F40000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ManageApprover.srf53457
Source: svchost.exe, 00000021.00000003.2438224753.0000019750F3B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000021.00000003.2438294098.0000019750F63000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000021.00000003.2438269726.0000019750F40000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000021.00000002.3300825248.000001975065F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ManageLoginKeys.srf
Source: svchost.exe, 00000021.00000002.3302943187.000001975141B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000021.00000003.2438269726.0000019750F40000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000021.00000002.3300825248.000001975065F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/RST2.srf
Source: svchost.exe, 00000021.00000003.2438224753.0000019750F3B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000021.00000002.3300708756.0000019750645000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000021.00000003.2438269726.0000019750F40000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/didtou.srf
Source: svchost.exe, 00000021.00000002.3300708756.0000019750645000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000021.00000003.2438269726.0000019750F40000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/getrealminfo.srf
Source: svchost.exe, 00000021.00000002.3300708756.0000019750645000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000021.00000003.2502574094.0000019750F3B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000021.00000003.2438269726.0000019750F40000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/getuserrealm.srf
Source: svchost.exe, 00000021.00000003.2438027377.0000019750F10000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000021.00000002.3300708756.0000019750645000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000021.00000003.2438334304.0000019750F6B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000021.00000003.2438294098.0000019750F63000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000021.00000002.3300825248.000001975065F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/DeviceAssociate.srf
Source: svchost.exe, 00000021.00000003.2438334304.0000019750F6B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000021.00000003.2438294098.0000019750F63000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000021.00000002.3300825248.000001975065F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/DeviceDisassociate.srf
Source: svchost.exe, 00000021.00000003.2438372704.0000019750F27000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/DeviceDisassociate.srff
Source: svchost.exe, 00000021.00000003.2438224753.0000019750F3B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000021.00000003.2438269726.0000019750F40000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000021.00000002.3300825248.000001975065F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/DeviceQuery.srf
Source: svchost.exe, 00000021.00000003.2438334304.0000019750F6B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000021.00000003.2438294098.0000019750F63000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000021.00000003.2438372704.0000019750F27000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000021.00000002.3300825248.000001975065F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/DeviceUpdate.srf
Source: svchost.exe, 00000021.00000003.2438334304.0000019750F6B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000021.00000003.2438294098.0000019750F63000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/EnumerateDevices.srf
Source: svchost.exe, 00000021.00000003.2438372704.0000019750F27000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/EnumerateDevices.srfX
Source: svchost.exe, 00000021.00000002.3300825248.000001975065F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/EnumerateDevices.srfr
Source: svchost.exe, 00000021.00000003.2438224753.0000019750F3B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000021.00000003.2438294098.0000019750F63000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000021.00000003.2438269726.0000019750F40000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000021.00000002.3300825248.000001975065F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/GetAppData.srf
Source: svchost.exe, 00000021.00000002.3300708756.0000019750645000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/GetAppData.srfrfrf6085fid=cpsrf
Source: svchost.exe, 00000021.00000003.2438334304.0000019750F6B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000021.00000003.2438294098.0000019750F63000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000021.00000002.3300825248.000001975065F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/GetUserKeyData.srf
Source: svchost.exe, 00000021.00000003.2438334304.0000019750F6B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000021.00000003.2438294098.0000019750F63000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000021.00000003.2438372704.0000019750F2C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000021.00000002.3300825248.000001975065F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/InlineClientAuth.srf
Source: svchost.exe, 00000021.00000003.2526466268.0000019750F5A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/InlineClientAuth.srf?stsft=-DlFziMZwIidRWaxddTIZTnitsKqk4l9lNorD2f9K
Source: svchost.exe, 00000021.00000003.2438224753.0000019750F3B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000021.00000003.2438583076.0000019750F56000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000021.00000003.2438073307.0000019750F52000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000021.00000003.2438294098.0000019750F63000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000021.00000003.2438269726.0000019750F40000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/InlineConnect.srf?id=80600
Source: svchost.exe, 00000021.00000002.3300708756.0000019750645000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/InlineConnect.srf?id=80600UE
Source: svchost.exe, 00000021.00000003.2438224753.0000019750F3B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000021.00000003.2438073307.0000019750F52000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000021.00000003.2438294098.0000019750F63000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000021.00000003.2438269726.0000019750F40000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000021.00000002.3300825248.000001975065F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/InlineConnect.srf?id=80601
Source: svchost.exe, 00000021.00000003.2438224753.0000019750F3B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000021.00000003.2438294098.0000019750F63000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000021.00000003.2438269726.0000019750F40000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000021.00000002.3300825248.000001975065F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/InlineConnect.srf?id=80603
Source: svchost.exe, 00000021.00000003.2438073307.0000019750F52000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000021.00000003.2438294098.0000019750F63000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000021.00000003.2438372704.0000019750F2C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000021.00000002.3300825248.000001975065F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/InlineConnect.srf?id=80604
Source: svchost.exe, 00000021.00000003.2533154446.0000019750F6D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000021.00000003.2438334304.0000019750F6B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000021.00000003.2438294098.0000019750F63000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000021.00000002.3300825248.000001975065F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/InlineDesktop.srf
Source: svchost.exe, 00000021.00000003.2438372704.0000019750F2C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/InlineDesktop.srfm
Source: svchost.exe, 00000021.00000002.3302943187.000001975141B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/InlineDesktop.srft
Source: svchost.exe, 00000021.00000003.2533154446.0000019750F6D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/InlineDesktop.srfue
Source: svchost.exe, 00000021.00000003.2438294098.0000019750F63000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/InlineLogin.srf?id=80502
Source: svchost.exe, 00000021.00000003.2438224753.0000019750F3B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000021.00000003.2438269726.0000019750F40000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/InlineLogin.srf?id=805025
Source: svchost.exe, 00000021.00000002.3300708756.0000019750645000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/InlineLogin.srf?id=80502R
Source: svchost.exe, 00000021.00000003.2438224753.0000019750F3B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000021.00000002.3300708756.0000019750645000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000021.00000003.2438294098.0000019750F63000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000021.00000003.2438269726.0000019750F40000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/InlineLogin.srf?id=80600
Source: svchost.exe, 00000021.00000003.2438224753.0000019750F3B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000021.00000003.2438583076.0000019750F56000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000021.00000002.3300708756.0000019750645000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000021.00000003.2438073307.0000019750F52000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000021.00000003.2438294098.0000019750F63000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000021.00000003.2438269726.0000019750F40000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/InlineLogin.srf?id=80601
Source: svchost.exe, 00000021.00000003.2438224753.0000019750F3B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000021.00000003.2438073307.0000019750F52000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000021.00000003.2438294098.0000019750F63000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000021.00000003.2438269726.0000019750F40000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000021.00000002.3300825248.000001975065F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/InlineLogin.srf?id=80603
Source: svchost.exe, 00000021.00000003.2438073307.0000019750F52000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000021.00000003.2438294098.0000019750F63000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000021.00000003.2438372704.0000019750F2C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000021.00000003.2438269726.0000019750F40000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000021.00000002.3300825248.000001975065F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/InlineLogin.srf?id=80604
Source: svchost.exe, 00000021.00000003.2438073307.0000019750F52000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000021.00000003.2438294098.0000019750F63000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000021.00000003.2438372704.0000019750F2C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000021.00000002.3300825248.000001975065F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/InlineLogin.srf?id=80605
Source: svchost.exe, 00000021.00000003.2438073307.0000019750F52000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000021.00000003.2438294098.0000019750F63000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000021.00000003.2438372704.0000019750F2C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000021.00000002.3300825248.000001975065F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/InlineLogin.srf?id=80606
Source: svchost.exe, 00000021.00000003.2438073307.0000019750F52000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000021.00000003.2438294098.0000019750F63000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000021.00000003.2438372704.0000019750F2C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000021.00000002.3300825248.000001975065F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/InlineLogin.srf?id=80607
Source: svchost.exe, 00000021.00000003.2438073307.0000019750F52000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000021.00000003.2438294098.0000019750F63000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000021.00000003.2438372704.0000019750F2C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000021.00000002.3300825248.000001975065F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000021.00000003.2438249849.0000019750F57000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/InlineLogin.srf?id=80608
Source: svchost.exe, 00000021.00000003.2438073307.0000019750F52000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/InlinePOPAuth.srf?id=80601&fid=cp
Source: svchost.exe, 00000021.00000002.3300708756.0000019750645000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000021.00000003.2438051525.0000019750F5A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000021.00000003.2438372704.0000019750F2C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/InlinePOPAuth.srf?id=80601&fid=cp
Source: svchost.exe, 00000021.00000003.2438073307.0000019750F52000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000021.00000003.2438294098.0000019750F63000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000021.00000003.2438372704.0000019750F2C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000021.00000002.3300825248.000001975065F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/InlinePOPAuth.srf?id=80605
Source: svchost.exe, 00000021.00000003.2438224753.0000019750F3B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000021.00000003.2438294098.0000019750F63000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000021.00000003.2438269726.0000019750F40000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000021.00000002.3300825248.000001975065F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/ResolveUser.srf
Source: svchost.exe, 00000021.00000003.2438294098.0000019750F63000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000021.00000002.3300825248.000001975065F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/SHA1Auth.srf
Source: svchost.exe, 00000021.00000003.2438224753.0000019750F3B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000021.00000003.2438269726.0000019750F40000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/SHA1Auth.srfrf
Source: svchost.exe, 00000021.00000003.2438027377.0000019750F10000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000021.00000002.3300825248.000001975065F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/deviceaddcredential.srf
Source: svchost.exe, 00000021.00000003.2438224753.0000019750F3B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000021.00000002.3300708756.0000019750645000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000021.00000003.2438269726.0000019750F40000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/devicechangecredential.srf
Source: svchost.exe, 00000021.00000003.2438224753.0000019750F3B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000021.00000003.2438294098.0000019750F63000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000021.00000003.2438269726.0000019750F40000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/deviceremovecredential.srf
Source: svchost.exe, 00000021.00000002.3300708756.0000019750645000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/deviceremovecredential.srfLive
Source: svchost.exe, 00000021.00000003.2438224753.0000019750F3B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000021.00000002.3300708756.0000019750645000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000021.00000003.2438269726.0000019750F40000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/resetpw.srf
Source: svchost.exe, 00000021.00000002.3300708756.0000019750645000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000021.00000003.2502574094.0000019750F3B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000021.00000003.2438269726.0000019750F40000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/retention.srf
Source: svchost.exe, 00000021.00000002.3301375524.00000197506D3000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000021.00000003.2526630515.0000019750F5A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000021.00000003.2502574094.0000019750F3B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000021.00000003.2526603315.0000019750F52000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com:443/RST2.srf
Source: svchost.exe, 00000021.00000002.3303189123.000001975146F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com:443/RST2.srfityCRL
Source: svchost.exe, 00000021.00000002.3303288355.0000019751481000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.comM
Source: svchost.exe, 00000021.00000003.2438224753.0000019750F3B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000021.00000003.2438294098.0000019750F63000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000021.00000003.2438269726.0000019750F40000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000021.00000002.3300825248.000001975065F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.microsoftonline.com/MSARST2.srf
Source: svchost.exe, 00000021.00000003.2438224753.0000019750F3B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000021.00000002.3300708756.0000019750645000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000021.00000003.2438294098.0000019750F63000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000021.00000003.2438269726.0000019750F40000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.microsoftonline.com/ppsecure/DeviceAssociate.srf
Source: svchost.exe, 00000021.00000002.3300708756.0000019750645000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.microsoftonline.com/ppsecure/DeviceAssociate.srfJ
Source: svchost.exe, 00000021.00000002.3300708756.0000019750645000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.microsoftonline.com/ppsecure/DeviceDisassociate.srf
Source: svchost.exe, 00000021.00000002.3300708756.0000019750645000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.microsoftonline.com/ppsecure/DeviceDisassociate.srf.
Source: svchost.exe, 00000021.00000003.2438027377.0000019750F10000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.microsoftonline.com/ppsecure/DeviceDisassociate.srf:CLSID
Source: svchost.exe, 00000021.00000003.2438224753.0000019750F3B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000021.00000002.3300708756.0000019750645000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000021.00000003.2438294098.0000019750F63000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000021.00000003.2438269726.0000019750F40000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.microsoftonline.com/ppsecure/DeviceQuery.srf
Source: svchost.exe, 00000021.00000002.3300708756.0000019750645000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.microsoftonline.com/ppsecure/DeviceQuery.srf-
Source: svchost.exe, 00000021.00000003.2438224753.0000019750F3B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000021.00000002.3300708756.0000019750645000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000021.00000003.2438294098.0000019750F63000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000021.00000003.2438269726.0000019750F40000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.microsoftonline.com/ppsecure/DeviceUpdate.srf
Source: svchost.exe, 00000021.00000002.3300708756.0000019750645000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.microsoftonline.com/ppsecure/DeviceUpdate.srf%
Source: svchost.exe, 00000021.00000002.3300708756.0000019750645000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000021.00000003.2438294098.0000019750F63000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000021.00000003.2438269726.0000019750F40000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.microsoftonline.com/ppsecure/EnumerateDevices.srf
Source: svchost.exe, 00000021.00000002.3300708756.0000019750645000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000021.00000003.2438294098.0000019750F63000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000021.00000003.2438269726.0000019750F40000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.microsoftonline.com/ppsecure/ResolveUser.srf
Source: svchost.exe, 00000021.00000002.3300708756.0000019750645000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.microsoftonline.com/ppsecure/deviceaddmsacredential.srf
Source: svchost.exe, 00000021.00000002.3300708756.0000019750645000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.microsoftonline.com/ppsecure/devicechangecredential.srf
Source: svchost.exe, 00000021.00000003.2438372704.0000019750F27000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.microsoftonline.com/ppsecure/devicechangecredential.srfMM
Source: svchost.exe, 00000021.00000002.3300708756.0000019750645000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.microsoftonline.com/ppsecure/deviceremovecredential.srf
Source: svchost.exe, 00000021.00000003.2438027377.0000019750F10000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.microsoftonline.com/ppsecure/deviceremovecredential.srfRE
Source: powershell.exe, 00000023.00000002.2497354949.000000000649B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://nuget.org/nuget.exe
Source: FastestVPN.exe, 00000022.00000002.3338344676.0000000009112000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://scripts.sil.org/OFL
Source: FastestVPN.exe, 00000022.00000000.2464852704.00000000008F2000.00000002.00000001.01000000.00000011.sdmp	String found in binary or memory: https://scripts.sil.org/OFLThis
Source: FastestVPN.exe, 00000022.00000000.2464852704.00000000008F2000.00000002.00000001.01000000.00000011.sdmp	String found in binary or memory: https://scripts.sil.org/OFLwww.rfuenzalida.comwww.fragtypefoundry.xyzRodrigo
Source: PVUfopbGfc.tmp, 00000001.00000003.2675219520.00000000054B0000.00000004.00001000.00020000.00000000.sdmp, ComDebug.exe, 00000030.00000002.2669360248.0000025FA3DB0000.00000004.00000020.00020000.00000000.sdmp, ComDebug.exe, 00000030.00000003.2658642223.0000025FA3CF1000.00000004.00000020.00020000.00000000.sdmp, ComDebug.exe, 00000030.00000003.2658999518.0000025FA3CF1000.00000004.00000020.00020000.00000000.sdmp, ComDebug.exe, 00000030.00000002.2669578005.0000025FA4009000.00000004.00000020.00020000.00000000.sdmp, ComDebug.exe, 00000030.00000003.2656545355.0000025FA3CF1000.00000004.00000020.00020000.00000000.sdmp, ComDebug.exe, 00000030.00000003.2656053801.0000025FA3F72000.00000004.00000020.00020000.00000000.sdmp, ComDebug.exe, 00000030.00000003.2655997626.0000025FA3CF2000.00000004.00000020.00020000.00000000.sdmp, ComDebug.exe, 00000030.00000003.2641290540.0000025FA46F0000.00000004.00000001.00020000.00000000.sdmp, netsh.exe, 00000032.00000002.2825661828.0000000005235000.00000004.00000800.00020000.00000000.sdmp, Launcher.exe, 00000035.00000002.2857488192.0000000002774000.00000004.00000800.00020000.00000000.sdmp, is-QN5KA.tmp.1.dr, file_selector_windows_plugin.dll.48.dr, is-QG142.tmp.1.dr, is-1ASBC.tmp.1.dr, is-K889R.tmp.1.dr, is-71J6V.tmp.1.dr	String found in binary or memory: https://sectigo.com/CPS0
Source: svchost.exe, 00000021.00000003.2438269726.0000019750F40000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://signup.live.com/signup.aspx
Source: PVUfopbGfc.tmp, 00000001.00000003.2675219520.00000000054B0000.00000004.00001000.00020000.00000000.sdmp, xcopy.exe, 00000018.00000003.2403159655.00000297A19EA000.00000004.00000020.00020000.00000000.sdmp, ComDebug.exe, 00000030.00000002.2669578005.0000025FA4009000.00000004.00000020.00020000.00000000.sdmp, netsh.exe, 00000032.00000002.2825661828.0000000005235000.00000004.00000800.00020000.00000000.sdmp, Launcher.exe, 00000035.00000002.2857488192.0000000002774000.00000004.00000800.00020000.00000000.sdmp, is-7J76O.tmp.1.dr, is-PBM2F.tmp.1.dr	String found in binary or memory: https://www.digicert.com/CPS0
Source: ComDebug.exe, 00000030.00000002.2669360248.0000025FA3DB0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.digicert.comP/CPS
Source: PVUfopbGfc.tmp, 00000001.00000002.2700520104.000000000018C000.00000004.00000010.00020000.00000000.sdmp, PVUfopbGfc.tmp, 00000001.00000003.2675219520.00000000054B0000.00000004.00001000.00020000.00000000.sdmp, FastestVPN.WindowsService.exe, 0000002A.00000002.2608775109.0000000000ED0000.00000004.00000020.00020000.00000000.sdmp, FastestVPN.WindowsService.exe, 0000002A.00000002.2606870926.0000000000AB7000.00000004.00000020.00020000.00000000.sdmp, is-O5MTV.tmp.1.dr, is-OTL5D.tmp.1.dr, is-1ASBC.tmp.1.dr, is-K889R.tmp.1.dr, is-21P0F.tmp.1.dr, is-71J6V.tmp.1.dr	String found in binary or memory: https://www.entrust.net/rpa0
Source: PVUfopbGfc.exe, 00000000.00000003.2704325303.0000000002316000.00000004.00001000.00020000.00000000.sdmp, PVUfopbGfc.exe, 00000000.00000003.2036701725.0000000002870000.00000004.00001000.00020000.00000000.sdmp, PVUfopbGfc.tmp, 00000001.00000003.2042009552.00000000034D0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.fastestvpn.com/
Source: PVUfopbGfc.exe, 00000000.00000003.2038232664.000000007FB7B000.00000004.00001000.00020000.00000000.sdmp, PVUfopbGfc.exe, 00000000.00000003.2037873390.0000000002870000.00000004.00001000.00020000.00000000.sdmp, PVUfopbGfc.tmp, 00000001.00000000.2039732775.0000000000401000.00000020.00000001.01000000.00000004.sdmp	String found in binary or memory: https://www.innosetup.com/
Source: PVUfopbGfc.tmp, 00000001.00000003.2675219520.00000000054B0000.00000004.00001000.00020000.00000000.sdmp, is-K9S0M.tmp.1.dr	String found in binary or memory: https://www.newtonsoft.com/json
Source: FastestVPN.WindowsService.exe, 0000002F.00000002.3314344281.0000000004802000.00000002.00000001.01000000.0000004B.sdmp, is-K9S0M.tmp.1.dr	String found in binary or memory: https://www.newtonsoft.com/jsonschema
Source: PVUfopbGfc.tmp, 00000001.00000003.2675219520.00000000054B0000.00000004.00001000.00020000.00000000.sdmp, FastestVPN.WindowsService.exe, FastestVPN.WindowsService.exe, 0000002F.00000002.3314344281.0000000004802000.00000002.00000001.01000000.0000004B.sdmp, is-K9S0M.tmp.1.dr	String found in binary or memory: https://www.nuget.org/packages/Newtonsoft.Json.Bson
Source: PVUfopbGfc.exe, 00000000.00000003.2038232664.000000007FB7B000.00000004.00001000.00020000.00000000.sdmp, PVUfopbGfc.exe, 00000000.00000003.2037873390.0000000002870000.00000004.00001000.00020000.00000000.sdmp, PVUfopbGfc.tmp, 00000001.00000000.2039732775.0000000000401000.00000020.00000001.01000000.00000004.sdmp	String found in binary or memory: https://www.remobjects.com/ps
Source: PVUfopbGfc.tmp, 00000001.00000003.2675219520.00000000054B0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.wireguard.com/
Source: PVUfopbGfc.tmp, 00000001.00000003.2675219520.00000000054B0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.wireguard.com/D
Source: PVUfopbGfc.tmp, 00000001.00000003.2675219520.00000000054B0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.wireguard.com/donations/key
Source: PVUfopbGfc.tmp, 00000001.00000003.2675219520.00000000054B0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.wireguard.com/initSpan:
Source: PVUfopbGfc.tmp, 00000001.00000003.2675219520.00000000054B0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.wireguard.net/D

Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734

Uses secure TLS version for HTTPS connections

Source: unknown

HTTPS traffic detected: 104.22.21.170:443 -> 192.168.2.5:49734 version: TLS 1.2

Key, Mouse, Clipboard, Microphone and Screen Capturing

Installs a raw input device (often for capturing keystrokes)

Source: PVUfopbGfc.tmp, 00000001.00000003.2675219520.00000000054B0000.00000004.00001000.00020000.00000000.sdmp

Binary or memory string: &Configuration:,M3.2.0,M11.1.0/managerservice476837158203125: cannot parse <invalid Value>ASCII_Hex_DigitAbout WireGuardAddDllDirectoryAddresses: NoneCLSIDFromStringCallWindowProcWCreateHardLinkWCreatePopupMenuCreateWindowExWDeviceIoControlDialogBoxParamWDragAcceptFilesDrawThemeTextExDuplicateHandleExcludeClipRectFailed to find Failed to load FindNextVolumeWFindVolumeCloseFlushViewOfFileFwpmEngineOpen0FwpmFreeMemory0GdiplusShutdownGetActiveWindowGetAdaptersInfoGetCommTimeoutsGetCommandLineWGetDpiForWindowGetEnhMetaFileWGetModuleHandleGetMonitorInfoWGetProcessTimesGetRawInputDataGetSecurityInfoGetStartupInfoWGetTextMetricsWGetThreadLocaleHanifi_RohingyaImpersonateSelfInsertMenuItemWInvalid key: %vIsWindowEnabledIsWindowVisibleIsWow64Process2NTSTATUS 0x%08xNotTrueTypeFontOleUninitializeOpenThreadTokenOther_LowercaseOther_UppercasePlayEnhMetaFilePostQuitMessageProcess32FirstWProfileNotFoundPsalter_PahlaviPublicKey = %s

memstr_e269cfe5-2

E-Banking Fraud

Drops certificate files (DER)

Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	File created: C:\Program Files\FastestVPN\Resources\driver\windows\i386\is-O423O.tmp	Jump to dropped file
Source: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exe	File created: C:\Users\user\AppData\Local\Temp\{d561b4bd-4963-934e-b2b1-0e0727e36250}\SET9446.tmp	Jump to dropped file
Source: C:\Program Files\FastestVPN\FastestVPN.exe	File created: C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F2E248BEDDBB2D85122423C41028BFD4	Jump to dropped file
Source: C:\Windows\System32\drvinst.exe	File created: C:\Windows\System32\DriverStore\Temp\{3501cea1-1def-284d-aeaa-53ba66ad3796}\SET98AB.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	File created: C:\Program Files\FastestVPN\Resources\driver\windows\amd64\is-PG7JG.tmp	Jump to dropped file
Source: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exe	File created: C:\Users\user\AppData\Local\Temp\{d561b4bd-4963-934e-b2b1-0e0727e36250}\tap0901.cat (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	File created: C:\Program Files\FastestVPN\Resources\driver\windows10\i386\is-SPFH5.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	File created: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tap0901.cat (copy)	Jump to dropped file
Source: C:\Windows\System32\drvinst.exe	File created: C:\Windows\System32\DriverStore\Temp\{3501cea1-1def-284d-aeaa-53ba66ad3796}\tap0901.cat (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	File created: C:\Program Files\FastestVPN\Resources\driver\windows10\i386\tap0901.cat (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	File created: C:\Program Files\FastestVPN\Resources\driver\windows\i386\tap0901.cat (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	File created: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\is-DDCD3.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	File created: C:\Program Files\FastestVPN\Resources\driver\windows\amd64\tap0901.cat (copy)	Jump to dropped file

Spam, unwanted Advertisements and Ransom Demands

Reads the Security eventlog

Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe	Key opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\Security
Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe	Key opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\Security
Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe	Key opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\Security
Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe	Key opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\Security
Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe	Key opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\Security
Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe	Key opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\Security

Reads the System eventlog

Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe	Key opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\System
Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe	Key opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\System
Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe	Key opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\System
Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe	Key opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\System
Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe	Key opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\System
Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe	Key opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\System

System Summary

Malicious sample detected (through community Yara rule)

Source: C:\Program Files\FastestVPN\Resources\is-QOP0D.tmp, type: DROPPED

Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen

Contains functionality to communicate with device drivers

Source: C:\Program Files\FastestVPN\Resources\sp\release\nfregdrv.exe

Code function: 25_2_10014000: ?nf_getDriverType@nfapi@@YAKXZ,EnterCriticalSection,LeaveCriticalSection,DeviceIoControl,LeaveCriticalSection,LeaveCriticalSection,

25_2_10014000

Contains functionality to delete services

Source: C:\Program Files\FastestVPN\Resources\sp\release\nfregdrv.exe

Code function: 25_2_100134A0 ?nf_unRegisterDriver@nfapi@@YA?AW4_NF_STATUS@@PBD@Z,OpenSCManagerA,OpenServiceA,DeleteService,GetLastError,CloseServiceHandle,CloseServiceHandle,GetLastError,CloseServiceHandle,GetLastError,SetLastError,

25_2_100134A0

Creates driver files

Source: C:\Windows\System32\xcopy.exe

File created: C:\Windows\system32\drivers\fastestvpndriver.sys

Creates files inside the driver directory

Source: C:\Windows\System32\drvinst.exe

File created: C:\Windows\System32\DriverStore\Temp\{3501cea1-1def-284d-aeaa-53ba66ad3796}

Jump to behavior

Creates files inside the system directory

Source: C:\Windows\System32\drvinst.exe	File created: C:\Windows\System32\DriverStore\FileRepository\oemvista.inf_amd64_6d4bec28a2ef0cdf	Jump to behavior
Source: C:\Windows\System32\drvinst.exe	File created: C:\Windows\System32\DriverStore\drvstore.tmp	Jump to behavior
Source: C:\Windows\System32\drvinst.exe	File created: C:\Windows\inf\oem4.inf	Jump to behavior
Source: C:\Windows\System32\drvinst.exe	File created: C:\Windows\System32\drivers\SET9DE9.tmp	Jump to behavior
Source: C:\Windows\System32\drvinst.exe	File created: C:\Windows\System32\drivers\SET9DE9.tmp	Jump to behavior
Source: C:\Windows\System32\xcopy.exe	File created: C:\Windows\system32\drivers\fastestvpndriver.sys
Source: C:\Windows\System32\svchost.exe	File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Deletes files inside the Windows folder

Source: C:\Windows\System32\drvinst.exe

File deleted: C:\Windows\System32\DriverStore\Temp\{3501cea1-1def-284d-aeaa-53ba66ad3796}\SET989A.tmp

Jump to behavior

Detected potential crypto function

Source: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exe	Code function: 10_2_00007FF70A9E41D0	10_2_00007FF70A9E41D0
Source: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exe	Code function: 10_2_00007FF70A9E52E0	10_2_00007FF70A9E52E0
Source: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exe	Code function: 10_2_00007FF70AA04B7C	10_2_00007FF70AA04B7C
Source: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exe	Code function: 10_2_00007FF70AA22920	10_2_00007FF70AA22920
Source: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exe	Code function: 10_2_00007FF70A9E7030	10_2_00007FF70A9E7030
Source: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exe	Code function: 10_2_00007FF70AA04E5C	10_2_00007FF70AA04E5C
Source: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exe	Code function: 10_2_00007FF70AA283E4	10_2_00007FF70AA283E4
Source: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exe	Code function: 10_2_00007FF70AA24340	10_2_00007FF70AA24340
Source: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exe	Code function: 10_2_00007FF70AA04430	10_2_00007FF70AA04430
Source: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exe	Code function: 10_2_00007FF70AA041AC	10_2_00007FF70AA041AC
Source: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exe	Code function: 10_2_00007FF70AA22160	10_2_00007FF70AA22160
Source: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exe	Code function: 10_2_00007FF70AA1E0B0	10_2_00007FF70AA1E0B0
Source: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exe	Code function: 10_2_00007FF70AA322DC	10_2_00007FF70AA322DC
Source: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exe	Code function: 10_2_00007FF70AA2A7C0	10_2_00007FF70AA2A7C0
Source: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exe	Code function: 10_2_00007FF70AA1E810	10_2_00007FF70AA1E810
Source: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exe	Code function: 10_2_00007FF70AA1C738	10_2_00007FF70AA1C738
Source: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exe	Code function: 10_2_00007FF70AA04914	10_2_00007FF70AA04914
Source: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exe	Code function: 10_2_00007FF70AA04698	10_2_00007FF70AA04698
Source: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exe	Code function: 10_2_00007FF70AA266E8	10_2_00007FF70AA266E8
Source: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exe	Code function: 10_2_00007FF70AA12640	10_2_00007FF70AA12640
Source: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exe	Code function: 10_2_00007FF70AA29BC0	10_2_00007FF70AA29BC0
Source: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exe	Code function: 10_2_00007FF70AA03C8C	10_2_00007FF70AA03C8C
Source: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exe	Code function: 10_2_00007FF70AA059DC	10_2_00007FF70AA059DC
Source: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exe	Code function: 10_2_00007FF70AA1E0B0	10_2_00007FF70AA1E0B0
Source: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exe	Code function: 10_2_00007FF70AA2A070	10_2_00007FF70AA2A070
Source: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exe	Code function: 10_2_00007FF70AA1BD18	10_2_00007FF70AA1BD18
Source: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exe	Code function: 10_2_00007FF70AA13F14	10_2_00007FF70AA13F14
Source: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exe	Code function: 10_2_00007FF70AA03F10	10_2_00007FF70AA03F10
Source: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exe	Code function: 10_2_00007FF70A9E13E0	10_2_00007FF70A9E13E0
Source: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exe	Code function: 10_2_00007FF70AA05430	10_2_00007FF70AA05430
Source: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exe	Code function: 10_2_00007FF70AA21154	10_2_00007FF70AA21154
Source: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exe	Code function: 10_2_00007FF70A9EB1FC	10_2_00007FF70A9EB1FC
Source: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exe	Code function: 10_2_00007FF70AA21154	10_2_00007FF70AA21154
Source: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exe	Code function: 10_2_00007FF70AA05150	10_2_00007FF70AA05150
Source: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exe	Code function: 10_2_00007FF70AA2D168	10_2_00007FF70AA2D168
Source: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exe	Code function: 10_2_00007FF70AA056FC	10_2_00007FF70AA056FC
Source: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exe	Code function: 10_2_00007FF70AA296F0	10_2_00007FF70AA296F0
Source: C:\Program Files\FastestVPN\Resources\sp\release\nfregdrv.exe	Code function: 25_2_00402920	25_2_00402920
Source: C:\Program Files\FastestVPN\Resources\sp\release\nfregdrv.exe	Code function: 25_2_00404DDB	25_2_00404DDB
Source: C:\Program Files\FastestVPN\Resources\sp\release\nfregdrv.exe	Code function: 25_2_10002060	25_2_10002060
Source: C:\Program Files\FastestVPN\Resources\sp\release\nfregdrv.exe	Code function: 25_2_1000A0A0	25_2_1000A0A0
Source: C:\Program Files\FastestVPN\Resources\sp\release\nfregdrv.exe	Code function: 25_2_10009A81	25_2_10009A81
Source: C:\Program Files\FastestVPN\Resources\sp\release\nfregdrv.exe	Code function: 25_2_10005C60	25_2_10005C60
Source: C:\Program Files\FastestVPN\Resources\sp\release\nfregdrv.exe	Code function: 25_2_1000BD21	25_2_1000BD21
Source: C:\Program Files\FastestVPN\Resources\sp\release\nfregdrv.exe	Code function: 25_2_10001620	25_2_10001620
Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe	Code function: 29_2_05783366	29_2_05783366
Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe	Code function: 29_2_057838B4	29_2_057838B4
Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe	Code function: 29_2_01750D4D	29_2_01750D4D
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Code function: 34_2_05D16E58	34_2_05D16E58
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Code function: 34_2_05D1701A	34_2_05D1701A
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Code function: 34_2_05D1712E	34_2_05D1712E
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Code function: 34_2_05D73C1A	34_2_05D73C1A
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Code function: 34_2_05D72FE2	34_2_05D72FE2
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Code function: 34_2_060A4900	34_2_060A4900
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Code function: 34_2_060A5CD6	34_2_060A5CD6
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Code function: 34_2_0BE3317E	34_2_0BE3317E
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Code function: 34_2_0BE3305A	34_2_0BE3305A
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Code function: 34_2_0BE34799	34_2_0BE34799
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Code function: 34_2_0C175D0B	34_2_0C175D0B
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Code function: 34_2_0C17BB59	34_2_0C17BB59
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Code function: 34_2_0C1726E8	34_2_0C1726E8
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Code function: 34_2_0C1E5C52	34_2_0C1E5C52
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Code function: 34_2_02D23848	34_2_02D23848
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Code function: 34_2_02D2D262	34_2_02D2D262
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Code function: 34_2_02D2D062	34_2_02D2D062
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Code function: 34_2_02D2D035	34_2_02D2D035
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Code function: 34_2_02D2D162	34_2_02D2D162
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Code function: 34_2_063256C0	34_2_063256C0
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Code function: 34_2_0632B090	34_2_0632B090
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Code function: 34_2_06327B30	34_2_06327B30
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Code function: 34_2_06320439	34_2_06320439
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Code function: 34_2_06320D28	34_2_06320D28
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Code function: 34_2_06320D18	34_2_06320D18
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Code function: 34_2_0BD62A40	34_2_0BD62A40
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Code function: 34_2_0BDF04A1	34_2_0BDF04A1
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Code function: 34_2_0C1BCDB0	34_2_0C1BCDB0
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Code function: 34_2_0C1B8178	34_2_0C1B8178
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Code function: 34_2_0C1BC198	34_2_0C1BC198
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Code function: 34_2_0C1B6360	34_2_0C1B6360
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Code function: 34_2_0C1BC4E0	34_2_0C1BC4E0
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 35_2_0367A528	35_2_0367A528
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 35_2_0367ADF8	35_2_0367ADF8
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 35_2_0367A1E0	35_2_0367A1E0
Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe	Code function: 42_2_00A65F27	42_2_00A65F27
Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe	Code function: 42_2_00A65F38	42_2_00A65F38
Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe	Code function: 42_2_00A65F48	42_2_00A65F48
Source: C:\Program Files\FastestVPN\subinacl.exe	Code function: 43_2_010383F6	43_2_010383F6
Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe	Code function: 47_2_04523D9F	47_2_04523D9F
Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe	Code function: 47_2_0452699C	47_2_0452699C
Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe	Code function: 47_2_045C5F9F	47_2_045C5F9F
Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe	Code function: 47_2_045C5988	47_2_045C5988
Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe	Code function: 47_2_046976B7	47_2_046976B7
Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe	Code function: 47_2_0471571D	47_2_0471571D
Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe	Code function: 47_2_047A3986	47_2_047A3986
Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe	Code function: 47_2_04806998	47_2_04806998
Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe	Code function: 47_2_048033B9	47_2_048033B9
Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe	Code function: 47_2_04803276	47_2_04803276
Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe	Code function: 47_2_04805D9D	47_2_04805D9D

Enables driver privileges

Source: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exe

Process token adjusted: Load Driver

Jump to behavior

Enables security privileges

Source: C:\Windows\System32\svchost.exe

Process token adjusted: Security

Jump to behavior

Found potential string decryption / allocating functions

Source: C:\Program Files\FastestVPN\Resources\sp\release\nfregdrv.exe	Code function: String function: 1000A044 appears 35 times
Source: C:\Program Files\FastestVPN\subinacl.exe	Code function: String function: 0103E03C appears 110 times
Source: C:\Program Files\FastestVPN\subinacl.exe	Code function: String function: 0103E368 appears 75 times
Source: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exe	Code function: String function: 00007FF70AA181A8 appears 48 times

One or more processes crash

Source: C:\Windows\System32\svchost.exe

Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 6276 -ip 6276

PE file contains executable resources (Code or Archives)

Source: PVUfopbGfc.tmp.0.dr	Static PE information: Resource name: RT_RCDATA type: PE32+ executable (console) x86-64, for MS Windows
Source: is-1SSK8.tmp.1.dr	Static PE information: Resource name: RT_RCDATA type: PE32+ executable (console) x86-64, for MS Windows

Sample file is different than original file name gathered from version info

Source: PVUfopbGfc.exe, 00000000.00000003.2037873390.0000000002942000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFileName vs PVUfopbGfc.exe
Source: PVUfopbGfc.exe, 00000000.00000003.2038232664.000000007FE2E000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFileName vs PVUfopbGfc.exe
Source: PVUfopbGfc.exe, 00000000.00000000.2036420422.00000000004B9000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFileName vs PVUfopbGfc.exe
Source: PVUfopbGfc.exe	Binary or memory string: OriginalFileName vs PVUfopbGfc.exe

Uses 32bit PE files

Source: PVUfopbGfc.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE

Uses reg.exe to modify the Windows registry

Source: C:\Windows\System32\cmd.exe

Process created: C:\Windows\System32\reg.exe reg Query "HKLM\Hardware\Description\System\CentralProcessor\0"

Yara signature match

Source: C:\Program Files\FastestVPN\Resources\is-QOP0D.tmp, type: DROPPED

Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)

Source: is-FRGRO.tmp.1.dr

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: is-OTL5D.tmp.1.dr	Binary string: Type the password for user :--- DEBUG NetDfsGetClientInfo Dfs path detected = --- DEBUG NetDfsGetClientInfo NetStatus = --- DEBUG NetDfsGetClientInfo DfsPath to check = \\%[^\]\%[^\]--- DEBUG NetDfsGetClientInfo exists in NetApi32.lib. DfsPath is checked = --- DEBUG NetDfsGetClientInfo not existing in NetApi32.lib. DfsPath not checked = NetDfsGetClientInfoNetApi32.dll--- DEBUG FileFullPathName Default Sam Server will be = --- DEBUG FileFullPathName ShareName is = --- DEBUG FileFullPathName Server is = \Device\LanmanRedirector\;%[^\]\%[^\]\%s\Device\LanmanRedirector\\Device\WinDfs\ privileges to run this tool successfullyYou may need privilege. This privilege may be required. WARNING :Unable to set SeDebugPrivilegeSeChangeNotifyPrivilegeSeTakeOwnershipPrivilegeSeBackupPrivilegeSeSecurityPrivilegeSeRestorePrivilegeCheckPriv : Memory ExhaustedParsing registry key error :Could not open Sam Server :Error OpenSCManager : will not be processed. Dfs path is not supported--- DEBUG ObjCreateInstance - Error FileFullPathName = Remote access is not allowed for kernelobject or process--- DEBUG ObjCreateInstance - Default Sam Server will be = - DfsPath is not supported
Source: SET9DE9.tmp.14.dr	Binary string: \Device\
Source: is-PBM2F.tmp.1.dr	Binary string: \Device\.tap\DosDevices\Global\.tapdiagTAP-Windows Adapter V9

Source: classification engine

Classification label: mal76.troj.spyw.expl.evad.winEXE@83/372@1/2

Source: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exe	Code function: 10_2_00007FF70A9E52E0 CharNextW,CharNextW,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,CloseHandle,InitiateSystemShutdownExW,	10_2_00007FF70A9E52E0
Source: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exe	Code function: 10_2_00007FF70A9E4D80 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,CloseHandle,InitiateSystemShutdownExW,	10_2_00007FF70A9E4D80
Source: C:\Program Files\FastestVPN\Resources\sp\release\nfregdrv.exe	Code function: 25_2_100139D0 ?nf_adjustProcessPriviledges@nfapi@@YAXXZ,GetCurrentProcessId,OpenProcess,OpenProcessToken,CloseHandle,LookupPrivilegeValueA,CloseHandle,CloseHandle,AdjustTokenPrivileges,CloseHandle,CloseHandle,CloseHandle,	25_2_100139D0
Source: C:\Program Files\FastestVPN\subinacl.exe	Code function: 43_2_0101CA79 LookupPrivilegeValueW,AdjustTokenPrivileges,PrivilegeCheck,GetLastError,_CxxThrowException,	43_2_0101CA79

Source: C:\Program Files\FastestVPN\Resources\sp\release\nfregdrv.exe

Code function: OpenSCManagerA,CreateServiceW,CloseServiceHandle,GetLastError,GetLastError,OpenServiceA,QueryServiceStatus,StartServiceA,GetLastError,CloseServiceHandle,GetLastError,CloseServiceHandle,SetLastError,

25_2_10013540

Source: C:\Program Files\FastestVPN\Resources\sp\release\nfregdrv.exe

Code function: 25_2_10013540 OpenSCManagerA,CreateServiceW,CloseServiceHandle,GetLastError,GetLastError,OpenServiceA,QueryServiceStatus,StartServiceA,GetLastError,CloseServiceHandle,GetLastError,CloseServiceHandle,SetLastError,

25_2_10013540

Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe	Code function: 47_2_019B13E8 StartServiceCtrlDispatcherW,		47_2_019B13E8
Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe	Code function: 47_2_019B13E1 StartServiceCtrlDispatcherW,		47_2_019B13E1

Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp

File created: C:\Program Files\FastestVPN

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp

File created: C:\Users\Public\Desktop\FastestVPN.lnk

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6648:120:WilError_03
Source: C:\Windows\System32\drvinst.exe	Mutant created: \BaseNamedObjects\DrvInst.exe_mutex_{5B10AC83-4F13-4fde-8C0B-B85681BA8D73}
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Mutant created: NULL
Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe	Mutant created: \Sessions\1\BaseNamedObjects\Global\netfxeventlog.1.0
Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess6276
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5008:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5684:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6608:120:WilError_03
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Mutant created: \Sessions\1\BaseNamedObjects\F7ADS2TDE9SFT7VCP4NAF2A1S4TAE7S8TBVDPEN5FAA3S0T3EFS6T1V4PDN4F8user
Source: C:\Users\user\AppData\Local\Temp\Launcher.exe	Mutant created: \Sessions\1\BaseNamedObjects\DVRAY
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Mutant created: \Sessions\1\BaseNamedObjects\Global\8C9EED5B-604B-4700-866A-6A9606527CC6
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3556:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3856:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5388:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5756:120:WilError_03
Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe	Mutant created: \BaseNamedObjects\Global\netfxeventlog.1.0
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5380:120:WilError_03

Source: C:\Users\user\Desktop\PVUfopbGfc.exe

File created: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp

Process created: C:\Windows\System32\cmd.exe "C:\Windows\system32\cmd.exe" /C ""C:\Program Files\FastestVPN\Resources\driver\install_tap.bat""

Source: C:\Program Files\FastestVPN\Resources\sp\release\nfregdrv.exe

Command line argument: nfregdvr

25_2_00401050

Source: C:\Users\user\Desktop\PVUfopbGfc.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Users\user\Desktop\PVUfopbGfc.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp

File read: C:\Program Files\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\PVUfopbGfc.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp

Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion RegisteredOrganization

Jump to behavior

Source: PVUfopbGfc.exe

ReversingLabs: Detection: 21%

Source: tapinstall.exe	String found in binary or memory: itioned on the newly-added filter. ! Deletes the next occurrence of the specified filter. When the subcommand
Source: tapinstall.exe	String found in binary or memory: of the list. When the subcommand completes, the cursor is positioned on the newly-added filter. + Add after. I
Source: FastestVPN.WindowsService.exe	String found in binary or memory: registerHubProxies(proxies, true); this._registerSubscribedHubs(); }).disconnected(function () { // Unsubscribe all hub proxies when we "disconnect". This is to ensure that we do not re-add functional call backs.
Source: FastestVPN.WindowsService.exe	String found in binary or memory: /installtunnelservice "
Source: PVUfopbGfc.exe	String found in binary or memory: /LOADINF="filename"

Source: C:\Users\user\Desktop\PVUfopbGfc.exe

File read: C:\Users\user\Desktop\PVUfopbGfc.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\PVUfopbGfc.exe "C:\Users\user\Desktop\PVUfopbGfc.exe"
Source: C:\Users\user\Desktop\PVUfopbGfc.exe	Process created: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp "C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp" /SL5="$1046E,20382094,735744,C:\Users\user\Desktop\PVUfopbGfc.exe"
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Process created: C:\Windows\System32\cmd.exe "C:\Windows\system32\cmd.exe" /C ""C:\Program Files\FastestVPN\Resources\driver\install_tap.bat""
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\reg.exe reg Query "HKLM\Hardware\Description\System\CentralProcessor\0"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\find.exe find /i "x86"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c ver
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exe tapinstall.exe remove tap0901
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exe tapinstall.exe install OemVista.inf tap0901
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\system32\svchost.exe -k DcomLaunch -p -s DeviceInstall
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\System32\drvinst.exe DrvInst.exe "4" "0" "C:\Users\user\AppData\Local\Temp\{d561b4bd-4963-934e-b2b1-0e0727e36250}\oemvista.inf" "9" "4d14a44ff" "0000000000000160" "WinSta0\Default" "0000000000000158" "208" "c:\program files\fastestvpn\resources\driver\windows10\amd64"
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\System32\drvinst.exe DrvInst.exe "2" "211" "ROOT\NET\0000" "C:\Windows\INF\oem4.inf" "oem4.inf:3beb73aff103cc24:tap0901.ndi:9.24.2.601:tap0901," "4d14a44ff" "0000000000000180"
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s NetSetupSvc
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Process created: C:\Windows\System32\cmd.exe "C:\Windows\system32\cmd.exe" /C ""C:\Program Files\FastestVPN\Resources\sp\install_sp.bat""
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc stop fastestvpndriver
Source: C:\Windows\System32\sc.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\reg.exe reg Query "HKLM\Hardware\Description\System\CentralProcessor\0"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\find.exe find /i "x86"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\reg.exe reg QUERY "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\find.exe find /i "Windows 7"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\xcopy.exe xcopy /y driver\windows8\amd64\fastestvpndriver.sys C:\Windows\system32\drivers
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\FastestVPN\Resources\sp\release\nfregdrv.exe release\nfregdrv.exe -u fastestvpndriver
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\FastestVPN\Resources\sp\release\nfregdrv.exe release\nfregdrv.exe fastestvpndriver
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Process created: C:\Windows\System32\sc.exe "C:\Windows\system32\sc.exe" stop FastestVPNService
Source: C:\Windows\System32\sc.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Process created: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe "C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe" --uninstall
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k WerSvcGroup
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 6276 -ip 6276
Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 6276 -s 1076
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc
Source: unknown	Process created: C:\Program Files\FastestVPN\FastestVPN.exe "C:\Program Files\FastestVPN\FastestVPN.exe" -autorun
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "powershell" -windowstyle hidden get-wmiobject Win32_ComputerSystemProduct \| Select-Object -ExpandProperty UUID
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Process created: C:\Windows\System32\sc.exe "C:\Windows\system32\sc.exe" delete FastestVPNService
Source: C:\Windows\System32\sc.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Process created: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe "C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe" --install
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Process created: C:\Program Files\FastestVPN\subinacl.exe "C:\Program Files\FastestVPN\subinacl.exe" /service FastestVPNService /GRANT=everyone=TO
Source: C:\Program Files\FastestVPN\subinacl.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Process created: C:\Windows\System32\sc.exe "C:\Windows\system32\sc.exe" start FastestVPNService
Source: C:\Windows\System32\sc.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe "C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe"
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Process created: C:\Program Files\FastestVPN\Resources\ComDebug.exe "C:\Program Files\FastestVPN\Resources\ComDebug.exe"
Source: C:\Windows\SysWOW64\WerFault.exe	Process created: C:\Windows\System32\dllhost.exe C:\Windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}
Source: C:\Program Files\FastestVPN\Resources\ComDebug.exe	Process created: C:\Windows\SysWOW64\netsh.exe C:\Windows\SysWOW64\netsh.exe
Source: C:\Windows\SysWOW64\netsh.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Process created: C:\Program Files\FastestVPN\FastestVPN.exe "C:\Program Files\FastestVPN\FastestVPN.exe"
Source: C:\Windows\SysWOW64\netsh.exe	Process created: C:\Users\user\AppData\Local\Temp\Launcher.exe C:\Users\user\AppData\Local\Temp\Launcher.exe
Source: C:\Users\user\Desktop\PVUfopbGfc.exe	Process created: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp "C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp" /SL5="$1046E,20382094,735744,C:\Users\user\Desktop\PVUfopbGfc.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Process created: C:\Windows\System32\cmd.exe "C:\Windows\system32\cmd.exe" /C ""C:\Program Files\FastestVPN\Resources\driver\install_tap.bat""	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Process created: C:\Windows\System32\cmd.exe "C:\Windows\system32\cmd.exe" /C ""C:\Program Files\FastestVPN\Resources\sp\install_sp.bat""	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Process created: C:\Windows\System32\sc.exe "C:\Windows\system32\sc.exe" stop FastestVPNService	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c ver	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Process created: C:\Windows\System32\sc.exe "C:\Windows\system32\sc.exe" delete FastestVPNService	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Process created: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe "C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe" --install	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Process created: C:\Program Files\FastestVPN\subinacl.exe "C:\Program Files\FastestVPN\subinacl.exe" /service FastestVPNService /GRANT=everyone=TO	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Process created: C:\Windows\System32\find.exe find /i "Windows 7"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Process created: C:\Program Files\FastestVPN\Resources\ComDebug.exe "C:\Program Files\FastestVPN\Resources\ComDebug.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Process created: C:\Program Files\FastestVPN\FastestVPN.exe "C:\Program Files\FastestVPN\FastestVPN.exe"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\reg.exe reg Query "HKLM\Hardware\Description\System\CentralProcessor\0"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\find.exe find /i "x86"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c ver	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exe tapinstall.exe remove tap0901	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exe tapinstall.exe install OemVista.inf tap0901	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\System32\drvinst.exe DrvInst.exe "4" "0" "C:\Users\user\AppData\Local\Temp\{d561b4bd-4963-934e-b2b1-0e0727e36250}\oemvista.inf" "9" "4d14a44ff" "0000000000000160" "WinSta0\Default" "0000000000000158" "208" "c:\program files\fastestvpn\resources\driver\windows10\amd64"	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\System32\drvinst.exe DrvInst.exe "2" "211" "ROOT\NET\0000" "C:\Windows\INF\oem4.inf" "oem4.inf:3beb73aff103cc24:tap0901.ndi:9.24.2.601:tap0901," "4d14a44ff" "0000000000000180"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc stop fastestvpndriver	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\reg.exe reg Query "HKLM\Hardware\Description\System\CentralProcessor\0"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\find.exe find /i "x86"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\reg.exe reg QUERY "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\find.exe find /i "Windows 7"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\xcopy.exe xcopy /y driver\windows8\amd64\fastestvpndriver.sys C:\Windows\system32\drivers	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\FastestVPN\Resources\sp\release\nfregdrv.exe release\nfregdrv.exe -u fastestvpndriver	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\FastestVPN\Resources\sp\release\nfregdrv.exe release\nfregdrv.exe fastestvpndriver	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 6276 -ip 6276
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 6276 -s 1076
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\SysWOW64\WerFault.exe	Process created: unknown unknown
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "powershell" -windowstyle hidden get-wmiobject Win32_ComputerSystemProduct \| Select-Object -ExpandProperty UUID
Source: C:\Program Files\FastestVPN\Resources\ComDebug.exe	Process created: C:\Windows\SysWOW64\netsh.exe C:\Windows\SysWOW64\netsh.exe
Source: C:\Windows\SysWOW64\netsh.exe	Process created: C:\Users\user\AppData\Local\Temp\Launcher.exe C:\Users\user\AppData\Local\Temp\Launcher.exe

Source: C:\Users\user\Desktop\PVUfopbGfc.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\PVUfopbGfc.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Section loaded: winsta.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Section loaded: shfolder.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Section loaded: msftedit.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Section loaded: windows.globalization.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Section loaded: bcp47mrm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Section loaded: globinputhost.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Section loaded: windows.ui.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Section loaded: windowmanagementapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Section loaded: inputhost.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Section loaded: explorerframe.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Section loaded: sfc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Section loaded: linkinfo.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Section loaded: ntshrui.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Section loaded: cscapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: cmdext.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\System32\find.exe	Section loaded: ulib.dll	Jump to behavior
Source: C:\Windows\System32\find.exe	Section loaded: fsutilext.dll	Jump to behavior
Source: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exe	Section loaded: devobj.dll	Jump to behavior
Source: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exe	Section loaded: devrtl.dll	Jump to behavior
Source: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exe	Section loaded: spinf.dll	Jump to behavior
Source: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exe	Section loaded: drvstore.dll	Jump to behavior
Source: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exe	Section loaded: devobj.dll	Jump to behavior
Source: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exe	Section loaded: newdev.dll	Jump to behavior
Source: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exe	Section loaded: cabinet.dll	Jump to behavior
Source: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpnpmgr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: devrtl.dll	Jump to behavior
Source: C:\Windows\System32\drvinst.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\drvinst.exe	Section loaded: devrtl.dll	Jump to behavior
Source: C:\Windows\System32\drvinst.exe	Section loaded: drvstore.dll	Jump to behavior
Source: C:\Windows\System32\drvinst.exe	Section loaded: cabinet.dll	Jump to behavior
Source: C:\Windows\System32\drvinst.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\drvinst.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\drvinst.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\drvinst.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\drvinst.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\drvinst.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\drvinst.exe	Section loaded: devrtl.dll	Jump to behavior
Source: C:\Windows\System32\drvinst.exe	Section loaded: drvstore.dll	Jump to behavior
Source: C:\Windows\System32\drvinst.exe	Section loaded: devobj.dll	Jump to behavior
Source: C:\Windows\System32\drvinst.exe	Section loaded: cabinet.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netsetupsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netsetupapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netsetupengine.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: implatsetup.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: devrtl.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: spinf.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: drvstore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netsetupengine.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: implatsetup.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: cmdext.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\System32\find.exe	Section loaded: ulib.dll
Source: C:\Windows\System32\find.exe	Section loaded: fsutilext.dll
Source: C:\Windows\System32\find.exe	Section loaded: ulib.dll
Source: C:\Windows\System32\find.exe	Section loaded: fsutilext.dll
Source: C:\Windows\System32\xcopy.exe	Section loaded: ulib.dll
Source: C:\Windows\System32\xcopy.exe	Section loaded: ifsutil.dll
Source: C:\Windows\System32\xcopy.exe	Section loaded: devobj.dll
Source: C:\Windows\System32\xcopy.exe	Section loaded: fsutilext.dll
Source: C:\Windows\System32\xcopy.exe	Section loaded: ntmarta.dll
Source: C:\Program Files\FastestVPN\Resources\sp\release\nfregdrv.exe	Section loaded: apphelp.dll
Source: C:\Program Files\FastestVPN\Resources\sp\release\nfregdrv.exe	Section loaded: nfapi.dll
Source: C:\Program Files\FastestVPN\Resources\sp\release\nfregdrv.exe	Section loaded: nfapi.dll
Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe	Section loaded: mscoree.dll
Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe	Section loaded: apphelp.dll
Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe	Section loaded: kernel.appcore.dll
Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe	Section loaded: version.dll
Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe	Section loaded: windows.storage.dll
Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe	Section loaded: wldp.dll
Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe	Section loaded: profapi.dll
Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe	Section loaded: cryptsp.dll
Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe	Section loaded: rsaenh.dll
Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wersvc.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: windowsperformancerecordercontrol.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: weretw.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wer.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: faultrep.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: dbghelp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: dbgcore.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wer.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wlidsvc.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: clipc.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msxml6.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wtsapi32.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: winsta.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: gamestreamingext.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msauserext.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: tbs.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptnet.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptngc.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: devobj.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptprov.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: elscore.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: elstrans.dll
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Section loaded: mscoree.dll
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Section loaded: apphelp.dll
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Section loaded: kernel.appcore.dll
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Section loaded: version.dll
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Section loaded: uxtheme.dll
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Section loaded: cryptsp.dll
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Section loaded: rsaenh.dll
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Section loaded: cryptbase.dll
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Section loaded: dwrite.dll
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Section loaded: msvcp140_clr0400.dll
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Section loaded: sspicli.dll
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Section loaded: mswsock.dll
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Section loaded: windows.storage.dll
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Section loaded: wldp.dll
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Section loaded: profapi.dll
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Section loaded: dwmapi.dll
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Section loaded: d3d9.dll
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Section loaded: d3d10warp.dll
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Section loaded: urlmon.dll
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Section loaded: iertutil.dll
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Section loaded: srvcli.dll
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Section loaded: netutils.dll
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Section loaded: windowscodecs.dll
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Section loaded: wtsapi32.dll
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Section loaded: winsta.dll
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Section loaded: powrprof.dll
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Section loaded: umpdc.dll
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Section loaded: dataexchange.dll
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Section loaded: d3d11.dll
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Section loaded: dcomp.dll
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Section loaded: dxgi.dll
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Section loaded: twinapi.appcore.dll
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Section loaded: resourcepolicyclient.dll
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Section loaded: dxcore.dll
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Section loaded: textshaping.dll
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Section loaded: textinputframework.dll
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Section loaded: coreuicomponents.dll
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Section loaded: coremessaging.dll
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Section loaded: ntmarta.dll
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Section loaded: coremessaging.dll
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Section loaded: wintypes.dll
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Section loaded: wintypes.dll
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Section loaded: wintypes.dll
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Section loaded: msctfui.dll
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Section loaded: uiautomationcore.dll
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Section loaded: propsys.dll
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Section loaded: d3dcompiler_47.dll
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Section loaded: winmm.dll
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Section loaded: msasn1.dll
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Section loaded: riched20.dll
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Section loaded: usp10.dll
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Section loaded: msls31.dll
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Section loaded: gpapi.dll
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Section loaded: cryptnet.dll
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Section loaded: iphlpapi.dll
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Section loaded: winnsi.dll
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Section loaded: winhttp.dll
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Section loaded: dhcpcsvc6.dll
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Section loaded: dhcpcsvc.dll
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Section loaded: webio.dll
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Section loaded: dnsapi.dll
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Section loaded: rasadhlp.dll
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Section loaded: fwpuclnt.dll
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Section loaded: wbemcomn.dll
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Section loaded: amsi.dll
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Section loaded: userenv.dll
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Section loaded: rasapi32.dll
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Section loaded: rasman.dll
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Section loaded: rtutils.dll
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Section loaded: secur32.dll
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Section loaded: schannel.dll
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Section loaded: mskeyprotect.dll
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Section loaded: ntasn1.dll
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Section loaded: ncrypt.dll
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Section loaded: ncryptsslp.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: napinsp.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: pnrpnsp.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshbth.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: nlaapi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winrnr.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: fwpuclnt.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasadhlp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll
Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe	Section loaded: mscoree.dll
Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe	Section loaded: kernel.appcore.dll
Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe	Section loaded: version.dll
Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe	Section loaded: windows.storage.dll
Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe	Section loaded: wldp.dll
Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe	Section loaded: profapi.dll
Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe	Section loaded: cryptsp.dll
Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe	Section loaded: rsaenh.dll
Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe	Section loaded: cryptbase.dll
Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe	Section loaded: urlmon.dll
Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe	Section loaded: iertutil.dll
Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe	Section loaded: srvcli.dll
Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe	Section loaded: netutils.dll
Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe	Section loaded: sspicli.dll
Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe	Section loaded: propsys.dll
Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe	Section loaded: msasn1.dll
Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe	Section loaded: riched20.dll
Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe	Section loaded: usp10.dll
Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe	Section loaded: msls31.dll
Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe	Section loaded: gpapi.dll
Source: C:\Program Files\FastestVPN\subinacl.exe	Section loaded: apphelp.dll
Source: C:\Program Files\FastestVPN\subinacl.exe	Section loaded: mfc42u.dll
Source: C:\Program Files\FastestVPN\subinacl.exe	Section loaded: msvcirt.dll
Source: C:\Program Files\FastestVPN\subinacl.exe	Section loaded: msvcp60.dll
Source: C:\Program Files\FastestVPN\subinacl.exe	Section loaded: version.dll
Source: C:\Program Files\FastestVPN\subinacl.exe	Section loaded: netapi32.dll
Source: C:\Program Files\FastestVPN\subinacl.exe	Section loaded: mpr.dll
Source: C:\Program Files\FastestVPN\subinacl.exe	Section loaded: clusapi.dll
Source: C:\Program Files\FastestVPN\subinacl.exe	Section loaded: samlib.dll
Source: C:\Program Files\FastestVPN\subinacl.exe	Section loaded: dnsapi.dll
Source: C:\Program Files\FastestVPN\subinacl.exe	Section loaded: srvcli.dll
Source: C:\Program Files\FastestVPN\subinacl.exe	Section loaded: netutils.dll
Source: C:\Program Files\FastestVPN\subinacl.exe	Section loaded: logoncli.dll
Source: C:\Program Files\FastestVPN\subinacl.exe	Section loaded: samcli.dll
Source: C:\Program Files\FastestVPN\subinacl.exe	Section loaded: iphlpapi.dll
Source: C:\Program Files\FastestVPN\subinacl.exe	Section loaded: kernel.appcore.dll
Source: C:\Program Files\FastestVPN\subinacl.exe	Section loaded: uxtheme.dll
Source: C:\Program Files\FastestVPN\subinacl.exe	Section loaded: ntmarta.dll
Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe	Section loaded: mscoree.dll
Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe	Section loaded: kernel.appcore.dll
Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe	Section loaded: version.dll
Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe	Section loaded: windows.storage.dll
Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe	Section loaded: wldp.dll
Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe	Section loaded: profapi.dll
Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe	Section loaded: mswsock.dll
Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe	Section loaded: cryptsp.dll
Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe	Section loaded: rsaenh.dll
Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe	Section loaded: cryptbase.dll
Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe	Section loaded: iphlpapi.dll
Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe	Section loaded: httpapi.dll
Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe	Section loaded: urlmon.dll
Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe	Section loaded: iertutil.dll
Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe	Section loaded: srvcli.dll
Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe	Section loaded: netutils.dll
Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe	Section loaded: sspicli.dll
Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe	Section loaded: propsys.dll
Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe	Section loaded: dnsapi.dll
Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe	Section loaded: rasadhlp.dll

Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00BB2765-6A77-11D0-A535-00C04FD7D062}\InProcServer32

Jump to behavior

Reads the Windows registered owner settings

Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp

Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion RegisteredOwner

Jump to behavior

Executable creates window controls seldom found in malware

Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp

Window found: window name: TMainForm

Jump to behavior

Found GUI installer (many successful clicks)

Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Automated click: I accept the agreement
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Automated click: Next
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Automated click: I accept the agreement
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Automated click: Next
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Automated click: Next
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Automated click: I accept the agreement
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Automated click: Next
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Automated click: I accept the agreement
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Automated click: Install
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Automated click: I accept the agreement
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Automated click: Next
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Automated click: I accept the agreement
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Automated click: Next
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Automated click: I accept the agreement
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Automated click: Next
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Automated click: I accept the agreement
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Automated click: Next
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Automated click: I accept the agreement
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Automated click: Next
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Automated click: I accept the agreement

Uses Rich Edit Controls

Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp

File opened: C:\Windows\SysWOW64\MSFTEDIT.DLL

Jump to behavior

Found graphical window changes (likely an installer)

Source: Window Recorder

Window detected: More than 3 window changes detected

Found installer window with terms and condition text

Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Window detected: License AgreementPlease read the following important information before continuing.Please read the following License Agreement. You must accept the terms of this agreement before continuing with the installation.Terms of ServiceThis is an agreement between you and FastestVPN.com for virtual private network communications services related services and features. It is NOT a service for the commission of criminal acts. It is an anonymity and privacy service. You agree not to violate any laws of any jurisdiction you are originating from or terminating into.You agree to protect your user id/password and our system from unauthorized use. You are responsible for all actions that occur on our servers where the login uses your user id/password.You agree not to use the system for sending spam port scanning scanning for open proxies or open relays sending opt-in email unsolicited email or any type or version of email sent in large quantities even if the email is ultimately sent off of another server. You agree not to launch any pop-ups from our service. You agree not to attack in any way shape or form any other computer or network while on our service.Actual service coverage speeds locations and quality may vary. The Service will attempt to be available at all times except for limited periods for maintenance and repair. However the Service may be subject to unavailability for a variety of factors beyond our control including emergencies third party service failures transmission equipment or network problems or limitations interference signal strength and may be interrupted refused limited or curtailed. We are not responsible for data messages or pages lost not delivered delayed or misdirected because of interruptions or performance issues with the Service or communications services or networks (e.g. T-1 lines or the Internet). We may impose usage or Service limits suspend Service or block certain kinds of usage in our sole discretion to protect users or the Service. Network speed is an estimate and is no indication of the speed at which your or the Service sends or receives data. Actual network speed will vary based on configuration compression network congestion and other factors. The accuracy and timeliness of data received is not guaranteed; delays or omissions may occur.We do not log any user activity (sites visited DNS lookups emails etc.) We only log access attempts to our servers (for security and troubleshooting). We do not get involved in any form of censorship. We do not give your personal info to any third parties. We do not cooperate with any requests for information unless we are ordered by a court of competent jurisdiction and the vast majority of these requests would not be from a court of competent jurisdiction. We will protect you to the max and our system is setup to automatically do so. There are hundreds of good reasons for being anonymous and we respect them fully.Hacking cracking distribution of viruses fraudulent activities network sa
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Window detected: License AgreementPlease read the following important information before continuing.Please read the following License Agreement. You must accept the terms of this agreement before continuing with the installation.Terms of ServiceThis is an agreement between you and FastestVPN.com for virtual private network communications services related services and features. It is NOT a service for the commission of criminal acts. It is an anonymity and privacy service. You agree not to violate any laws of any jurisdiction you are originating from or terminating into.You agree to protect your user id/password and our system from unauthorized use. You are responsible for all actions that occur on our servers where the login uses your user id/password.You agree not to use the system for sending spam port scanning scanning for open proxies or open relays sending opt-in email unsolicited email or any type or version of email sent in large quantities even if the email is ultimately sent off of another server. You agree not to launch any pop-ups from our service. You agree not to attack in any way shape or form any other computer or network while on our service.Actual service coverage speeds locations and quality may vary. The Service will attempt to be available at all times except for limited periods for maintenance and repair. However the Service may be subject to unavailability for a variety of factors beyond our control including emergencies third party service failures transmission equipment or network problems or limitations interference signal strength and may be interrupted refused limited or curtailed. We are not responsible for data messages or pages lost not delivered delayed or misdirected because of interruptions or performance issues with the Service or communications services or networks (e.g. T-1 lines or the Internet). We may impose usage or Service limits suspend Service or block certain kinds of usage in our sole discretion to protect users or the Service. Network speed is an estimate and is no indication of the speed at which your or the Service sends or receives data. Actual network speed will vary based on configuration compression network congestion and other factors. The accuracy and timeliness of data received is not guaranteed; delays or omissions may occur.We do not log any user activity (sites visited DNS lookups emails etc.) We only log access attempts to our servers (for security and troubleshooting). We do not get involved in any form of censorship. We do not give your personal info to any third parties. We do not cooperate with any requests for information unless we are ordered by a court of competent jurisdiction and the vast majority of these requests would not be from a court of competent jurisdiction. We will protect you to the max and our system is setup to automatically do so. There are hundreds of good reasons for being anonymous and we respect them fully.Hacking cracking distribution of viruses fraudulent activities network sa
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Window detected: License AgreementPlease read the following important information before continuing.Please read the following License Agreement. You must accept the terms of this agreement before continuing with the installation.Terms of ServiceThis is an agreement between you and FastestVPN.com for virtual private network communications services related services and features. It is NOT a service for the commission of criminal acts. It is an anonymity and privacy service. You agree not to violate any laws of any jurisdiction you are originating from or terminating into.You agree to protect your user id/password and our system from unauthorized use. You are responsible for all actions that occur on our servers where the login uses your user id/password.You agree not to use the system for sending spam port scanning scanning for open proxies or open relays sending opt-in email unsolicited email or any type or version of email sent in large quantities even if the email is ultimately sent off of another server. You agree not to launch any pop-ups from our service. You agree not to attack in any way shape or form any other computer or network while on our service.Actual service coverage speeds locations and quality may vary. The Service will attempt to be available at all times except for limited periods for maintenance and repair. However the Service may be subject to unavailability for a variety of factors beyond our control including emergencies third party service failures transmission equipment or network problems or limitations interference signal strength and may be interrupted refused limited or curtailed. We are not responsible for data messages or pages lost not delivered delayed or misdirected because of interruptions or performance issues with the Service or communications services or networks (e.g. T-1 lines or the Internet). We may impose usage or Service limits suspend Service or block certain kinds of usage in our sole discretion to protect users or the Service. Network speed is an estimate and is no indication of the speed at which your or the Service sends or receives data. Actual network speed will vary based on configuration compression network congestion and other factors. The accuracy and timeliness of data received is not guaranteed; delays or omissions may occur.We do not log any user activity (sites visited DNS lookups emails etc.) We only log access attempts to our servers (for security and troubleshooting). We do not get involved in any form of censorship. We do not give your personal info to any third parties. We do not cooperate with any requests for information unless we are ordered by a court of competent jurisdiction and the vast majority of these requests would not be from a court of competent jurisdiction. We will protect you to the max and our system is setup to automatically do so. There are hundreds of good reasons for being anonymous and we respect them fully.Hacking cracking distribution of viruses fraudulent activities network sa

Uses Microsoft Silverlight

Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Creates a directory in C:\Program Files

Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Directory created: C:\Program Files\FastestVPN	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Directory created: C:\Program Files\FastestVPN\unins000.dat	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Directory created: C:\Program Files\FastestVPN\is-1SSK8.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Directory created: C:\Program Files\FastestVPN\is-V02LD.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Directory created: C:\Program Files\FastestVPN\is-F6R4E.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Directory created: C:\Program Files\FastestVPN\is-HC0TS.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Directory created: C:\Program Files\FastestVPN\is-FCV4A.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Directory created: C:\Program Files\FastestVPN\is-2448N.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Directory created: C:\Program Files\FastestVPN\is-50CK2.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Directory created: C:\Program Files\FastestVPN\is-5L7N2.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Directory created: C:\Program Files\FastestVPN\is-3LDP6.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Directory created: C:\Program Files\FastestVPN\is-59D46.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Directory created: C:\Program Files\FastestVPN\is-CKMSD.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Directory created: C:\Program Files\FastestVPN\is-FRGRO.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Directory created: C:\Program Files\FastestVPN\is-BJ8NM.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Directory created: C:\Program Files\FastestVPN\is-PTLVI.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Directory created: C:\Program Files\FastestVPN\is-9ODK7.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Directory created: C:\Program Files\FastestVPN\is-OKMTN.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Directory created: C:\Program Files\FastestVPN\is-QTCOF.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Directory created: C:\Program Files\FastestVPN\is-446MI.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Directory created: C:\Program Files\FastestVPN\is-GFG66.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Directory created: C:\Program Files\FastestVPN\is-QNEIM.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Directory created: C:\Program Files\FastestVPN\is-TIP8B.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Directory created: C:\Program Files\FastestVPN\is-NSK8U.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Directory created: C:\Program Files\FastestVPN\is-LFVH5.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Directory created: C:\Program Files\FastestVPN\is-98KKE.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Directory created: C:\Program Files\FastestVPN\is-5TM82.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Directory created: C:\Program Files\FastestVPN\is-5IUQF.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Directory created: C:\Program Files\FastestVPN\is-AHK7Q.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Directory created: C:\Program Files\FastestVPN\is-K9S0M.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Directory created: C:\Program Files\FastestVPN\is-GRQCB.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Directory created: C:\Program Files\FastestVPN\is-L8FIT.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Directory created: C:\Program Files\FastestVPN\is-4QKGT.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Directory created: C:\Program Files\FastestVPN\is-UORP7.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Directory created: C:\Program Files\FastestVPN\is-1RGTV.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Directory created: C:\Program Files\FastestVPN\is-O5MTV.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Directory created: C:\Program Files\FastestVPN\is-IPA77.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Directory created: C:\Program Files\FastestVPN\is-1FT3O.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Directory created: C:\Program Files\FastestVPN\is-VTVPL.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Directory created: C:\Program Files\FastestVPN\is-05ABD.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Directory created: C:\Program Files\FastestVPN\is-EQOPF.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Directory created: C:\Program Files\FastestVPN\is-UN9A1.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Directory created: C:\Program Files\FastestVPN\is-5EDG5.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Directory created: C:\Program Files\FastestVPN\is-K82F0.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Directory created: C:\Program Files\FastestVPN\is-4EJAE.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Directory created: C:\Program Files\FastestVPN\is-HNNPS.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Directory created: C:\Program Files\FastestVPN\is-RU768.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Directory created: C:\Program Files\FastestVPN\is-21P0F.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Directory created: C:\Program Files\FastestVPN\is-57IGR.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Directory created: C:\Program Files\FastestVPN\is-DTS4U.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Directory created: C:\Program Files\FastestVPN\Resources	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Directory created: C:\Program Files\FastestVPN\Resources\is-5M6KM.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Directory created: C:\Program Files\FastestVPN\Resources\is-JF6RJ.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Directory created: C:\Program Files\FastestVPN\Resources\is-J9ANF.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Directory created: C:\Program Files\FastestVPN\Resources\is-8UK12.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Directory created: C:\Program Files\FastestVPN\Resources\is-UCO86.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Directory created: C:\Program Files\FastestVPN\Resources\is-O5204.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Directory created: C:\Program Files\FastestVPN\Resources\is-EJ1T1.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Directory created: C:\Program Files\FastestVPN\Resources\is-JCL7T.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Directory created: C:\Program Files\FastestVPN\Resources\is-4H11H.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Directory created: C:\Program Files\FastestVPN\Resources\is-Q7RHP.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Directory created: C:\Program Files\FastestVPN\Resources\is-QN5KA.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Directory created: C:\Program Files\FastestVPN\Resources\is-BERNA.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Directory created: C:\Program Files\FastestVPN\Resources\is-4R4LE.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Directory created: C:\Program Files\FastestVPN\Resources\is-TSTOA.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Directory created: C:\Program Files\FastestVPN\Resources\is-QG142.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Directory created: C:\Program Files\FastestVPN\Resources\is-T7NGU.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Directory created: C:\Program Files\FastestVPN\Resources\is-9HBCL.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Directory created: C:\Program Files\FastestVPN\Resources\is-J49VG.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Directory created: C:\Program Files\FastestVPN\Resources\is-71J6V.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Directory created: C:\Program Files\FastestVPN\Resources\is-BTQQJ.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Directory created: C:\Program Files\FastestVPN\Resources\is-MI83V.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Directory created: C:\Program Files\FastestVPN\Resources\is-9BMN3.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Directory created: C:\Program Files\FastestVPN\Resources\is-FO4BS.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Directory created: C:\Program Files\FastestVPN\Resources\is-7L7U1.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Directory created: C:\Program Files\FastestVPN\Resources\is-4JUC4.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Directory created: C:\Program Files\FastestVPN\Resources\is-SADIQ.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Directory created: C:\Program Files\FastestVPN\Resources\is-OJSLF.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Directory created: C:\Program Files\FastestVPN\Resources\is-R9V8V.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Directory created: C:\Program Files\FastestVPN\Resources\is-K889R.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Directory created: C:\Program Files\FastestVPN\Resources\is-PM9AD.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Directory created: C:\Program Files\FastestVPN\Resources\is-KHPQG.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Directory created: C:\Program Files\FastestVPN\Resources\is-5RDD6.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Directory created: C:\Program Files\FastestVPN\Resources\is-QLSLT.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Directory created: C:\Program Files\FastestVPN\Resources\is-71JPL.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Directory created: C:\Program Files\FastestVPN\Resources\is-1155O.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Directory created: C:\Program Files\FastestVPN\Resources\is-QOP0D.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Directory created: C:\Program Files\FastestVPN\Resources\data	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Directory created: C:\Program Files\FastestVPN\Resources\data\is-HMKT1.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Directory created: C:\Program Files\FastestVPN\Resources\data\is-NI40A.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Directory created: C:\Program Files\FastestVPN\Resources\data\is-GM9LU.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Directory created: C:\Program Files\FastestVPN\Resources\data\is-CUGSD.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Directory created: C:\Program Files\FastestVPN\Resources\driver	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Directory created: C:\Program Files\FastestVPN\Resources\driver\is-SAIVV.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Directory created: C:\Program Files\FastestVPN\Resources\driver\is-90S23.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Directory created: C:\Program Files\FastestVPN\Resources\driver\windows	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Directory created: C:\Program Files\FastestVPN\Resources\driver\windows\amd64	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Directory created: C:\Program Files\FastestVPN\Resources\driver\windows\amd64\is-QA9TR.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Directory created: C:\Program Files\FastestVPN\Resources\driver\windows\amd64\is-FKPUT.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Directory created: C:\Program Files\FastestVPN\Resources\driver\windows\amd64\is-PG7JG.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Directory created: C:\Program Files\FastestVPN\Resources\driver\windows\amd64\is-7J76O.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Directory created: C:\Program Files\FastestVPN\Resources\driver\windows\amd64\is-9NM46.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Directory created: C:\Program Files\FastestVPN\Resources\driver\windows\amd64\is-0UT9M.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Directory created: C:\Program Files\FastestVPN\Resources\driver\windows\i386	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Directory created: C:\Program Files\FastestVPN\Resources\driver\windows\i386\is-6HO0C.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Directory created: C:\Program Files\FastestVPN\Resources\driver\windows\i386\is-VSNQ2.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Directory created: C:\Program Files\FastestVPN\Resources\driver\windows\i386\is-O423O.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Directory created: C:\Program Files\FastestVPN\Resources\driver\windows\i386\is-PBM2F.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Directory created: C:\Program Files\FastestVPN\Resources\driver\windows\i386\is-QN43A.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Directory created: C:\Program Files\FastestVPN\Resources\driver\windows\i386\is-EQ5BP.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Directory created: C:\Program Files\FastestVPN\Resources\driver\windows10	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Directory created: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Directory created: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\is-P6RB9.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Directory created: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\is-3MVJ1.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Directory created: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\is-DDCD3.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Directory created: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\is-6LAFJ.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Directory created: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\is-ISUTF.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Directory created: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\is-9C393.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Directory created: C:\Program Files\FastestVPN\Resources\driver\windows10\i386	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Directory created: C:\Program Files\FastestVPN\Resources\driver\windows10\i386\is-0IO2E.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Directory created: C:\Program Files\FastestVPN\Resources\driver\windows10\i386\is-922TB.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Directory created: C:\Program Files\FastestVPN\Resources\driver\windows10\i386\is-SPFH5.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Directory created: C:\Program Files\FastestVPN\Resources\driver\windows10\i386\is-5P6ME.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Directory created: C:\Program Files\FastestVPN\Resources\driver\windows10\i386\is-GNQS3.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Directory created: C:\Program Files\FastestVPN\Resources\driver\windows10\i386\is-T49GN.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Directory created: C:\Program Files\FastestVPN\Resources\sp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Directory created: C:\Program Files\FastestVPN\Resources\sp\is-D3BH1.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Directory created: C:\Program Files\FastestVPN\Resources\sp\is-T3PGP.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Directory created: C:\Program Files\FastestVPN\Resources\sp\driver	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Directory created: C:\Program Files\FastestVPN\Resources\sp\driver\windows7	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Directory created: C:\Program Files\FastestVPN\Resources\sp\driver\windows7\amd64	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Directory created: C:\Program Files\FastestVPN\Resources\sp\driver\windows7\amd64\is-K5R6R.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Directory created: C:\Program Files\FastestVPN\Resources\sp\driver\windows7\i386	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Directory created: C:\Program Files\FastestVPN\Resources\sp\driver\windows7\i386\is-HEM9F.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Directory created: C:\Program Files\FastestVPN\Resources\sp\driver\windows8	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Directory created: C:\Program Files\FastestVPN\Resources\sp\driver\windows8\amd64	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Directory created: C:\Program Files\FastestVPN\Resources\sp\driver\windows8\amd64\is-0G2RR.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Directory created: C:\Program Files\FastestVPN\Resources\sp\driver\windows8\i386	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Directory created: C:\Program Files\FastestVPN\Resources\sp\driver\windows8\i386\is-PE3HT.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Directory created: C:\Program Files\FastestVPN\Resources\sp\release	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Directory created: C:\Program Files\FastestVPN\Resources\sp\release\is-QPO3E.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Directory created: C:\Program Files\FastestVPN\Resources\sp\release\is-1ASBC.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Directory created: C:\Program Files\FastestVPN\Service	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Directory created: C:\Program Files\FastestVPN\Service\is-IBD4C.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Directory created: C:\Program Files\FastestVPN\Service\is-PTINH.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Directory created: C:\Program Files\FastestVPN\Service\is-84F6J.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Directory created: C:\Program Files\FastestVPN\Service\is-SQ7U6.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Directory created: C:\Program Files\FastestVPN\Service\is-2RVHB.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Directory created: C:\Program Files\FastestVPN\Service\is-7I93E.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Directory created: C:\Program Files\FastestVPN\Service\is-902P3.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Directory created: C:\Program Files\FastestVPN\Service\is-QVSDK.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Directory created: C:\Program Files\FastestVPN\Service\is-GL2TH.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Directory created: C:\Program Files\FastestVPN\Service\is-AVARB.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Directory created: C:\Program Files\FastestVPN\Service\is-E9VNL.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Directory created: C:\Program Files\FastestVPN\Service\is-63I9E.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Directory created: C:\Program Files\FastestVPN\Service\is-J59NL.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Directory created: C:\Program Files\FastestVPN\Service\is-6KC91.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Directory created: C:\Program Files\FastestVPN\Service\is-UI3J1.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Directory created: C:\Program Files\FastestVPN\Service\is-OTL5D.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Directory created: C:\Program Files\FastestVPN\Service\is-BI62G.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Directory created: C:\Program Files\FastestVPN\Service\is-17VQ7.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Directory created: C:\Program Files\FastestVPN\Service\is-NF2G1.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Directory created: C:\Program Files\FastestVPN\Service\is-CS1P9.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Directory created: C:\Program Files\FastestVPN\Service\is-9GVKQ.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Directory created: C:\Program Files\FastestVPN\Service\is-JJ40M.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Directory created: C:\Program Files\FastestVPN\Service\is-17D7A.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Directory created: C:\Program Files\FastestVPN\is-0G40P.tmp	Jump to behavior
Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe	Directory created: C:\Program Files\FastestVPN\Service\InstallUtil.InstallLog
Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe	Directory created: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.InstallLog
Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe	Directory created: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.InstallState

Creates a software uninstall entry

Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp

Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\FastestVPN_is1

Jump to behavior

PE / OLE file has a valid certificate

Source: PVUfopbGfc.exe

Static PE information: certificate valid

Submission file is bigger than most known malware samples

Source: PVUfopbGfc.exe

Static file information: File size 21250384 > 1048576

Contains modern PE file flags such as dynamic base (ASLR) or NX

Source: PVUfopbGfc.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Binary contains paths to debug symbols

Source:	Binary string: System.Configuration.Install.pdb source: FastestVPN.WindowsService.exe, 0000001D.00000002.2583865767.0000000003286000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: D:\a\SQLitePCL.raw\SQLitePCL.raw\SQLitePCL.raw\src\SQLitePCLRaw.core\obj\Release\netstandard2.0\SQLitePCLRaw.core.pdb source: FastestVPN.exe, FastestVPN.exe, 00000022.00000002.3351200547.000000000BE32000.00000002.00000001.01000000.0000002E.sdmp
Source:	Binary string: C:\Users\samuli\source\repos\tap-windows6\devcon\x64\Release\devcon.pdb source: tapinstall.exe, 0000000A.00000000.2343669290.00007FF70AA34000.00000002.00000001.01000000.00000008.sdmp, tapinstall.exe, 0000000A.00000002.2345236578.00007FF70AA34000.00000002.00000001.01000000.00000008.sdmp, tapinstall.exe, 0000000B.00000000.2345491583.00007FF70AA34000.00000002.00000001.01000000.00000008.sdmp, tapinstall.exe, 0000000B.00000002.2394906784.00007FF70AA34000.00000002.00000001.01000000.00000008.sdmp
Source:	Binary string: C:\BuildAgent\work\da2c3d9512902c54\Tooling\obj\Release\System.Web.Cors\System.Web.Cors.pdb source: FastestVPN.WindowsService.exe, FastestVPN.WindowsService.exe, 0000002F.00000002.3310997564.0000000004682000.00000002.00000001.01000000.0000004C.sdmp
Source:	Binary string: D:\Sagar Work FastestVPN\FastestVPN-Windows-App\FastestVPN.WindowsService\obj\Release\FastestVPN.WindowsService.pdbe\FastestVPN.WindowsServic source: FastestVPN.WindowsService.exe, 0000001D.00000002.2581965322.0000000000FB9000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: D:\VPN core\FastestVPN-Windows-Core\VPN\obj\Debug\VPN.pdbB3\3 N3_CorDllMainmscoree.dll source: FastestVPN.WindowsService.exe, 0000002F.00000002.3312674428.0000000004752000.00000002.00000001.01000000.0000004E.sdmp
Source:	Binary string: D:\VPN core\FastestVPN-Windows-Core\VPN.Common\obj\Debug\VPN.Common.pdb source: PVUfopbGfc.tmp, 00000001.00000002.2700520104.000000000018C000.00000004.00000010.00020000.00000000.sdmp, PVUfopbGfc.tmp, 00000001.00000003.2675219520.00000000054B0000.00000004.00001000.00020000.00000000.sdmp, FastestVPN.WindowsService.exe, FastestVPN.WindowsService.exe, 0000001D.00000002.2584576821.0000000005782000.00000002.00000001.01000000.0000000F.sdmp
Source:	Binary string: D:\a\SQLitePCL.raw\SQLitePCL.raw\SQLitePCL.raw\src\SQLitePCLRaw.provider.dynamic_cdecl\obj\Release\netstandard2.0\SQLitePCLRaw.provider.dynamic_cdecl.pdb source: FastestVPN.exe, FastestVPN.exe, 00000022.00000002.3352299163.000000000C172000.00000002.00000001.01000000.0000002F.sdmp
Source:	Binary string: /_/artifacts/obj/Microsoft.AspNet.SignalR.Core/Release/net45/Microsoft.AspNet.SignalR.Core.pdbSHA256Z source: FastestVPN.WindowsService.exe, 0000001D.00000002.2584816506.0000000005A92000.00000002.00000001.01000000.0000000E.sdmp, FastestVPN.WindowsService.exe, 0000002F.00000002.3298560141.000000000116F000.00000004.00000020.00020000.00000000.sdmp, FastestVPN.WindowsService.exe, 0000002F.00000002.3304056218.0000000001BCC000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdb source: netsh.exe, 00000032.00000002.2825529110.0000000004E80000.00000004.00000020.00020000.00000000.sdmp, netsh.exe, 00000032.00000002.2825762645.0000000005320000.00000004.00001000.00020000.00000000.sdmp, Launcher.exe, 00000035.00000002.2857233034.00000000023C9000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000035.00000002.2857620610.0000000002860000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: Microsoft.Owin.Cors.pdbSHA256 source: FastestVPN.WindowsService.exe, 0000002F.00000002.3310437304.0000000004662000.00000002.00000001.01000000.00000046.sdmp
Source:	Binary string: E:\nt\dnsrv\sdktools\reskit\content\subinacl\source\obj\i386\subinacl.pdb source: PVUfopbGfc.tmp, 00000001.00000003.2675219520.00000000054B0000.00000004.00001000.00020000.00000000.sdmp, subinacl.exe, subinacl.exe, 0000002B.00000000.2611161261.0000000001001000.00000020.00000001.01000000.00000034.sdmp, subinacl.exe, 0000002B.00000002.2618280142.0000000001001000.00000020.00000001.01000000.00000034.sdmp, is-O5MTV.tmp.1.dr, is-OTL5D.tmp.1.dr
Source:	Binary string: ?&nC:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.pdb# source: FastestVPN.WindowsService.exe, 0000001D.00000002.2581965322.0000000000FB9000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: Microsoft.Owin.Cors.pdb source: FastestVPN.WindowsService.exe, FastestVPN.WindowsService.exe, 0000002F.00000002.3310437304.0000000004662000.00000002.00000001.01000000.00000046.sdmp
Source:	Binary string: winmm.pdbUGP source: netsh.exe, 00000032.00000002.2825340131.00000000047B0000.00000004.00001000.00020000.00000000.sdmp, Launcher.exe, 00000035.00000002.2856862183.00000000007E7000.00000008.00000001.01000000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\symbols\dll\System.Configuration.Install.pdb source: FastestVPN.WindowsService.exe, 0000001D.00000002.2582155531.00000000012F2000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\Sagar Work FastestVPN\FastestVPN-Windows-App\FastestVPN.Common\obj\Release\FastestVPN.Common.pdb source: FastestVPN.WindowsService.exe, FastestVPN.WindowsService.exe, 0000002F.00000002.3307845165.0000000004522000.00000002.00000001.01000000.00000035.sdmp
Source:	Binary string: Microsoft.Owin.Diagnostics.pdbSHA256 source: FastestVPN.WindowsService.exe, 0000002F.00000002.3311828504.0000000004712000.00000002.00000001.01000000.00000049.sdmp
Source:	Binary string: D:\VPN core\FastestVPN-Windows-Core\VPN\obj\Debug\VPN.pdb source: FastestVPN.WindowsService.exe, FastestVPN.WindowsService.exe, 0000002F.00000002.3312674428.0000000004752000.00000002.00000001.01000000.0000004E.sdmp
Source:	Binary string: C:\Windows\Microsoft.NET\Framework\v4.0.30319\spNet.SignalR.Core.pdb561934e089\System.dllLISTj! source: FastestVPN.WindowsService.exe, 0000002F.00000002.3298560141.000000000112D000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: /_/artifacts/obj/Microsoft.AspNet.SignalR.Core/Release/net45/Microsoft.AspNet.SignalR.Core.pdb source: FastestVPN.WindowsService.exe, 0000002F.00000002.3298560141.000000000116F000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\samuli\source\repos\tap-windows6\src\Release\tap0901.pdb source: is-PBM2F.tmp.1.dr
Source:	Binary string: c:\Users\Junaid AK\Desktop\New folder (2)\SingleInstanceApplication\SingleInstanceApplication\obj\Release\SingleInstanceApplication.pdb source: FastestVPN.exe, 00000034.00000002.2693645936.00000000026F2000.00000002.00000001.01000000.00000012.sdmp
Source:	Binary string: C:\Users\Jason A. Donenfeld\Projects\wireguard-nt\Release\amd64\wireguard.pdb source: PVUfopbGfc.tmp, 00000001.00000003.2675219520.00000000054B0000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: Windows\dll\mscorlib.pdbex0 source: FastestVPN.exe, 00000022.00000002.3344745212.000000000B5B6000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: Microsoft.Owin.Hosting.pdbSHA256d"M! source: FastestVPN.WindowsService.exe, 0000002F.00000002.3308225688.0000000004542000.00000002.00000001.01000000.00000037.sdmp
Source:	Binary string: D:\a\SQLitePCL.raw\SQLitePCL.raw\SQLitePCL.raw\src\SQLitePCLRaw.provider.dynamic_cdecl\obj\Release\netstandard2.0\SQLitePCLRaw.provider.dynamic_cdecl.pdbSHA256 source: FastestVPN.exe, 00000022.00000002.3352299163.000000000C172000.00000002.00000001.01000000.0000002F.sdmp
Source:	Binary string: D:\VPN core\FastestVPN-Windows-Core\VPN.OpenVpn\obj\Debug\VPN.OpenVpn.pdbRhlh ^h_CorDllMainmscoree.dll source: FastestVPN.WindowsService.exe, 0000002F.00000002.3312869455.0000000004762000.00000002.00000001.01000000.0000004F.sdmp
Source:	Binary string: D:\a\1\s\SDK\AppCenterAnalytics\Microsoft.AppCenter.Analytics.WindowsDesktop\obj\Microsoft.AppCenter.Analytics.WindowsDesktop\Release\net472\Microsoft.AppCenter.Analytics.pdb source: FastestVPN.exe, FastestVPN.exe, 00000022.00000002.3330206330.0000000006392000.00000002.00000001.01000000.0000002B.sdmp
Source:	Binary string: /_/artifacts/obj/Microsoft.AspNet.SignalR.Core/Release/net45/Microsoft.AspNet.SignalR.Core.pdb source: FastestVPN.WindowsService.exe, FastestVPN.WindowsService.exe, 0000001D.00000002.2584816506.0000000005A92000.00000002.00000001.01000000.0000000E.sdmp, FastestVPN.WindowsService.exe, 0000002F.00000002.3298560141.000000000116F000.00000004.00000020.00020000.00000000.sdmp, FastestVPN.WindowsService.exe, 0000002F.00000002.3304056218.0000000001BCC000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\symbols\exe\FastestVPN.WindowsService.pdb source: FastestVPN.WindowsService.exe, 0000001D.00000002.2582155531.00000000012F2000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: c:\projects\projectsJ\nfsdk2_1.6\bin\release\win32\nfapi.pdb< source: nfregdrv.exe, 00000019.00000002.2407457416.0000000010019000.00000002.00000001.01000000.0000000A.sdmp, nfregdrv.exe, 0000001A.00000002.2409400563.0000000010019000.00000002.00000001.01000000.0000000A.sdmp
Source:	Binary string: Hardcodet.NotifyIcon.Wpf.pdbSHA256[ source: FastestVPN.exe, 00000022.00000002.3327281264.00000000060A2000.00000002.00000001.01000000.0000001F.sdmp
Source:	Binary string: D:\a\1\s\SDK\AppCenterCrashes\Microsoft.AppCenter.Crashes.WindowsDesktop\obj\Microsoft.AppCenter.Crashes.WindowsDesktop\Release\net472\Microsoft.AppCenter.Crashes.pdbSHA256 source: FastestVPN.exe, 00000022.00000002.3330335816.00000000063A2000.00000002.00000001.01000000.0000002C.sdmp
Source:	Binary string: h:\projects\netfilter3\bin\Release\Win32\nfregdrv.pdb )0THi source: nfregdrv.exe, 00000019.00000002.2406977537.0000000000408000.00000002.00000001.01000000.00000009.sdmp, nfregdrv.exe, 00000019.00000000.2405650366.0000000000408000.00000002.00000001.01000000.00000009.sdmp, nfregdrv.exe, 0000001A.00000002.2408828115.0000000000408000.00000002.00000001.01000000.00000009.sdmp, nfregdrv.exe, 0000001A.00000000.2407706394.0000000000408000.00000002.00000001.01000000.00000009.sdmp, is-1ASBC.tmp.1.dr
Source:	Binary string: D:\a\SQLitePCL.raw\SQLitePCL.raw\SQLitePCL.raw\src\SQLitePCLRaw.bundle_green\obj\Release\net461\SQLitePCLRaw.batteries_v2.pdbSHA256x source: FastestVPN.exe, 00000022.00000002.3298315092.000000000108F000.00000004.00000020.00020000.00000000.sdmp, FastestVPN.exe, 00000022.00000002.3349122671.000000000BC52000.00000002.00000001.01000000.0000002D.sdmp
Source:	Binary string: \??\C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.pdbtral source: FastestVPN.WindowsService.exe, 0000001D.00000002.2582155531.00000000012F2000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: mscorlib.pdbmDataDriverData=C:\Windows\System32\Drivers\DriverDataOS=Windows_NTPATHEXT=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSCPROCESSOR_ARCHITECTURE=AMD64ProgramData=C:\ProgramDataPUBLIC=C:\Users\PublicSystemDrive=C:SystemRoot=C:\Windows~ source: FastestVPN.exe, 00000022.00000002.3341691329.000000000B474000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\b\s\w\ir\cache\builder\src\out\host_release\flutter_windows.dll.pdb source: ComDebug.exe, 00000030.00000002.2672367606.00007FF8A80B8000.00000002.00000001.01000000.00000048.sdmp
Source:	Binary string: C:\projects\projectsJ\nfsdk2_1.6\driver_wfp\Win8\Win8Release\x64\netfilter2.pdb source: xcopy.exe, 00000018.00000003.2403159655.00000297A19EA000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdbUGP source: netsh.exe, 00000032.00000002.2825529110.0000000004E80000.00000004.00000020.00020000.00000000.sdmp, netsh.exe, 00000032.00000002.2825762645.0000000005320000.00000004.00001000.00020000.00000000.sdmp, Launcher.exe, 00000035.00000002.2857233034.00000000023C9000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000035.00000002.2857620610.0000000002860000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: h:\projects\netfilter3\bin\Release\Win32\nfregdrv.pdb source: nfregdrv.exe, 00000019.00000002.2406977537.0000000000408000.00000002.00000001.01000000.00000009.sdmp, nfregdrv.exe, 00000019.00000000.2405650366.0000000000408000.00000002.00000001.01000000.00000009.sdmp, nfregdrv.exe, 0000001A.00000002.2408828115.0000000000408000.00000002.00000001.01000000.00000009.sdmp, nfregdrv.exe, 0000001A.00000000.2407706394.0000000000408000.00000002.00000001.01000000.00000009.sdmp, is-1ASBC.tmp.1.dr
Source:	Binary string: ntdll.pdbUGP source: ComDebug.exe, 00000030.00000002.2670309064.0000025FA46F0000.00000004.00000001.00020000.00000000.sdmp, ComDebug.exe, 00000030.00000002.2669964695.0000025FA44F0000.00000004.00000800.00020000.00000000.sdmp, ComDebug.exe, 00000030.00000002.2669735713.0000025FA40F3000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: $]qEC:\Program Files\FastestVPN\Service\Microsoft.AspNet.SignalR.Core.pdb source: FastestVPN.WindowsService.exe, 0000002F.00000002.3304056218.0000000001BCC000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: winmm.pdb source: netsh.exe, 00000032.00000002.2825340131.00000000047B0000.00000004.00001000.00020000.00000000.sdmp, Launcher.exe, 00000035.00000002.2856862183.00000000007E7000.00000008.00000001.01000000.00000000.sdmp
Source:	Binary string: agar Work FastestVPN\FastestVPN-Windows-App\FastestVPN.WindowsService\obj\Release\FastestVPN.WindowsService.pdb source: FastestVPN.WindowsService.exe, 0000001D.00000002.2582155531.00000000012F2000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: $]q!Microsoft.AspNet.SignalR.Core.pdb`,]q)"<>\| source: FastestVPN.WindowsService.exe, 0000002F.00000002.3304056218.0000000001BCC000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: D:\VPN core\FastestVPN-Windows-Core\VPN.Common\obj\Debug\VPN.Common.pdbH source: PVUfopbGfc.tmp, 00000001.00000002.2700520104.000000000018C000.00000004.00000010.00020000.00000000.sdmp, PVUfopbGfc.tmp, 00000001.00000003.2675219520.00000000054B0000.00000004.00001000.00020000.00000000.sdmp, FastestVPN.WindowsService.exe, 0000001D.00000002.2584576821.0000000005782000.00000002.00000001.01000000.0000000F.sdmp
Source:	Binary string: D:\VPN core\FastestVPN-Windows-Core\VPN.WireGuard\obj\Debug\VPN.WireGuard.pdb source: FastestVPN.WindowsService.exe, FastestVPN.WindowsService.exe, 0000002F.00000002.3314037370.00000000047B2000.00000002.00000001.01000000.00000051.sdmp
Source:	Binary string: D:\Sagar Work FastestVPN\FastestVPN-Windows-App\FastestVPN.Data.Local\obj\Release\FastestVPN.Data.Local.pdb source: FastestVPN.exe, FastestVPN.exe, 00000022.00000002.3325295176.0000000005DD2000.00000002.00000001.01000000.0000001D.sdmp
Source:	Binary string: /_/artifacts/obj/Microsoft.Extensions.DependencyInjection.Abstractions/Release/net462/Microsoft.Extensions.DependencyInjection.Abstractions.pdbSHA256 source: FastestVPN.exe, 00000022.00000002.3323696936.0000000005952000.00000002.00000001.01000000.00000015.sdmp
Source:	Binary string: D:\Sagar Work FastestVPN\FastestVPN-Windows-App\FastestVPN.WindowsService\obj\Release\FastestVPN.WindowsService.pdb source: FastestVPN.WindowsService.exe, 0000001D.00000002.2581965322.0000000000FB9000.00000004.00000010.00020000.00000000.sdmp, FastestVPN.WindowsService.exe, 0000001D.00000000.2412885741.0000000000E22000.00000002.00000001.01000000.0000000B.sdmp, FastestVPN.WindowsService.exe, 0000001D.00000002.2583865767.0000000003286000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: E:\A\_work\89\s\corefx\bin\obj\AnyOS.AnyCPU.Release\System.Memory\netstandard\System.Memory.pdbSHA256HXhZm source: FastestVPN.exe, 00000022.00000002.3352911178.000000000C1E2000.00000002.00000001.01000000.00000030.sdmp
Source:	Binary string: Microsoft.Owin.pdbSHA256 source: FastestVPN.WindowsService.exe, 0000002F.00000002.3309349757.0000000004592000.00000002.00000001.01000000.00000038.sdmp
Source:	Binary string: /home/runner/work/Flurl/Flurl/src/Flurl/obj/Release/net472/Flurl.pdb source: FastestVPN.exe, FastestVPN.exe, 00000022.00000002.3351506959.000000000BE72000.00000002.00000001.01000000.00000032.sdmp
Source:	Binary string: /home/runner/work/Flurl/Flurl/src/Flurl/obj/Release/net472/Flurl.pdbSHA256!VN source: FastestVPN.exe, 00000022.00000002.3351506959.000000000BE72000.00000002.00000001.01000000.00000032.sdmp
Source:	Binary string: mscorlib.pdb source: FastestVPN.exe, 00000022.00000002.3298315092.000000000108F000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\VPN core\FastestVPN-Windows-Core\VPN.RAS\obj\Debug\VPN.RAS.pdb source: PVUfopbGfc.tmp, 00000001.00000002.2700520104.000000000018C000.00000004.00000010.00020000.00000000.sdmp, PVUfopbGfc.tmp, 00000001.00000003.2675219520.00000000054B0000.00000004.00001000.00020000.00000000.sdmp, FastestVPN.WindowsService.exe, FastestVPN.WindowsService.exe, 0000002F.00000002.3313739781.00000000047A2000.00000002.00000001.01000000.00000050.sdmp, is-21P0F.tmp.1.dr
Source:	Binary string: /_/artifacts/obj/Microsoft.Extensions.DependencyInjection.Abstractions/Release/net462/Microsoft.Extensions.DependencyInjection.Abstractions.pdb source: FastestVPN.exe, FastestVPN.exe, 00000022.00000002.3323696936.0000000005952000.00000002.00000001.01000000.00000015.sdmp
Source:	Binary string: C:\Windows\FastestVPN.WindowsService.pdbpdbice.pdb </ source: FastestVPN.WindowsService.exe, 0000001D.00000002.2582155531.00000000012F2000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\projects\wpfanimatedgif\WpfAnimatedGif\obj\Release\net40\WpfAnimatedGif.pdbSHA256 source: FastestVPN.exe, 00000022.00000002.3329548380.0000000006312000.00000002.00000001.01000000.00000020.sdmp
Source:	Binary string: D:\a\1\s\SDK\AppCenter\Microsoft.AppCenter.WindowsDesktop\obj\Microsoft.AppCenter.WindowsDesktop\Release\net472\Microsoft.AppCenter.pdb source: FastestVPN.exe, FastestVPN.exe, 00000022.00000002.3330868755.00000000065B2000.00000002.00000001.01000000.0000002A.sdmp
Source:	Binary string: D:\Sagar Work FastestVPN\FastestVPN-Windows-App\FastestVPN.ViewModel\obj\Release\FastestVPN.ViewModel.pdb source: FastestVPN.exe, FastestVPN.exe, 00000022.00000002.3324911285.0000000005D72000.00000002.00000001.01000000.0000001A.sdmp
Source:	Binary string: Microsoft.Owin.Host.HttpListener.pdbSHA256-( source: FastestVPN.WindowsService.exe, 0000002F.00000002.3309864180.00000000045C2000.00000002.00000001.01000000.0000003A.sdmp
Source:	Binary string: D:\repos\main\SSH2\Release\pdbs\BvUpdateLauncher.pdb source: ComDebug.exe, 00000030.00000002.2669578005.0000025FA4009000.00000004.00000020.00020000.00000000.sdmp, netsh.exe, 00000032.00000002.2825661828.0000000005235000.00000004.00000800.00020000.00000000.sdmp, Launcher.exe, 00000035.00000002.2856630470.00000000003A9000.00000002.00000001.01000000.00000057.sdmp, Launcher.exe, 00000035.00000000.2781267206.00000000003A8000.00000002.00000001.01000000.00000057.sdmp, Launcher.exe, 00000035.00000002.2857488192.0000000002774000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: Microsoft.Owin.Security.pdbSHA256U source: FastestVPN.WindowsService.exe, 0000002F.00000002.3311384386.0000000004692000.00000002.00000001.01000000.0000004A.sdmp, is-63I9E.tmp.1.dr
Source:	Binary string: System.pdbN\|2h\|2 Z\|2_CorDllMainmscoree.dll source: FastestVPN.WindowsService.exe, 0000002F.00000002.3298560141.000000000116F000.00000004.00000020.00020000.00000000.sdmp, FastestVPN.WindowsService.exe, 0000002F.00000002.3304056218.0000000001BCC000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: D:\nt-driver-builder\wireguard-nt-0.10\Release\arm64\driver\wireguard.pdb source: PVUfopbGfc.tmp, 00000001.00000003.2675219520.00000000054B0000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: D:\Sagar Work FastestVPN\FastestVPN-Windows-App\FastestVPN.Data.Remote\obj\Release\FastestVPN.Data.Remote.pdb source: FastestVPN.exe, FastestVPN.exe, 00000022.00000002.3325390125.0000000005DE2000.00000002.00000001.01000000.0000001E.sdmp
Source:	Binary string: D:\Sagar Work FastestVPN\FastestVPN-Windows-App\FastestVPN.BLL\obj\Release\FastestVPN.BLL.pdbVepe be_CorDllMainmscoree.dll source: FastestVPN.exe, 00000022.00000002.3325176110.0000000005DC2000.00000002.00000001.01000000.0000001C.sdmp
Source:	Binary string: symbols\exe\FastestVPN.WindowsService.pdb source: FastestVPN.WindowsService.exe, 0000001D.00000002.2581965322.0000000000FB9000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: /_/src/Flurl.Http/obj/Release/net472/Flurl.Http.pdbSHA256 source: FastestVPN.exe, 00000022.00000002.3351847731.000000000BE92000.00000002.00000001.01000000.00000033.sdmp
Source:	Binary string: D:\VPN core\FastestVPN-Windows-Core\VPN.OpenVpn\obj\Debug\VPN.OpenVpn.pdb source: FastestVPN.WindowsService.exe, FastestVPN.WindowsService.exe, 0000002F.00000002.3312869455.0000000004762000.00000002.00000001.01000000.0000004F.sdmp
Source:	Binary string: /_/artifacts/obj/Microsoft.Bcl.AsyncInterfaces/Release/net462/Microsoft.Bcl.AsyncInterfaces.pdbSHA256 source: FastestVPN.exe, 00000022.00000002.3324194724.0000000005D02000.00000002.00000001.01000000.00000016.sdmp
Source:	Binary string: BouncyCastle.Crypto.pdbSHA256 source: FastestVPN.exe, 00000022.00000002.3354869052.000000000DFF2000.00000002.00000001.01000000.00000036.sdmp
Source:	Binary string: Microsoft.Owin.Diagnostics.pdb source: FastestVPN.WindowsService.exe, FastestVPN.WindowsService.exe, 0000002F.00000002.3311828504.0000000004712000.00000002.00000001.01000000.00000049.sdmp
Source:	Binary string: D:\nt-driver-builder\wireguard-nt-0.10\Release\arm64\driver\wireguard.pdbGCTL source: PVUfopbGfc.tmp, 00000001.00000003.2675219520.00000000054B0000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: System.ServiceProcess.pdb source: FastestVPN.WindowsService.exe, 0000001D.00000002.2583865767.0000000003286000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\FastestVPN.WindowsService.pdbL source: FastestVPN.WindowsService.exe, 0000001D.00000002.2582155531.00000000012F2000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: /_/artifacts/obj/Microsoft.Extensions.DependencyInjection/Release/net462/Microsoft.Extensions.DependencyInjection.pdbSHA256 source: FastestVPN.exe, 00000022.00000002.3324336785.0000000005D12000.00000002.00000001.01000000.00000017.sdmp
Source:	Binary string: System.Configuration.Install.pdbxF source: FastestVPN.WindowsService.exe, 0000001D.00000002.2583865767.0000000003286000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: D:\VPN core\FastestVPN-Windows-Core\VPN.WireGuard\obj\Debug\VPN.WireGuard.pdb2;L; >;_CorDllMainmscoree.dll source: FastestVPN.WindowsService.exe, 0000002F.00000002.3314037370.00000000047B2000.00000002.00000001.01000000.00000051.sdmp
Source:	Binary string: E:\nt\dnsrv\sdktools\reskit\content\subinacl\source\obj\i386\subinacl.pdbPa source: PVUfopbGfc.tmp, 00000001.00000003.2675219520.00000000054B0000.00000004.00001000.00020000.00000000.sdmp, subinacl.exe, 0000002B.00000000.2611161261.0000000001001000.00000020.00000001.01000000.00000034.sdmp, subinacl.exe, 0000002B.00000002.2618280142.0000000001001000.00000020.00000001.01000000.00000034.sdmp, is-O5MTV.tmp.1.dr, is-OTL5D.tmp.1.dr
Source:	Binary string: C:\projects\projectsJ\nfsdk2_1.6\driver_wfp\Win8\Win8Release\x64\netfilter2.pdb source: xcopy.exe, 00000018.00000003.2403159655.00000297A19EA000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a\1\s\SDK\AppCenterAnalytics\Microsoft.AppCenter.Analytics.WindowsDesktop\obj\Microsoft.AppCenter.Analytics.WindowsDesktop\Release\net472\Microsoft.AppCenter.Analytics.pdbSHA256 source: FastestVPN.exe, 00000022.00000002.3330206330.0000000006392000.00000002.00000001.01000000.0000002B.sdmp
Source:	Binary string: E:\A\_work\156\s\corefx\bin\obj\AnyOS.AnyCPU.Release\System.Threading.Tasks.Extensions\netfx\System.Threading.Tasks.Extensions.pdb source: FastestVPN.exe, FastestVPN.exe, 00000022.00000002.3324622795.0000000005D32000.00000002.00000001.01000000.00000018.sdmp
Source:	Binary string: D:\Sagar Work FastestVPN\FastestVPN-Windows-App\FastestVPN.Diagnostics\obj\Release\FastestVPN.Diagnostics.pdb source: FastestVPN.exe, FastestVPN.exe, 00000022.00000002.3324712420.0000000005D42000.00000002.00000001.01000000.00000019.sdmp
Source:	Binary string: C:\Users\Jason A. Donenfeld\Projects\wireguard-nt\Release\arm64\setupapihost.pdb source: PVUfopbGfc.tmp, 00000001.00000003.2675219520.00000000054B0000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: c:\projects\projectsJ\nfsdk2_1.6\bin\release\win32\nfapi.pdb source: nfregdrv.exe, 00000019.00000002.2407457416.0000000010019000.00000002.00000001.01000000.0000000A.sdmp, nfregdrv.exe, 0000001A.00000002.2409400563.0000000010019000.00000002.00000001.01000000.0000000A.sdmp
Source:	Binary string: /_/artifacts/obj/Microsoft.Bcl.AsyncInterfaces/Release/net462/Microsoft.Bcl.AsyncInterfaces.pdb source: FastestVPN.exe, FastestVPN.exe, 00000022.00000002.3324194724.0000000005D02000.00000002.00000001.01000000.00000016.sdmp
Source:	Binary string: c:\Users\lodejard\Projects\owin-hosting\src\main\Owin.Startup\obj\Release\Owin.pdb source: FastestVPN.WindowsService.exe, FastestVPN.WindowsService.exe, 0000002F.00000002.3307242028.0000000004242000.00000002.00000001.01000000.00000039.sdmp
Source:	Binary string: Microsoft.Owin.Hosting.pdb source: FastestVPN.WindowsService.exe, FastestVPN.WindowsService.exe, 0000002F.00000002.3308225688.0000000004542000.00000002.00000001.01000000.00000037.sdmp
Source:	Binary string: D:\Sagar Work FastestVPN\FastestVPN-Windows-App\FastestVPN.DependencyInjection\obj\Release\FastestVPN.DI.pdb source: FastestVPN.exe, FastestVPN.exe, 00000022.00000002.3323485610.0000000005842000.00000002.00000001.01000000.00000014.sdmp
Source:	Binary string: D:\a\1\s\SDK\AppCenterCrashes\Microsoft.AppCenter.Crashes.WindowsDesktop\obj\Microsoft.AppCenter.Crashes.WindowsDesktop\Release\net472\Microsoft.AppCenter.Crashes.pdb source: FastestVPN.exe, FastestVPN.exe, 00000022.00000002.3330335816.00000000063A2000.00000002.00000001.01000000.0000002C.sdmp
Source:	Binary string: nTC:\Windows\FastestVPN.WindowsService.pdb source: FastestVPN.WindowsService.exe, 0000001D.00000002.2581965322.0000000000FB9000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: /_/artifacts/obj/Microsoft.Extensions.DependencyInjection/Release/net462/Microsoft.Extensions.DependencyInjection.pdb source: FastestVPN.exe, FastestVPN.exe, 00000022.00000002.3324336785.0000000005D12000.00000002.00000001.01000000.00000017.sdmp
Source:	Binary string: @&n.pdb source: FastestVPN.WindowsService.exe, 0000001D.00000002.2581965322.0000000000FB9000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: c:\Users\Junaid AK\Desktop\New folder (2)\SingleInstanceApplication\SingleInstanceApplication\obj\Release\SingleInstanceApplication.pdb@:^: P:_CorDllMainmscoree.dll source: FastestVPN.exe, 00000034.00000002.2693645936.00000000026F2000.00000002.00000001.01000000.00000012.sdmp
Source:	Binary string: /_/Src/Newtonsoft.Json/obj/Release/net45/Newtonsoft.Json.pdbSHA256 source: PVUfopbGfc.tmp, 00000001.00000003.2675219520.00000000054B0000.00000004.00001000.00020000.00000000.sdmp, FastestVPN.WindowsService.exe, 0000002F.00000002.3314344281.0000000004802000.00000002.00000001.01000000.0000004B.sdmp, is-K9S0M.tmp.1.dr
Source:	Binary string: E:\A\_work\89\s\corefx\bin\obj\AnyOS.AnyCPU.Release\System.Memory\netstandard\System.Memory.pdb source: FastestVPN.exe, FastestVPN.exe, 00000022.00000002.3352911178.000000000C1E2000.00000002.00000001.01000000.00000030.sdmp
Source:	Binary string: C:\projects\wpfanimatedgif\WpfAnimatedGif\obj\Release\net40\WpfAnimatedGif.pdb source: FastestVPN.exe, FastestVPN.exe, 00000022.00000002.3329548380.0000000006312000.00000002.00000001.01000000.00000020.sdmp
Source:	Binary string: D:\Sagar Work FastestVPN\FastestVPN-Windows-App\FastestVPN.BLL\obj\Release\FastestVPN.BLL.pdb source: FastestVPN.exe, FastestVPN.exe, 00000022.00000002.3325176110.0000000005DC2000.00000002.00000001.01000000.0000001C.sdmp
Source:	Binary string: D:\a\SQLitePCL.raw\SQLitePCL.raw\SQLitePCL.raw\src\SQLitePCLRaw.bundle_green\obj\Release\net461\SQLitePCLRaw.batteries_v2.pdb source: FastestVPN.exe, FastestVPN.exe, 00000022.00000002.3298315092.000000000108F000.00000004.00000020.00020000.00000000.sdmp, FastestVPN.exe, 00000022.00000002.3349122671.000000000BC52000.00000002.00000001.01000000.0000002D.sdmp
Source:	Binary string: Microsoft.Owin.Security.pdb source: FastestVPN.WindowsService.exe, FastestVPN.WindowsService.exe, 0000002F.00000002.3311384386.0000000004692000.00000002.00000001.01000000.0000004A.sdmp, is-63I9E.tmp.1.dr
Source:	Binary string: D:\Sagar Work FastestVPN\FastestVPN-Windows-App\FastestVPN.Common\obj\Release\FastestVPN.Common.pdb source: FastestVPN.WindowsService.exe, 0000002F.00000002.3307845165.0000000004522000.00000002.00000001.01000000.00000035.sdmp
Source:	Binary string: /_/Src/Newtonsoft.Json/obj/Release/net45/Newtonsoft.Json.pdb source: PVUfopbGfc.tmp, 00000001.00000003.2675219520.00000000054B0000.00000004.00001000.00020000.00000000.sdmp, FastestVPN.WindowsService.exe, FastestVPN.WindowsService.exe, 0000002F.00000002.3314344281.0000000004802000.00000002.00000001.01000000.0000004B.sdmp, is-K9S0M.tmp.1.dr
Source:	Binary string: \??\C:\Windows\Microsoft.AspNet.SignalR.Core.pdbTV source: FastestVPN.WindowsService.exe, 0000002F.00000002.3298560141.00000000011D3000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: n0C:\Windows\mscorlib.pdb source: FastestVPN.exe, 00000022.00000002.3330592068.00000000065A8000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\symbols\dll\System.ServiceProcess.pdblez source: FastestVPN.WindowsService.exe, 0000001D.00000002.2582155531.00000000012F2000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\VPN core\FastestVPN-Windows-Core\VPN.AdvancedNetwork\obj\Debug\VPN.AdvancedNetwork.pdb source: FastestVPN.WindowsService.exe, FastestVPN.WindowsService.exe, 0000002F.00000002.3312448340.0000000004742000.00000002.00000001.01000000.0000004D.sdmp
Source:	Binary string: D:\Sagar Work FastestVPN\FastestVPN-Windows-App\FastestVPN\obj\Release\FastestVPN.pdb source: FastestVPN.exe, 00000022.00000000.2464852704.0000000000ABD000.00000002.00000001.01000000.00000011.sdmp
Source:	Binary string: \??\C:\Windows\exe\FastestVPN.WindowsService.pdb source: FastestVPN.WindowsService.exe, 0000001D.00000002.2582155531.00000000012F2000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Windows\System.Configuration.Install.pdbpdball.pdb> source: FastestVPN.WindowsService.exe, 0000001D.00000002.2582155531.00000000012F2000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.pdb source: FastestVPN.WindowsService.exe, 0000002F.00000002.3298560141.000000000116F000.00000004.00000020.00020000.00000000.sdmp, FastestVPN.WindowsService.exe, 0000002F.00000002.3304056218.0000000001BCC000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: /_/artifacts/obj/Microsoft.AspNet.SignalR.Core/Release/net45/Microsoft.AspNet.SignalR.Core.pdb@\]q^/_/artifacts/obj/Microsoft.AspNet.SignalR.Core/Release/net45/Microsoft.AspNet.SignalR.Core.pdb source: FastestVPN.WindowsService.exe, 0000002F.00000002.3304056218.0000000001BCC000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: Microsoft.Owin.Host.HttpListener.pdb source: FastestVPN.WindowsService.exe, FastestVPN.WindowsService.exe, 0000002F.00000002.3309864180.00000000045C2000.00000002.00000001.01000000.0000003A.sdmp
Source:	Binary string: $]q^/_/artifacts/obj/Microsoft.AspNet.SignalR.Core/Release/net45/Microsoft.AspNet.SignalR.Core.pdb source: FastestVPN.WindowsService.exe, 0000002F.00000002.3304056218.0000000001BCC000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: D:\nt-driver-builder\wireguard-nt-0.10\Release\amd64\driver\wireguard.pdbGCTL source: PVUfopbGfc.tmp, 00000001.00000003.2675219520.00000000054B0000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: D:\a\1\s\SDK\AppCenter\Microsoft.AppCenter.WindowsDesktop\obj\Microsoft.AppCenter.WindowsDesktop\Release\net472\Microsoft.AppCenter.pdbSHA256 source: FastestVPN.exe, 00000022.00000002.3330868755.00000000065B2000.00000002.00000001.01000000.0000002A.sdmp
Source:	Binary string: D:\Sagar Work FastestVPN\FastestVPN-Windows-App\FastestVPN.Data.Remote\obj\Release\FastestVPN.Data.Remote.pdbb^\|^ n^_CorDllMainmscoree.dll source: FastestVPN.exe, 00000022.00000002.3325390125.0000000005DE2000.00000002.00000001.01000000.0000001E.sdmp
Source:	Binary string: D:\Sagar Work FastestVPN\FastestVPN-Windows-App\FastestVPN.DependencyInjection\obj\Release\FastestVPN.DI.pdbY6s6 e6_CorDllMainmscoree.dll source: FastestVPN.exe, 00000022.00000002.3323485610.0000000005842000.00000002.00000001.01000000.00000014.sdmp
Source:	Binary string: \??\C:\Windows\exe\FastestVPN.WindowsService.pdb3 source: FastestVPN.WindowsService.exe, 0000001D.00000002.2582155531.00000000012F2000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\samuli\source\repos\tap-windows6\src\x64\Release\tap0901.pdb source: drvinst.exe, 0000000D.00000003.2367445197.000001E102C35000.00000004.00000020.00020000.00000000.sdmp, drvinst.exe, 0000000D.00000003.2365465099.000001E102B8C000.00000004.00000020.00020000.00000000.sdmp, drvinst.exe, 0000000D.00000003.2367245171.000001E102C34000.00000004.00000020.00020000.00000000.sdmp, is-7J76O.tmp.1.dr, SET9DE9.tmp.14.dr
Source:	Binary string: ntdll.pdb source: ComDebug.exe, 00000030.00000002.2670309064.0000025FA46F0000.00000004.00000001.00020000.00000000.sdmp, ComDebug.exe, 00000030.00000002.2669964695.0000025FA44F0000.00000004.00000800.00020000.00000000.sdmp, ComDebug.exe, 00000030.00000002.2669735713.0000025FA40F3000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: /_/src/Flurl.Http/obj/Release/net472/Flurl.Http.pdb source: FastestVPN.exe, FastestVPN.exe, 00000022.00000002.3351847731.000000000BE92000.00000002.00000001.01000000.00000033.sdmp
Source:	Binary string: D:\a\SQLitePCL.raw\SQLitePCL.raw\SQLitePCL.raw\src\SQLitePCLRaw.core\obj\Release\netstandard2.0\SQLitePCLRaw.core.pdbSHA256Ci\ source: FastestVPN.exe, 00000022.00000002.3351200547.000000000BE32000.00000002.00000001.01000000.0000002E.sdmp
Source:	Binary string: Microsoft.Owin.pdb source: FastestVPN.WindowsService.exe, FastestVPN.WindowsService.exe, 0000002F.00000002.3309349757.0000000004592000.00000002.00000001.01000000.00000038.sdmp
Source:	Binary string: BouncyCastle.Crypto.pdb source: FastestVPN.exe, FastestVPN.exe, 00000022.00000002.3354869052.000000000DFF2000.00000002.00000001.01000000.00000036.sdmp
Source:	Binary string: D:\nt-driver-builder\wireguard-nt-0.10\Release\amd64\driver\wireguard.pdb source: PVUfopbGfc.tmp, 00000001.00000003.2675219520.00000000054B0000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.pdb source: FastestVPN.WindowsService.exe, 0000001D.00000002.2582155531.00000000012F2000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: Hardcodet.NotifyIcon.Wpf.pdb source: FastestVPN.exe, FastestVPN.exe, 00000022.00000002.3327281264.00000000060A2000.00000002.00000001.01000000.0000001F.sdmp
Source:	Binary string: \??\C:\Windows\FastestVPN.WindowsService.pdbdb] source: FastestVPN.WindowsService.exe, 0000001D.00000002.2582155531.00000000012F2000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\symbols\exe\FastestVPN.WindowsService.pdb00 source: FastestVPN.WindowsService.exe, 0000001D.00000002.2582155531.00000000012F2000.00000004.00000020.00020000.00000000.sdmp

Data Obfuscation

Suspicious powershell command line found

Source: C:\Program Files\FastestVPN\FastestVPN.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "powershell" -windowstyle hidden get-wmiobject Win32_ComputerSystemProduct \| Select-Object -ExpandProperty UUID
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "powershell" -windowstyle hidden get-wmiobject Win32_ComputerSystemProduct \| Select-Object -ExpandProperty UUID

Binary contains a suspicious time stamp

Source: is-HC0TS.tmp.1.dr

Static PE information: 0xAB462008 [Fri Jan 21 02:20:56 2061 UTC]

Contains functionality to dynamically determine API calls

Source: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exe

Code function: 10_2_00007FF70A9E6C90 SetupOpenInfFileW,GetLastError,SetupFindFirstLineW,SetupGetStringFieldW,SetupFindFirstLineW,SetupGetStringFieldW,CLSIDFromString,SetupDiGetClassDescriptionExW,LoadLibraryW,GetProcAddress,GetLastError,GetLastError,SetupFindFirstLineW,SetupGetStringFieldW,SetupGetStringFieldW,SetupCloseInfFile,FreeLibrary,

10_2_00007FF70A9E6C90

PE file contains sections with non-standard names

Source: PVUfopbGfc.exe	Static PE information: section name: .didata
Source: PVUfopbGfc.tmp.0.dr	Static PE information: section name: .didata
Source: is-ISUTF.tmp.1.dr	Static PE information: section name: _RDATA
Source: is-1SSK8.tmp.1.dr	Static PE information: section name: .didata

Uses code obfuscation techniques (call, push, ret)

Source: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exe	Code function: 10_2_00007FF70AA2C52C push rsp; retn 0004h	10_2_00007FF70AA2C52D
Source: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exe	Code function: 10_2_00007FF70AA2C576 push rsi; ret	10_2_00007FF70AA2C579
Source: C:\Program Files\FastestVPN\Resources\sp\release\nfregdrv.exe	Code function: 25_2_004028FD push ecx; ret	25_2_00402910
Source: C:\Program Files\FastestVPN\Resources\sp\release\nfregdrv.exe	Code function: 25_2_1000A089 push ecx; ret	25_2_1000A09C
Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe	Code function: 29_2_057858C0 push ds; retf	29_2_057858D0
Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe	Code function: 29_2_05785547 push cs; retf	29_2_05785552
Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe	Code function: 29_2_05785739 push ss; retf	29_2_0578573E
Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe	Code function: 29_2_05785530 push cs; retf	29_2_05785546
Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe	Code function: 29_2_057858B1 push ds; retf	29_2_057858B2
Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe	Code function: 29_2_05785734 push ss; retf	29_2_05785738
Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe	Code function: 29_2_057858B4 push ds; retf	29_2_057858B8
Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe	Code function: 29_2_05785529 push cs; retf	29_2_0578552E
Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe	Code function: 29_2_05785729 push ss; retf	29_2_0578572C
Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe	Code function: 29_2_0578572F push ss; retf	29_2_05785732
Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe	Code function: 29_2_057854A6 push cs; retf	29_2_05785546
Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe	Code function: 29_2_0578569F push ss; retf	29_2_0578573E
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Code function: 34_2_0595435D push es; retf	34_2_0595437E
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Code function: 34_2_0595437F push es; retf	34_2_0595445C
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Code function: 34_2_05D179DF push es; retf	34_2_05D17A7E
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Code function: 34_2_05D1ADC0 push cs; ret	34_2_05D1AE10
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Code function: 34_2_05D182C7 push ss; ret	34_2_05D182CA
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Code function: 34_2_05D1AEF2 push cs; retf	34_2_05D1AEF6
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Code function: 34_2_05D1AF10 push cs; retf	34_2_05D1AF1A
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Code function: 34_2_05D1AF04 push cs; retf	34_2_05D1AF0E
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Code function: 34_2_05D1AD3F push cs; ret	34_2_05D1ADBC
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Code function: 34_2_05D73564 push es; ret	34_2_05D73585
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Code function: 34_2_05D72FE2 push es; ret	34_2_05D73585
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Code function: 34_2_063A5883 push cs; ret	34_2_063A58CC
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Code function: 34_2_0BE74DF4 push cs; retf	34_2_0BE74E1A
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Code function: 34_2_0BE75C46 push cs; ret	34_2_0BE75C9A
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Code function: 34_2_0BE75BD5 push cs; ret	34_2_0BE75C9A

Source: is-FRGRO.tmp.1.dr

Static PE information: section name: .text entropy: 7.662424467871785

Persistence and Installation Behavior

Uses cmd line tools excessively to alter registry or file data

Source: C:\Windows\System32\cmd.exe	Process created: reg.exe
Source: C:\Windows\System32\cmd.exe	Process created: reg.exe
Source: C:\Windows\System32\cmd.exe	Process created: reg.exe
Source: C:\Windows\System32\cmd.exe	Process created: reg.exe	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: reg.exe	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: reg.exe	Jump to behavior

Drops PE files

Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	File created: C:\Program Files\FastestVPN\Resources\driver\windows10\i386\tapinstall.exe (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	File created: C:\Program Files\FastestVPN\Service\is-UI3J1.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	File created: C:\Program Files\FastestVPN\Service\is-7I93E.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	File created: C:\Program Files\FastestVPN\Resources\is-4JUC4.tmp	Jump to dropped file
Source: C:\Windows\System32\drvinst.exe	File created: C:\Windows\System32\DriverStore\Temp\{3501cea1-1def-284d-aeaa-53ba66ad3796}\tap0901.sys (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	File created: C:\Program Files\FastestVPN\Service\is-JJ40M.tmp	Jump to dropped file
Source: C:\Program Files\FastestVPN\Resources\ComDebug.exe	File created: C:\Users\user\AppData\Roaming\linkinfo\window_size_plugin.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	File created: C:\Program Files\FastestVPN\Service\is-PTINH.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	File created: C:\Program Files\FastestVPN\Microsoft.Extensions.DependencyInjection.Abstractions.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	File created: C:\Program Files\FastestVPN\is-1RGTV.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	File created: C:\Program Files\FastestVPN\Resources\file_selector_windows_plugin.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	File created: C:\Program Files\FastestVPN\Resources\libssl-1_1-x64.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	File created: C:\Program Files\FastestVPN\Resources\driver\windows\amd64\tap0901.sys (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	File created: C:\Program Files\FastestVPN\iphelperclose.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	File created: C:\Program Files\FastestVPN\Microsoft.AppCenter.Crashes.dll (copy)	Jump to dropped file
Source: C:\Program Files\FastestVPN\Resources\ComDebug.exe	File created: C:\Users\user\AppData\Roaming\linkinfo\flutter_windows.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	File created: C:\Program Files\FastestVPN\is-4QKGT.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	File created: C:\Program Files\FastestVPN\Service\iphelperclose.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	File created: C:\Program Files\FastestVPN\Resources\flutter_gpu_texture_renderer_plugin.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	File created: C:\Program Files\FastestVPN\Resources\is-TSTOA.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	File created: C:\Program Files\FastestVPN\Service\Microsoft.Owin.Hosting.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	File created: C:\Program Files\FastestVPN\Service\nfapi.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	File created: C:\Program Files\FastestVPN\Resources\sp\driver\windows8\i386\fastestvpndriver.sys (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	File created: C:\Program Files\FastestVPN\Resources\is-1155O.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	File created: C:\Program Files\FastestVPN\Resources\is-71JPL.tmp	Jump to dropped file
Source: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exe	File created: C:\Users\user\AppData\Local\Temp\{d561b4bd-4963-934e-b2b1-0e0727e36250}\tap0901.sys (copy)	Jump to dropped file
Source: C:\Program Files\FastestVPN\Resources\ComDebug.exe	File created: C:\Users\user\AppData\Roaming\linkinfo\window_manager_plugin.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	File created: C:\Program Files\FastestVPN\subinacl.exe (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	File created: C:\Program Files\FastestVPN\Resources\libssl32.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	File created: C:\Program Files\FastestVPN\is-F6R4E.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	File created: C:\Program Files\FastestVPN\unins000.exe (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	File created: C:\Program Files\FastestVPN\is-FCV4A.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	File created: C:\Program Files\FastestVPN\Resources\openvpnserv.exe (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	File created: C:\Program Files\FastestVPN\Resources\driver\windows\amd64\tapinstall.exe (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	File created: C:\Program Files\FastestVPN\Service\is-IBD4C.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	File created: C:\Program Files\FastestVPN\FastestVPN.Data.Remote.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	File created: C:\Program Files\FastestVPN\Resources\openssl.exe (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	File created: C:\Program Files\FastestVPN\SQLitePCLRaw.batteries_v2.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	File created: C:\Program Files\FastestVPN\Resources\sp\release\nfapi.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	File created: C:\Program Files\FastestVPN\Resources\is-7L7U1.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	File created: C:\Program Files\FastestVPN\is-QNEIM.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	File created: C:\Program Files\FastestVPN\is-K82F0.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	File created: C:\Program Files\FastestVPN\Resources\is-J9ANF.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	File created: C:\Program Files\FastestVPN\Microsoft.AppCenter.Analytics.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	File created: C:\Program Files\FastestVPN\Service\subinacl.exe (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	File created: C:\Program Files\FastestVPN\Resources\is-QN5KA.tmp	Jump to dropped file
Source: C:\Program Files\FastestVPN\Resources\ComDebug.exe	File created: C:\Users\user\AppData\Roaming\linkinfo\desktop_multi_window_plugin.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	File created: C:\Program Files\FastestVPN\is-EQOPF.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	File created: C:\Program Files\FastestVPN\Resources\liblzo2-2.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	File created: C:\Program Files\FastestVPN\System.Threading.Tasks.Extensions.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	File created: C:\Program Files\FastestVPN\System.Memory.dll (copy)	Jump to dropped file
Source: C:\Program Files\FastestVPN\Resources\ComDebug.exe	File created: C:\Users\user\AppData\Roaming\linkinfo\desktop_drop_plugin.dll	Jump to dropped file
Source: C:\Program Files\FastestVPN\Resources\ComDebug.exe	File created: C:\Users\user\AppData\Roaming\linkinfo\url_launcher_windows_plugin.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	File created: C:\Program Files\FastestVPN\Resources\sp\driver\windows8\amd64\is-0G2RR.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	File created: C:\Program Files\FastestVPN\Resources\ComDebug.exe (copy)	Jump to dropped file
Source: C:\Program Files\FastestVPN\Resources\ComDebug.exe	File created: C:\Users\user\AppData\Roaming\linkinfo\texture_rgba_renderer_plugin.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\netsh.exe	File created: C:\Users\user\AppData\Local\Temp\dglbpg	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	File created: C:\Program Files\FastestVPN\is-HNNPS.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	File created: C:\Program Files\FastestVPN\is-TIP8B.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	File created: C:\Program Files\FastestVPN\Service\is-17D7A.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	File created: C:\Program Files\FastestVPN\is-O5MTV.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	File created: C:\Program Files\FastestVPN\is-QTCOF.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	File created: C:\Program Files\FastestVPN\is-GFG66.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	File created: C:\Program Files\FastestVPN\Resources\is-5RDD6.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	File created: C:\Program Files\FastestVPN\Service\is-E9VNL.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	File created: C:\Program Files\FastestVPN\is-DTS4U.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	File created: C:\Program Files\FastestVPN\is-1FT3O.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	File created: C:\Program Files\FastestVPN\Resources\driver\windows10\i386\tap0901.sys (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	File created: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\is-ISUTF.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	File created: C:\Program Files\FastestVPN\is-59D46.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	File created: C:\Program Files\FastestVPN\VPN.RAS.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	File created: C:\Program Files\FastestVPN\BouncyCastle.Crypto.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	File created: C:\Program Files\FastestVPN\Microsoft.AspNet.SignalR.Client.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	File created: C:\Program Files\FastestVPN\Service\is-QVSDK.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	File created: C:\Program Files\FastestVPN\FastestVPN.BLL.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	File created: C:\Program Files\FastestVPN\is-1SSK8.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	File created: C:\Program Files\FastestVPN\fix-dns-leak-32.dll (copy)	Jump to dropped file
Source: C:\Program Files\FastestVPN\Resources\ComDebug.exe	File created: C:\Users\user\AppData\Roaming\linkinfo\uni_links_desktop_plugin.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	File created: C:\Program Files\FastestVPN\Resources\vcruntime140.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	File created: C:\Program Files\FastestVPN\Service\Microsoft.Owin.Diagnostics.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	File created: C:\Program Files\FastestVPN\Resources\openvpn.exe (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	File created: C:\Program Files\FastestVPN\Service\VPN.RAS.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	File created: C:\Program Files\FastestVPN\Microsoft.AppCenter.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	File created: C:\Program Files\FastestVPN\Resources\sp\driver\windows7\amd64\is-K5R6R.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	File created: C:\Program Files\FastestVPN\Resources\is-QOP0D.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	File created: C:\Program Files\FastestVPN\VPN.OpenVpn.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	File created: C:\Program Files\FastestVPN\Resources\sp\driver\windows8\amd64\fastestvpndriver.sys (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	File created: C:\Program Files\FastestVPN\Flurl.Http.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	File created: C:\Program Files\FastestVPN\Newtonsoft.Json.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	File created: C:\Program Files\FastestVPN\Service\Microsoft.Owin.Security.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	File created: C:\Program Files\FastestVPN\Resources\is-5M6KM.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	File created: C:\Program Files\FastestVPN\is-OKMTN.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	File created: C:\Program Files\FastestVPN\FastestVPN.ViewModel.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	File created: C:\Program Files\FastestVPN\Resources\texture_rgba_renderer_plugin.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	File created: C:\Program Files\FastestVPN\is-RU768.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	File created: C:\Program Files\FastestVPN\Resources\is-T7NGU.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	File created: C:\Program Files\FastestVPN\Resources\is-MI83V.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	File created: C:\Program Files\FastestVPN\Service\Newtonsoft.Json.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	File created: C:\Program Files\FastestVPN\Service\VPN.Common.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	File created: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	File created: C:\Program Files\FastestVPN\Service\fix-dns-leak-32.dll (copy)	Jump to dropped file
Source: C:\Program Files\FastestVPN\Resources\ComDebug.exe	File created: C:\Users\user\AppData\Roaming\linkinfo\flutter_custom_cursor_plugin.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	File created: C:\Program Files\FastestVPN\Service\is-902P3.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	File created: C:\Program Files\FastestVPN\VPN.WireGuard.dll (copy)	Jump to dropped file
Source: C:\Windows\System32\drvinst.exe	File created: C:\Windows\System32\drivers\tap0901.sys (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	File created: C:\Program Files\FastestVPN\is-21P0F.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	File created: C:\Program Files\FastestVPN\Resources\window_manager_plugin.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	File created: C:\Program Files\FastestVPN\Updater.exe (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	File created: C:\Program Files\FastestVPN\SQLitePCLRaw.core.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	File created: C:\Program Files\FastestVPN\is-FRGRO.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	File created: C:\Program Files\FastestVPN\Service\Microsoft.Owin.Cors.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	File created: C:\Program Files\FastestVPN\Service\is-9GVKQ.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	File created: C:\Program Files\FastestVPN\Hardcodet.NotifyIcon.Wpf.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	File created: C:\Program Files\FastestVPN\Resources\tapinstallWin64.exe (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	File created: C:\Program Files\FastestVPN\Service\VPN.AdvancedNetwork.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	File created: C:\Program Files\FastestVPN\Resources\flutter_custom_cursor_plugin.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	File created: C:\Program Files\FastestVPN\Service\is-BI62G.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	File created: C:\Program Files\FastestVPN\Resources\is-QG142.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	File created: C:\Program Files\FastestVPN\Service\is-J59NL.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	File created: C:\Program Files\FastestVPN\Resources\is-EJ1T1.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	File created: C:\Program Files\FastestVPN\Service\Microsoft.AspNet.SignalR.Core.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	File created: C:\Program Files\FastestVPN\VPN.AdvancedNetwork.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	File created: C:\Program Files\FastestVPN\Resources\tapinstall.exe (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	File created: C:\Program Files\FastestVPN\Service\Owin.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	File created: C:\Program Files\FastestVPN\Resources\driver\windows\i386\is-QN43A.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	File created: C:\Program Files\FastestVPN\Resources\uni_links_desktop_plugin.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	File created: C:\Program Files\FastestVPN\Resources\wireguard.exe (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	File created: C:\Program Files\FastestVPN\Service\is-AVARB.tmp	Jump to dropped file
Source: C:\Windows\System32\drvinst.exe	File created: C:\Windows\System32\DriverStore\Temp\{3501cea1-1def-284d-aeaa-53ba66ad3796}\SET98BB.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	File created: C:\Program Files\FastestVPN\Service\Microsoft.Owin.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	File created: C:\Program Files\FastestVPN\Resources\driver\windows10\i386\is-GNQS3.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	File created: C:\Program Files\FastestVPN\Resources\is-4R4LE.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	File created: C:\Program Files\FastestVPN\FastestVPN.Data.Local.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	File created: C:\Program Files\FastestVPN\Flurl.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	File created: C:\Program Files\FastestVPN\Resources\is-71J6V.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	File created: C:\Program Files\FastestVPN\System.Buffers.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	File created: C:\Program Files\FastestVPN\Service\is-17VQ7.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	File created: C:\Program Files\FastestVPN\VPN.Common.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	File created: C:\Program Files\FastestVPN\Resources\driver\windows\amd64\is-7J76O.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	File created: C:\Program Files\FastestVPN\is-L8FIT.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	File created: C:\Program Files\FastestVPN\Resources\driver\windows10\i386\is-5P6ME.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	File created: C:\Program Files\FastestVPN\Resources\flutter_windows.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	File created: C:\Program Files\FastestVPN\SingleInstanceApplication.dll (copy)	Jump to dropped file
Source: C:\Windows\System32\drvinst.exe	File created: C:\Windows\System32\drivers\SET9DE9.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	File created: C:\Program Files\FastestVPN\Service\is-CS1P9.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	File created: C:\Program Files\FastestVPN\Service\System.Web.Cors.dll (copy)	Jump to dropped file
Source: C:\Program Files\FastestVPN\Resources\ComDebug.exe	File created: C:\Users\user\AppData\Roaming\linkinfo\flutter_gpu_texture_renderer_plugin.dll	Jump to dropped file
Source: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exe	File created: C:\Users\user\AppData\Local\Temp\{d561b4bd-4963-934e-b2b1-0e0727e36250}\SET9466.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	File created: C:\Program Files\FastestVPN\is-57IGR.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	File created: C:\Program Files\FastestVPN\is-98KKE.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	File created: C:\Program Files\FastestVPN\Service\is-6KC91.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	File created: C:\Program Files\FastestVPN\Resources\ssleay32.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	File created: C:\Program Files\FastestVPN\Resources\is-O5204.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	File created: C:\Program Files\FastestVPN\nfapi.dll (copy)	Jump to dropped file
Source: C:\Users\user\Desktop\PVUfopbGfc.exe	File created: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	File created: C:\Program Files\FastestVPN\Resources\is-QLSLT.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	File created: C:\Program Files\FastestVPN\is-GRQCB.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	File created: C:\Program Files\FastestVPN\Resources\devcon.exe (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	File created: C:\Program Files\FastestVPN\Resources\driver\windows\i386\tap0901.sys (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	File created: C:\Program Files\FastestVPN\is-NSK8U.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	File created: C:\Program Files\FastestVPN\is-UN9A1.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	File created: C:\Program Files\FastestVPN\FastestVPN.exe (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	File created: C:\Program Files\FastestVPN\is-5IUQF.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	File created: C:\Program Files\FastestVPN\Resources\openvpnserv2.exe (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	File created: C:\Users\user\AppData\Local\Temp\is-8EE2F.tmp\_isetup\_setup64.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	File created: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exe (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	File created: C:\Program Files\FastestVPN\Resources\is-K889R.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	File created: C:\Program Files\FastestVPN\VPN.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	File created: C:\Program Files\FastestVPN\Resources\sp\release\is-1ASBC.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	File created: C:\Program Files\FastestVPN\Service\is-63I9E.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	File created: C:\Program Files\FastestVPN\Resources\is-8UK12.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	File created: C:\Program Files\FastestVPN\Resources\desktop_drop_plugin.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	File created: C:\Program Files\FastestVPN\Service\VPN.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	File created: C:\Program Files\FastestVPN\Resources\tapctl.exe (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	File created: C:\Program Files\FastestVPN\is-UORP7.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	File created: C:\Program Files\FastestVPN\SQLitePCLRaw.provider.dynamic_cdecl.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	File created: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tap0901.sys (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	File created: C:\Program Files\FastestVPN\is-V02LD.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	File created: C:\Program Files\FastestVPN\FastestVPN.Common.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	File created: C:\Program Files\FastestVPN\Microsoft.Bcl.AsyncInterfaces.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	File created: C:\Program Files\FastestVPN\Resources\is-FO4BS.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	File created: C:\Program Files\FastestVPN\Resources\is-KHPQG.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	File created: C:\Program Files\FastestVPN\Resources\is-BTQQJ.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	File created: C:\Program Files\FastestVPN\is-VTVPL.tmp	Jump to dropped file
Source: C:\Windows\System32\xcopy.exe	File created: C:\Windows\System32\drivers\fastestvpndriver.sys	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	File created: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\is-6LAFJ.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	File created: C:\Program Files\FastestVPN\is-4EJAE.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	File created: C:\Program Files\FastestVPN\Resources\is-Q7RHP.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	File created: C:\Program Files\FastestVPN\Resources\is-9BMN3.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	File created: C:\Program Files\FastestVPN\is-LFVH5.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	File created: C:\Program Files\FastestVPN\Resources\driver\windows\i386\is-PBM2F.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	File created: C:\Program Files\FastestVPN\Resources\sp\driver\windows7\i386\is-HEM9F.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	File created: C:\Program Files\FastestVPN\is-HC0TS.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	File created: C:\Program Files\FastestVPN\Resources\is-J49VG.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	File created: C:\Program Files\FastestVPN\Resources\sp\driver\windows7\amd64\fastestvpndriver.sys (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	File created: C:\Program Files\FastestVPN\Resources\msvcr100.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	File created: C:\Program Files\FastestVPN\WpfAnimatedGif.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	File created: C:\Program Files\FastestVPN\Service\is-OTL5D.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	File created: C:\Program Files\FastestVPN\Resources\screen_retriever_plugin.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	File created: C:\Program Files\FastestVPN\Resources\driver\windows\i386\tapinstall.exe (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	File created: C:\Program Files\FastestVPN\Service\VPN.OpenVpn.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	File created: C:\Program Files\FastestVPN\Resources\sp\release\nfregdrv.exe (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	File created: C:\Program Files\FastestVPN\Resources\libeay32.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	File created: C:\Program Files\FastestVPN\Resources\libcrypto-1_1-x64.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	File created: C:\Program Files\FastestVPN\Resources\is-OJSLF.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	File created: C:\Program Files\FastestVPN\Service\Microsoft.Owin.Host.HttpListener.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	File created: C:\Program Files\FastestVPN\Resources\libpkcs11-helper-1.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	File created: C:\Program Files\FastestVPN\Microsoft.Extensions.DependencyInjection.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	File created: C:\Program Files\FastestVPN\Resources\desktop_multi_window_plugin.dll (copy)	Jump to dropped file
Source: C:\Windows\SysWOW64\netsh.exe	File created: C:\Users\user\AppData\Local\Temp\Launcher.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	File created: C:\Program Files\FastestVPN\Service\FastestVPN.Common.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	File created: C:\Program Files\FastestVPN\is-446MI.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	File created: C:\Program Files\FastestVPN\Service\is-NF2G1.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	File created: C:\Program Files\FastestVPN\Resources\is-9HBCL.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	File created: C:\Program Files\FastestVPN\is-K9S0M.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	File created: C:\Program Files\FastestVPN\Service\is-GL2TH.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	File created: C:\Program Files\FastestVPN\Resources\tapinstallWin32.exe (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	File created: C:\Program Files\FastestVPN\is-5L7N2.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	File created: C:\Program Files\FastestVPN\Resources\is-BERNA.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	File created: C:\Program Files\FastestVPN\Resources\driver\windows\amd64\is-9NM46.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	File created: C:\Program Files\FastestVPN\is-IPA77.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	File created: C:\Program Files\FastestVPN\Resources\url_launcher_windows_plugin.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	File created: C:\Program Files\FastestVPN\FastestVPN.Diagnostics.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	File created: C:\Program Files\FastestVPN\is-5TM82.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	File created: C:\Program Files\FastestVPN\Resources\is-JF6RJ.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	File created: C:\Program Files\FastestVPN\Resources\is-SADIQ.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	File created: C:\Program Files\FastestVPN\Resources\window_size_plugin.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	File created: C:\Program Files\FastestVPN\Resources\sp\release\is-QPO3E.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	File created: C:\Program Files\FastestVPN\Resources\sp\driver\windows8\i386\is-PE3HT.tmp	Jump to dropped file
Source: C:\Program Files\FastestVPN\Resources\ComDebug.exe	File created: C:\Users\user\AppData\Roaming\linkinfo\file_selector_windows_plugin.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	File created: C:\Program Files\FastestVPN\Service\is-2RVHB.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	File created: C:\Program Files\FastestVPN\System.Numerics.Vectors.dll (copy)	Jump to dropped file
Source: C:\Program Files\FastestVPN\Resources\ComDebug.exe	File created: C:\Users\user\AppData\Roaming\linkinfo\screen_retriever_plugin.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	File created: C:\Program Files\FastestVPN\is-2448N.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	File created: C:\Program Files\FastestVPN\is-PTLVI.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	File created: C:\Program Files\FastestVPN\is-AHK7Q.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	File created: C:\Program Files\FastestVPN\Service\VPN.WireGuard.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	File created: C:\Program Files\FastestVPN\Resources\is-UCO86.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	File created: C:\Program Files\FastestVPN\Service\is-SQ7U6.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	File created: C:\Program Files\FastestVPN\System.Runtime.CompilerServices.Unsafe.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	File created: C:\Program Files\FastestVPN\Resources\sp\driver\windows7\i386\fastestvpndriver.sys (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	File created: C:\Program Files\FastestVPN\is-05ABD.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	File created: C:\Program Files\FastestVPN\FastestVPN.DI.dll (copy)	Jump to dropped file

Drops PE files to the windows directory (C:\Windows)

Source: C:\Windows\System32\drvinst.exe	File created: C:\Windows\System32\DriverStore\Temp\{3501cea1-1def-284d-aeaa-53ba66ad3796}\tap0901.sys (copy)	Jump to dropped file
Source: C:\Windows\System32\drvinst.exe	File created: C:\Windows\System32\drivers\tap0901.sys (copy)	Jump to dropped file
Source: C:\Windows\System32\xcopy.exe	File created: C:\Windows\System32\drivers\fastestvpndriver.sys	Jump to dropped file
Source: C:\Windows\System32\drvinst.exe	File created: C:\Windows\System32\drivers\SET9DE9.tmp	Jump to dropped file
Source: C:\Windows\System32\drvinst.exe	File created: C:\Windows\System32\DriverStore\Temp\{3501cea1-1def-284d-aeaa-53ba66ad3796}\SET98BB.tmp	Jump to dropped file

Drops files with a non-matching file extension (content does not match file extension)

Source: C:\Windows\SysWOW64\netsh.exe

File created: C:\Users\user\AppData\Local\Temp\dglbpg

Jump to dropped file

Creates install or setup log file

Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe	File created: C:\Program Files\FastestVPN\Service\InstallUtil.InstallLog
Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe	File created: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.InstallLog

Boot Survival

Creates a start menu entry (Start Menu\Programs\Startup)

Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\FastestVPN.lnk

Jump to behavior

Creates or modifies windows services

Source: C:\Windows\System32\drvinst.exe

Registry key created: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\tap0901

Jump to behavior

Modifies existing windows services

Source: C:\Windows\System32\svchost.exe

Registry key value modified: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Linkage

Jump to behavior

Stores files to the Windows start menu directory

Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	File created: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\FastestVPN	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	File created: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\FastestVPN\FastestVPN.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	File created: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\FastestVPN\Uninstall FastestVPN.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\FastestVPN.lnk	Jump to behavior

Source: C:\Program Files\FastestVPN\Resources\sp\release\nfregdrv.exe

25_2_10013540

Source: C:\Windows\System32\cmd.exe

Process created: C:\Windows\System32\sc.exe sc stop fastestvpndriver

Hooking and other Techniques for Hiding and Protection

Found hidden mapped module (file has been removed from disk)

Source: C:\Windows\SysWOW64\netsh.exe

Module Loaded: C:\USERS\user\APPDATA\LOCAL\TEMP\DGLBPG

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

Source: C:\Program Files\FastestVPN\FastestVPN.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Registry key monitored for changes: HKEY_CURRENT_USER_Classes
Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot

Stores large binary data to the registry

Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe

Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DDFB16CD4931C973A2037D3FC83A4D7D775D05E4 Blob

Source: C:\Users\user\Desktop\PVUfopbGfc.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\FastestVPN\subinacl.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\FastestVPN\subinacl.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Queries sensitive system registry key value via command line tool

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\reg.exe reg Query "HKLM\Hardware\Description\System\CentralProcessor\0"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\reg.exe reg Query "HKLM\Hardware\Description\System\CentralProcessor\0"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\reg.exe reg Query "HKLM\Hardware\Description\System\CentralProcessor\0"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\reg.exe reg Query "HKLM\Hardware\Description\System\CentralProcessor\0"	Jump to behavior

Switches to a custom stack to bypass stack traces

Source: C:\Windows\SysWOW64\netsh.exe	API/Special instruction interceptor: Address: 764A3B97
Source: C:\Users\user\AppData\Local\Temp\Launcher.exe	API/Special instruction interceptor: Address: 3A4ACF

Allocates memory with a write watch (potentially for evading sandboxes)

Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe	Memory allocated: 1750000 memory reserve \| memory write watch
Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe	Memory allocated: 3200000 memory reserve \| memory write watch
Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe	Memory allocated: 2F70000 memory reserve \| memory write watch
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Memory allocated: 2C20000 memory reserve \| memory write watch
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Memory allocated: 2EB0000 memory reserve \| memory write watch
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Memory allocated: 2C20000 memory reserve \| memory write watch
Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe	Memory allocated: A60000 memory reserve \| memory write watch
Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe	Memory allocated: 2780000 memory reserve \| memory write watch
Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe	Memory allocated: D50000 memory reserve \| memory write watch
Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe	Memory allocated: 19B0000 memory reserve \| memory write watch
Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe	Memory allocated: 1B70000 memory reserve \| memory write watch
Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe	Memory allocated: 3B70000 memory reserve \| memory write watch
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Memory allocated: C80000 memory reserve \| memory write watch
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Memory allocated: 2740000 memory reserve \| memory write watch
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Memory allocated: 4740000 memory reserve \| memory write watch

Contains functionality to read device registry values (via SetupAPI)

Source: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exe

Code function: 10_2_00007FF70A9E4820 SetupDiGetDeviceRegistryPropertyW,GetLastError,SetupDiGetDeviceRegistryPropertyW,

10_2_00007FF70A9E4820

Contains long sleeps (>= 3 min)

Source: C:\Program Files\FastestVPN\FastestVPN.exe	Thread delayed: delay time: 922337203685477
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Thread delayed: delay time: 922337203685477
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe	Thread delayed: delay time: 922337203685477
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Thread delayed: delay time: 922337203685477
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Thread delayed: delay time: 922337203685477

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Source: C:\Program Files\FastestVPN\FastestVPN.exe	Window / User API: threadDelayed 4293
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Window / User API: threadDelayed 3927
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 2642
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 1589
Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe	Window / User API: threadDelayed 533

Found dropped PE file which has not been started or loaded

Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Dropped PE file which has not been started: C:\Program Files\FastestVPN\Resources\driver\windows10\i386\tapinstall.exe (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Dropped PE file which has not been started: C:\Program Files\FastestVPN\Service\is-UI3J1.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Dropped PE file which has not been started: C:\Program Files\FastestVPN\Service\is-7I93E.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Dropped PE file which has not been started: C:\Program Files\FastestVPN\Resources\is-4JUC4.tmp	Jump to dropped file
Source: C:\Windows\System32\drvinst.exe	Dropped PE file which has not been started: C:\Windows\System32\DriverStore\Temp\{3501cea1-1def-284d-aeaa-53ba66ad3796}\tap0901.sys (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Dropped PE file which has not been started: C:\Program Files\FastestVPN\Service\is-JJ40M.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Dropped PE file which has not been started: C:\Program Files\FastestVPN\Microsoft.Extensions.DependencyInjection.Abstractions.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Dropped PE file which has not been started: C:\Program Files\FastestVPN\is-1RGTV.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Dropped PE file which has not been started: C:\Program Files\FastestVPN\Resources\libssl-1_1-x64.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Dropped PE file which has not been started: C:\Program Files\FastestVPN\Resources\driver\windows\amd64\tap0901.sys (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Dropped PE file which has not been started: C:\Program Files\FastestVPN\iphelperclose.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Dropped PE file which has not been started: C:\Program Files\FastestVPN\is-4QKGT.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Dropped PE file which has not been started: C:\Program Files\FastestVPN\Service\iphelperclose.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Dropped PE file which has not been started: C:\Program Files\FastestVPN\Resources\is-TSTOA.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Dropped PE file which has not been started: C:\Program Files\FastestVPN\Service\Microsoft.Owin.Hosting.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Dropped PE file which has not been started: C:\Program Files\FastestVPN\Resources\sp\driver\windows8\i386\fastestvpndriver.sys (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Dropped PE file which has not been started: C:\Program Files\FastestVPN\Resources\is-1155O.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Dropped PE file which has not been started: C:\Program Files\FastestVPN\Resources\is-71JPL.tmp	Jump to dropped file
Source: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\{d561b4bd-4963-934e-b2b1-0e0727e36250}\tap0901.sys (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Dropped PE file which has not been started: C:\Program Files\FastestVPN\Resources\libssl32.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Dropped PE file which has not been started: C:\Program Files\FastestVPN\unins000.exe (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Dropped PE file which has not been started: C:\Program Files\FastestVPN\is-F6R4E.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Dropped PE file which has not been started: C:\Program Files\FastestVPN\Resources\openvpnserv.exe (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Dropped PE file which has not been started: C:\Program Files\FastestVPN\is-FCV4A.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Dropped PE file which has not been started: C:\Program Files\FastestVPN\Resources\driver\windows\amd64\tapinstall.exe (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Dropped PE file which has not been started: C:\Program Files\FastestVPN\Service\is-IBD4C.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Dropped PE file which has not been started: C:\Program Files\FastestVPN\FastestVPN.Data.Remote.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Dropped PE file which has not been started: C:\Program Files\FastestVPN\Resources\openssl.exe (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Dropped PE file which has not been started: C:\Program Files\FastestVPN\SQLitePCLRaw.batteries_v2.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Dropped PE file which has not been started: C:\Program Files\FastestVPN\Resources\is-7L7U1.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Dropped PE file which has not been started: C:\Program Files\FastestVPN\is-QNEIM.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Dropped PE file which has not been started: C:\Program Files\FastestVPN\is-K82F0.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Dropped PE file which has not been started: C:\Program Files\FastestVPN\Resources\is-J9ANF.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Dropped PE file which has not been started: C:\Program Files\FastestVPN\Microsoft.AppCenter.Analytics.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Dropped PE file which has not been started: C:\Program Files\FastestVPN\Service\subinacl.exe (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Dropped PE file which has not been started: C:\Program Files\FastestVPN\Resources\is-QN5KA.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Dropped PE file which has not been started: C:\Program Files\FastestVPN\is-EQOPF.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Dropped PE file which has not been started: C:\Program Files\FastestVPN\Resources\liblzo2-2.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Dropped PE file which has not been started: C:\Program Files\FastestVPN\System.Threading.Tasks.Extensions.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Dropped PE file which has not been started: C:\Program Files\FastestVPN\System.Memory.dll (copy)	Jump to dropped file
Source: C:\Windows\SysWOW64\netsh.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\dglbpg	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Dropped PE file which has not been started: C:\Program Files\FastestVPN\Resources\sp\driver\windows8\amd64\is-0G2RR.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Dropped PE file which has not been started: C:\Program Files\FastestVPN\is-HNNPS.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Dropped PE file which has not been started: C:\Program Files\FastestVPN\Service\is-17D7A.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Dropped PE file which has not been started: C:\Program Files\FastestVPN\is-TIP8B.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Dropped PE file which has not been started: C:\Program Files\FastestVPN\is-QTCOF.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Dropped PE file which has not been started: C:\Program Files\FastestVPN\is-GFG66.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Dropped PE file which has not been started: C:\Program Files\FastestVPN\Resources\is-5RDD6.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Dropped PE file which has not been started: C:\Program Files\FastestVPN\is-DTS4U.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Dropped PE file which has not been started: C:\Program Files\FastestVPN\Service\is-E9VNL.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Dropped PE file which has not been started: C:\Program Files\FastestVPN\is-1FT3O.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Dropped PE file which has not been started: C:\Program Files\FastestVPN\Resources\driver\windows10\i386\tap0901.sys (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Dropped PE file which has not been started: C:\Program Files\FastestVPN\VPN.RAS.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Dropped PE file which has not been started: C:\Program Files\FastestVPN\is-59D46.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Dropped PE file which has not been started: C:\Program Files\FastestVPN\Microsoft.AspNet.SignalR.Client.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Dropped PE file which has not been started: C:\Program Files\FastestVPN\BouncyCastle.Crypto.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Dropped PE file which has not been started: C:\Program Files\FastestVPN\Service\is-QVSDK.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Dropped PE file which has not been started: C:\Program Files\FastestVPN\FastestVPN.BLL.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Dropped PE file which has not been started: C:\Program Files\FastestVPN\fix-dns-leak-32.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Dropped PE file which has not been started: C:\Program Files\FastestVPN\is-1SSK8.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Dropped PE file which has not been started: C:\Program Files\FastestVPN\Service\Microsoft.Owin.Diagnostics.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Dropped PE file which has not been started: C:\Program Files\FastestVPN\Resources\vcruntime140.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Dropped PE file which has not been started: C:\Program Files\FastestVPN\Resources\openvpn.exe (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Dropped PE file which has not been started: C:\Program Files\FastestVPN\Service\VPN.RAS.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Dropped PE file which has not been started: C:\Program Files\FastestVPN\Microsoft.AppCenter.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Dropped PE file which has not been started: C:\Program Files\FastestVPN\Resources\sp\driver\windows7\amd64\is-K5R6R.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Dropped PE file which has not been started: C:\Program Files\FastestVPN\Resources\is-QOP0D.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Dropped PE file which has not been started: C:\Program Files\FastestVPN\VPN.OpenVpn.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Dropped PE file which has not been started: C:\Program Files\FastestVPN\Resources\sp\driver\windows8\amd64\fastestvpndriver.sys (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Dropped PE file which has not been started: C:\Program Files\FastestVPN\Flurl.Http.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Dropped PE file which has not been started: C:\Program Files\FastestVPN\Newtonsoft.Json.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Dropped PE file which has not been started: C:\Program Files\FastestVPN\Service\Microsoft.Owin.Security.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Dropped PE file which has not been started: C:\Program Files\FastestVPN\is-OKMTN.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Dropped PE file which has not been started: C:\Program Files\FastestVPN\FastestVPN.ViewModel.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Dropped PE file which has not been started: C:\Program Files\FastestVPN\is-RU768.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Dropped PE file which has not been started: C:\Program Files\FastestVPN\Resources\is-T7NGU.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Dropped PE file which has not been started: C:\Program Files\FastestVPN\Resources\is-MI83V.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Dropped PE file which has not been started: C:\Program Files\FastestVPN\Service\Newtonsoft.Json.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Dropped PE file which has not been started: C:\Program Files\FastestVPN\Service\VPN.Common.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Dropped PE file which has not been started: C:\Program Files\FastestVPN\Service\fix-dns-leak-32.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Dropped PE file which has not been started: C:\Program Files\FastestVPN\Service\is-902P3.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Dropped PE file which has not been started: C:\Program Files\FastestVPN\VPN.WireGuard.dll (copy)	Jump to dropped file
Source: C:\Windows\System32\drvinst.exe	Dropped PE file which has not been started: C:\Windows\System32\drivers\tap0901.sys (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Dropped PE file which has not been started: C:\Program Files\FastestVPN\is-21P0F.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Dropped PE file which has not been started: C:\Program Files\FastestVPN\Updater.exe (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Dropped PE file which has not been started: C:\Program Files\FastestVPN\SQLitePCLRaw.core.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Dropped PE file which has not been started: C:\Program Files\FastestVPN\Service\Microsoft.Owin.Cors.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Dropped PE file which has not been started: C:\Program Files\FastestVPN\Hardcodet.NotifyIcon.Wpf.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Dropped PE file which has not been started: C:\Program Files\FastestVPN\Service\is-9GVKQ.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Dropped PE file which has not been started: C:\Program Files\FastestVPN\Resources\tapinstallWin64.exe (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Dropped PE file which has not been started: C:\Program Files\FastestVPN\Service\VPN.AdvancedNetwork.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Dropped PE file which has not been started: C:\Program Files\FastestVPN\Service\is-BI62G.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Dropped PE file which has not been started: C:\Program Files\FastestVPN\Resources\is-QG142.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Dropped PE file which has not been started: C:\Program Files\FastestVPN\Service\is-J59NL.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Dropped PE file which has not been started: C:\Program Files\FastestVPN\Resources\is-EJ1T1.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Dropped PE file which has not been started: C:\Program Files\FastestVPN\Service\Microsoft.AspNet.SignalR.Core.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Dropped PE file which has not been started: C:\Program Files\FastestVPN\VPN.AdvancedNetwork.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Dropped PE file which has not been started: C:\Program Files\FastestVPN\Resources\tapinstall.exe (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Dropped PE file which has not been started: C:\Program Files\FastestVPN\Service\Owin.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Dropped PE file which has not been started: C:\Program Files\FastestVPN\Resources\driver\windows\i386\is-QN43A.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Dropped PE file which has not been started: C:\Program Files\FastestVPN\Resources\wireguard.exe (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Dropped PE file which has not been started: C:\Program Files\FastestVPN\Service\is-AVARB.tmp	Jump to dropped file
Source: C:\Windows\System32\drvinst.exe	Dropped PE file which has not been started: C:\Windows\System32\DriverStore\Temp\{3501cea1-1def-284d-aeaa-53ba66ad3796}\SET98BB.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Dropped PE file which has not been started: C:\Program Files\FastestVPN\Service\Microsoft.Owin.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Dropped PE file which has not been started: C:\Program Files\FastestVPN\FastestVPN.Data.Local.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Dropped PE file which has not been started: C:\Program Files\FastestVPN\Resources\is-4R4LE.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Dropped PE file which has not been started: C:\Program Files\FastestVPN\Resources\driver\windows10\i386\is-GNQS3.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Dropped PE file which has not been started: C:\Program Files\FastestVPN\Resources\is-71J6V.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Dropped PE file which has not been started: C:\Program Files\FastestVPN\Flurl.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Dropped PE file which has not been started: C:\Program Files\FastestVPN\System.Buffers.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Dropped PE file which has not been started: C:\Program Files\FastestVPN\Service\is-17VQ7.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Dropped PE file which has not been started: C:\Program Files\FastestVPN\VPN.Common.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Dropped PE file which has not been started: C:\Program Files\FastestVPN\Resources\driver\windows\amd64\is-7J76O.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Dropped PE file which has not been started: C:\Program Files\FastestVPN\is-L8FIT.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Dropped PE file which has not been started: C:\Program Files\FastestVPN\Resources\driver\windows10\i386\is-5P6ME.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Dropped PE file which has not been started: C:\Program Files\FastestVPN\SingleInstanceApplication.dll (copy)	Jump to dropped file
Source: C:\Windows\System32\drvinst.exe	Dropped PE file which has not been started: C:\Windows\System32\drivers\SET9DE9.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Dropped PE file which has not been started: C:\Program Files\FastestVPN\Service\System.Web.Cors.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Dropped PE file which has not been started: C:\Program Files\FastestVPN\Service\is-CS1P9.tmp	Jump to dropped file
Source: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\{d561b4bd-4963-934e-b2b1-0e0727e36250}\SET9466.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Dropped PE file which has not been started: C:\Program Files\FastestVPN\is-57IGR.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Dropped PE file which has not been started: C:\Program Files\FastestVPN\is-98KKE.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Dropped PE file which has not been started: C:\Program Files\FastestVPN\Service\is-6KC91.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Dropped PE file which has not been started: C:\Program Files\FastestVPN\Resources\ssleay32.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Dropped PE file which has not been started: C:\Program Files\FastestVPN\Resources\is-O5204.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Dropped PE file which has not been started: C:\Program Files\FastestVPN\Resources\is-QLSLT.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Dropped PE file which has not been started: C:\Program Files\FastestVPN\is-GRQCB.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Dropped PE file which has not been started: C:\Program Files\FastestVPN\Resources\driver\windows\i386\tap0901.sys (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Dropped PE file which has not been started: C:\Program Files\FastestVPN\Resources\devcon.exe (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Dropped PE file which has not been started: C:\Program Files\FastestVPN\is-NSK8U.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Dropped PE file which has not been started: C:\Program Files\FastestVPN\is-UN9A1.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Dropped PE file which has not been started: C:\Program Files\FastestVPN\Resources\openvpnserv2.exe (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Dropped PE file which has not been started: C:\Program Files\FastestVPN\is-5IUQF.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-8EE2F.tmp\_isetup\_setup64.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Dropped PE file which has not been started: C:\Program Files\FastestVPN\Resources\is-K889R.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Dropped PE file which has not been started: C:\Program Files\FastestVPN\VPN.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Dropped PE file which has not been started: C:\Program Files\FastestVPN\Service\is-63I9E.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Dropped PE file which has not been started: C:\Program Files\FastestVPN\Service\VPN.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Dropped PE file which has not been started: C:\Program Files\FastestVPN\Resources\is-8UK12.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Dropped PE file which has not been started: C:\Program Files\FastestVPN\Resources\tapctl.exe (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Dropped PE file which has not been started: C:\Program Files\FastestVPN\is-UORP7.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Dropped PE file which has not been started: C:\Program Files\FastestVPN\SQLitePCLRaw.provider.dynamic_cdecl.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Dropped PE file which has not been started: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tap0901.sys (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Dropped PE file which has not been started: C:\Program Files\FastestVPN\is-V02LD.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Dropped PE file which has not been started: C:\Program Files\FastestVPN\FastestVPN.Common.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Dropped PE file which has not been started: C:\Program Files\FastestVPN\Resources\is-FO4BS.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Dropped PE file which has not been started: C:\Program Files\FastestVPN\Resources\is-KHPQG.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Dropped PE file which has not been started: C:\Program Files\FastestVPN\Resources\is-BTQQJ.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Dropped PE file which has not been started: C:\Program Files\FastestVPN\is-VTVPL.tmp	Jump to dropped file
Source: C:\Windows\System32\xcopy.exe	Dropped PE file which has not been started: C:\Windows\System32\drivers\fastestvpndriver.sys	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Dropped PE file which has not been started: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\is-6LAFJ.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Dropped PE file which has not been started: C:\Program Files\FastestVPN\is-4EJAE.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Dropped PE file which has not been started: C:\Program Files\FastestVPN\Resources\is-Q7RHP.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Dropped PE file which has not been started: C:\Program Files\FastestVPN\Resources\is-9BMN3.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Dropped PE file which has not been started: C:\Program Files\FastestVPN\Resources\driver\windows\i386\is-PBM2F.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Dropped PE file which has not been started: C:\Program Files\FastestVPN\is-LFVH5.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Dropped PE file which has not been started: C:\Program Files\FastestVPN\Resources\sp\driver\windows7\i386\is-HEM9F.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Dropped PE file which has not been started: C:\Program Files\FastestVPN\is-HC0TS.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Dropped PE file which has not been started: C:\Program Files\FastestVPN\Resources\sp\driver\windows7\amd64\fastestvpndriver.sys (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Dropped PE file which has not been started: C:\Program Files\FastestVPN\Resources\is-J49VG.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Dropped PE file which has not been started: C:\Program Files\FastestVPN\Resources\msvcr100.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Dropped PE file which has not been started: C:\Program Files\FastestVPN\WpfAnimatedGif.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Dropped PE file which has not been started: C:\Program Files\FastestVPN\Service\is-OTL5D.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Dropped PE file which has not been started: C:\Program Files\FastestVPN\Service\VPN.OpenVpn.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Dropped PE file which has not been started: C:\Program Files\FastestVPN\Resources\driver\windows\i386\tapinstall.exe (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Dropped PE file which has not been started: C:\Program Files\FastestVPN\Resources\libeay32.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Dropped PE file which has not been started: C:\Program Files\FastestVPN\Resources\libcrypto-1_1-x64.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Dropped PE file which has not been started: C:\Program Files\FastestVPN\Resources\is-OJSLF.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Dropped PE file which has not been started: C:\Program Files\FastestVPN\Service\Microsoft.Owin.Host.HttpListener.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Dropped PE file which has not been started: C:\Program Files\FastestVPN\Resources\libpkcs11-helper-1.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Dropped PE file which has not been started: C:\Program Files\FastestVPN\Microsoft.Extensions.DependencyInjection.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Dropped PE file which has not been started: C:\Program Files\FastestVPN\Service\FastestVPN.Common.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Dropped PE file which has not been started: C:\Program Files\FastestVPN\is-446MI.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Dropped PE file which has not been started: C:\Program Files\FastestVPN\Service\is-NF2G1.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Dropped PE file which has not been started: C:\Program Files\FastestVPN\Resources\is-9HBCL.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Dropped PE file which has not been started: C:\Program Files\FastestVPN\is-K9S0M.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Dropped PE file which has not been started: C:\Program Files\FastestVPN\Service\is-GL2TH.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Dropped PE file which has not been started: C:\Program Files\FastestVPN\Resources\tapinstallWin32.exe (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Dropped PE file which has not been started: C:\Program Files\FastestVPN\is-5L7N2.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Dropped PE file which has not been started: C:\Program Files\FastestVPN\Resources\is-BERNA.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Dropped PE file which has not been started: C:\Program Files\FastestVPN\Resources\driver\windows\amd64\is-9NM46.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Dropped PE file which has not been started: C:\Program Files\FastestVPN\is-IPA77.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Dropped PE file which has not been started: C:\Program Files\FastestVPN\FastestVPN.Diagnostics.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Dropped PE file which has not been started: C:\Program Files\FastestVPN\is-5TM82.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Dropped PE file which has not been started: C:\Program Files\FastestVPN\Resources\is-JF6RJ.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Dropped PE file which has not been started: C:\Program Files\FastestVPN\Resources\is-SADIQ.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Dropped PE file which has not been started: C:\Program Files\FastestVPN\Resources\sp\release\is-QPO3E.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Dropped PE file which has not been started: C:\Program Files\FastestVPN\Resources\sp\driver\windows8\i386\is-PE3HT.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Dropped PE file which has not been started: C:\Program Files\FastestVPN\System.Numerics.Vectors.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Dropped PE file which has not been started: C:\Program Files\FastestVPN\Service\is-2RVHB.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Dropped PE file which has not been started: C:\Program Files\FastestVPN\is-2448N.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Dropped PE file which has not been started: C:\Program Files\FastestVPN\is-PTLVI.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Dropped PE file which has not been started: C:\Program Files\FastestVPN\is-AHK7Q.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Dropped PE file which has not been started: C:\Program Files\FastestVPN\Service\VPN.WireGuard.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Dropped PE file which has not been started: C:\Program Files\FastestVPN\Resources\is-UCO86.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Dropped PE file which has not been started: C:\Program Files\FastestVPN\Service\is-SQ7U6.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Dropped PE file which has not been started: C:\Program Files\FastestVPN\System.Runtime.CompilerServices.Unsafe.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Dropped PE file which has not been started: C:\Program Files\FastestVPN\Resources\sp\driver\windows7\i386\fastestvpndriver.sys (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Dropped PE file which has not been started: C:\Program Files\FastestVPN\is-05ABD.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Dropped PE file which has not been started: C:\Program Files\FastestVPN\FastestVPN.DI.dll (copy)	Jump to dropped file

Found large amount of non-executed APIs

Source: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exe	API coverage: 5.8 %
Source: C:\Program Files\FastestVPN\Resources\sp\release\nfregdrv.exe	API coverage: 3.4 %

May sleep (evasive loops) to hinder dynamic analysis

Source: C:\Program Files\FastestVPN\FastestVPN.exe TID: 4952	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Program Files\FastestVPN\FastestVPN.exe TID: 1680	Thread sleep time: -30000s >= -30000s
Source: C:\Program Files\FastestVPN\FastestVPN.exe TID: 6108	Thread sleep time: -9223372036854770s >= -30000s
Source: C:\Program Files\FastestVPN\FastestVPN.exe TID: 6108	Thread sleep time: -100000s >= -30000s
Source: C:\Program Files\FastestVPN\FastestVPN.exe TID: 6108	Thread sleep time: -99889s >= -30000s
Source: C:\Program Files\FastestVPN\FastestVPN.exe TID: 6108	Thread sleep time: -99781s >= -30000s
Source: C:\Program Files\FastestVPN\FastestVPN.exe TID: 6108	Thread sleep time: -99665s >= -30000s
Source: C:\Program Files\FastestVPN\FastestVPN.exe TID: 6108	Thread sleep time: -99555s >= -30000s
Source: C:\Program Files\FastestVPN\FastestVPN.exe TID: 6108	Thread sleep time: -99450s >= -30000s
Source: C:\Program Files\FastestVPN\FastestVPN.exe TID: 6108	Thread sleep time: -99296s >= -30000s
Source: C:\Program Files\FastestVPN\FastestVPN.exe TID: 6108	Thread sleep time: -99175s >= -30000s
Source: C:\Program Files\FastestVPN\FastestVPN.exe TID: 6108	Thread sleep time: -98983s >= -30000s
Source: C:\Program Files\FastestVPN\FastestVPN.exe TID: 6108	Thread sleep time: -98873s >= -30000s
Source: C:\Program Files\FastestVPN\FastestVPN.exe TID: 6108	Thread sleep time: -98760s >= -30000s
Source: C:\Program Files\FastestVPN\FastestVPN.exe TID: 6108	Thread sleep time: -98655s >= -30000s
Source: C:\Program Files\FastestVPN\FastestVPN.exe TID: 6108	Thread sleep time: -98538s >= -30000s
Source: C:\Program Files\FastestVPN\FastestVPN.exe TID: 6108	Thread sleep time: -98423s >= -30000s
Source: C:\Program Files\FastestVPN\FastestVPN.exe TID: 6108	Thread sleep time: -98299s >= -30000s
Source: C:\Program Files\FastestVPN\FastestVPN.exe TID: 6108	Thread sleep time: -98134s >= -30000s
Source: C:\Program Files\FastestVPN\FastestVPN.exe TID: 6108	Thread sleep time: -98030s >= -30000s
Source: C:\Program Files\FastestVPN\FastestVPN.exe TID: 6108	Thread sleep time: -97917s >= -30000s
Source: C:\Program Files\FastestVPN\FastestVPN.exe TID: 6108	Thread sleep time: -97813s >= -30000s
Source: C:\Program Files\FastestVPN\FastestVPN.exe TID: 6108	Thread sleep time: -97696s >= -30000s
Source: C:\Program Files\FastestVPN\FastestVPN.exe TID: 6108	Thread sleep time: -97582s >= -30000s
Source: C:\Program Files\FastestVPN\FastestVPN.exe TID: 6108	Thread sleep time: -97409s >= -30000s
Source: C:\Program Files\FastestVPN\FastestVPN.exe TID: 6108	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 1440	Thread sleep count: 2642 > 30
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 3224	Thread sleep count: 1589 > 30
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 2352	Thread sleep time: -3689348814741908s >= -30000s
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 3160	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 5600	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\System32\svchost.exe TID: 4708	Thread sleep time: -30000s >= -30000s
Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe TID: 6220	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe TID: 6308	Thread sleep count: 533 > 30
Source: C:\Program Files\FastestVPN\Resources\ComDebug.exe TID: 6696	Thread sleep time: -180000s >= -30000s
Source: C:\Program Files\FastestVPN\FastestVPN.exe TID: 3500	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Program Files\FastestVPN\FastestVPN.exe TID: 5648	Thread sleep time: -922337203685477s >= -30000s

Queries disk information (often used to detect virtual machines)

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Queries sensitive Operating System Information (via WMI, Win32_ComputerSystem, often done to detect virtual machines)

Source: C:\Program Files\FastestVPN\FastestVPN.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_ComputerSystem
Source: C:\Program Files\FastestVPN\FastestVPN.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_ComputerSystem
Source: C:\Program Files\FastestVPN\FastestVPN.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_ComputerSystem
Source: C:\Program Files\FastestVPN\FastestVPN.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_ComputerSystem
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from Win32_ComputerSystemProduct

Sample execution stops while process was sleeping (likely an evasion)

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exe	Code function: 10_2_00007FF70AA1ECAC FindFirstFileExW,FindNextFileW,FindClose,	10_2_00007FF70AA1ECAC
Source: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exe	Code function: 10_2_00007FF70AA1E0B0 _invalid_parameter_noinfo,_invalid_parameter_noinfo,FindFirstFileExW,FindNextFileW,FindClose,FindClose,FindClose,	10_2_00007FF70AA1E0B0
Source: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exe	Code function: 10_2_00007FF70AA1E810 FindFirstFileExW,	10_2_00007FF70AA1E810
Source: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exe	Code function: 10_2_00007FF70AA1E0B0 _invalid_parameter_noinfo,_invalid_parameter_noinfo,FindFirstFileExW,FindNextFileW,FindClose,FindClose,FindClose,	10_2_00007FF70AA1E0B0
Source: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exe	Code function: 10_2_00007FF70A9E3630 GetWindowsDirectoryW,FindFirstFileW,FindNextFileW,FindClose,	10_2_00007FF70A9E3630
Source: C:\Program Files\FastestVPN\subinacl.exe	Code function: 43_2_0103172D __EH_prolog,#540,#922,#858,#800,#2910,wcslen,#2910,wcslen,#823,GetLastError,_CxxThrowException,#2910,#2910,swprintf,FindFirstFileW,GetLastError,#825,#2910,FindFirstFileW,wcscmp,wcscmp,wcscmp,#535,#942,#942,#535,#942,#942,#800,FindNextFileW,FindClose,#800,	43_2_0103172D
Source: C:\Program Files\FastestVPN\subinacl.exe	Code function: 43_2_01031DDF __EH_prolog,#540,#925,#858,#800,#2910,wcslen,wcslen,#2910,wcslen,#823,GetLastError,_CxxThrowException,#2910,#2910,swprintf,FindFirstFileW,GetLastError,#825,#2910,FindFirstFileW,wcscmp,wcscmp,#540,#538,#922,#925,#858,#800,#800,#800,#925,#800,#858,#800,FindNextFileW,FindClose,#800,	43_2_01031DDF

Source: C:\Program Files\FastestVPN\Resources\sp\release\nfregdrv.exe

Code function: 25_2_100163B0 GetLogicalDriveStringsW,QueryDosDeviceW,GetDriveTypeW,EnterCriticalSection,LeaveCriticalSection,

25_2_100163B0

Source: C:\Program Files\FastestVPN\Resources\sp\release\nfregdrv.exe

Code function: 25_2_100013F0 ResetEvent,GetSystemInfo,

25_2_100013F0

Source: C:\Program Files\FastestVPN\FastestVPN.exe	Thread delayed: delay time: 922337203685477
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Thread delayed: delay time: 922337203685477
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Thread delayed: delay time: 100000
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Thread delayed: delay time: 99889
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Thread delayed: delay time: 99781
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Thread delayed: delay time: 99665
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Thread delayed: delay time: 99555
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Thread delayed: delay time: 99450
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Thread delayed: delay time: 99296
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Thread delayed: delay time: 99175
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Thread delayed: delay time: 98983
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Thread delayed: delay time: 98873
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Thread delayed: delay time: 98760
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Thread delayed: delay time: 98655
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Thread delayed: delay time: 98538
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Thread delayed: delay time: 98423
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Thread delayed: delay time: 98299
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Thread delayed: delay time: 98134
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Thread delayed: delay time: 98030
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Thread delayed: delay time: 97917
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Thread delayed: delay time: 97813
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Thread delayed: delay time: 97696
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Thread delayed: delay time: 97582
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Thread delayed: delay time: 97409
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe	Thread delayed: delay time: 922337203685477
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Thread delayed: delay time: 922337203685477
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Thread delayed: delay time: 922337203685477

Source: C:\Windows\System32\cmd.exe	File opened: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	File opened: C:\Program Files\FastestVPN\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	File opened: C:\Program Files\FastestVPN\Resources\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	File opened: C:\Program Files\FastestVPN\Resources\driver\windows10\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	File opened: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64	Jump to behavior
Source: C:\Windows\System32\cmd.exe	File opened: C:\Program Files\FastestVPN\Resources\driver\	Jump to behavior

Source: ComDebug.exe, 00000030.00000002.2672367606.00007FF8A80B8000.00000002.00000001.01000000.00000048.sdmp	Binary or memory string: (IsLinux() && isVMWare) \|\| (IsAndroid() && isNvidia) \|\| (IsAndroid() && GetAndroidSdkLevel() < 27 && IsAdreno5xxOrOlder(functions)) \|\| (!isMesa && IsMaliT8xxOrOlder(functions)) \|\| (!isMesa && IsMaliG31OrOlder(functions))
Source: ComDebug.exe, 00000030.00000002.2672367606.00007FF8A80B8000.00000002.00000001.01000000.00000048.sdmp	Binary or memory string: VMware
Source: Launcher.exe, 00000035.00000002.2857488192.0000000002774000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: http://www.vmware.com/0
Source: powershell.exe, 00000023.00000002.2503961408.0000000007BEC000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMware, Inc.
Source: svchost.exe, 0000000F.00000003.2383709965.000001885FB1D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: &@vmnetextension
Source: powershell.exe, 00000023.00000002.2503961408.0000000007BEC000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: stringComputer System ProductComputer System ProductAPPD4C2ED92742-89DC-DD72-92E8-869FA5A66493VMware, Inc.None3
Source: Launcher.exe, 00000035.00000002.2857488192.0000000002774000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: VMware, Inc.1!0
Source: svchost.exe, 00000021.00000003.2485264687.000001975150D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: NXTcpV6VMWare
Source: svchost.exe, 00000021.00000002.3301375524.00000197506D3000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000021.00000003.2448782040.00000197506DB000.00000004.00000020.00020000.00000000.sdmp, FastestVPN.exe, 00000022.00000002.3298315092.0000000001003000.00000004.00000020.00020000.00000000.sdmp, FastestVPN.exe, 00000022.00000002.3344745212.000000000B5B6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000026.00000002.3301534007.000001A803E2B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000026.00000002.3304511993.000001A809454000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: Launcher.exe, 00000035.00000002.2857488192.0000000002774000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: http://www.vmware.com/0/
Source: Launcher.exe, 00000035.00000002.2857488192.0000000002774000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: VMware, Inc.1
Source: Launcher.exe, 00000035.00000002.2857488192.0000000002774000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: VMware, Inc.0
Source: powershell.exe, 00000023.00000002.2503961408.0000000007BEC000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll#
Source: FastestVPN.WindowsService.exe, 0000002F.00000002.3298560141.000000000116F000.00000004.00000020.00020000.00000000.sdmp, netsh.exe, 00000032.00000002.2824601095.0000000000AD8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: ComDebug.exe, 00000030.00000002.2672367606.00007FF8A80B8000.00000002.00000001.01000000.00000048.sdmp	Binary or memory string: zJVSk/BwJVmcIGfE7vmLV2H0knZ9P4SNVbfo5azV8fUZVqZa+5Acr5Pr5RzUZ5dd
Source: Launcher.exe, 00000035.00000002.2857488192.0000000002774000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: noreply@vmware.com0
Source: svchost.exe, 0000000F.00000003.2383709965.000001885FB1D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: (@vmnetextension
Source: powershell.exe, 00000023.00000002.2503961408.0000000007BEC000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: stringComputer System ProductComputer System ProductAPPD4C2ED92742-89DC-DD72-92E8-869FA5A66493VMware, Inc.Noney*
Source: FastestVPN.exe, 00000034.00000002.2685362791.0000000000959000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll4
Source: svchost.exe, 0000000F.00000003.2384910165.000001885FB17000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: @ethernetwlanppipvmnetextension4E}
Source: ComDebug.exe, 00000030.00000002.2672367606.00007FF8A80B8000.00000002.00000001.01000000.00000048.sdmp	Binary or memory string: IIBroadcomGoogleMesaMicrosoftSamsung Electronics Co., Ltd.VivanteVMwareVirtIOTest
Source: powershell.exe, 00000023.00000002.2503961408.0000000007BEC000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: stem ProductAPPD4C2ED92742-89DC-DD72-92E8-869FA5A66493VMware, Inc.Noney*
Source: svchost.exe, 0000000F.00000003.2384538883.000001885FB38000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: @vmnetextension
Source: svchost.exe, 00000021.00000003.2570948235.000001975063E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000021.00000002.3300551301.000001975063E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW`nP

Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Checks if the current process is being debugged

Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe	Process queried: DebugPort
Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\Launcher.exe	Process queried: DebugPort

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Source: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exe

Code function: 10_2_00007FF70AA16788 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

10_2_00007FF70AA16788

Contains functionality to dynamically determine API calls

Source: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exe

10_2_00007FF70A9E6C90

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Source: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exe

Code function: 10_2_00007FF70AA257E0 GetProcessHeap,

10_2_00007FF70AA257E0

Enables debug privileges

Source: C:\Program Files\FastestVPN\subinacl.exe

Process token adjusted: Debug

Source: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exe	Code function: 10_2_00007FF70A9E8738 SetUnhandledExceptionFilter,	10_2_00007FF70A9E8738
Source: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exe	Code function: 10_2_00007FF70AA16788 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	10_2_00007FF70AA16788
Source: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exe	Code function: 10_2_00007FF70A9E8550 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	10_2_00007FF70A9E8550
Source: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exe	Code function: 10_2_00007FF70A9E7B18 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	10_2_00007FF70A9E7B18
Source: C:\Program Files\FastestVPN\Resources\sp\release\nfregdrv.exe	Code function: 25_2_004054F3 _raise,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	25_2_004054F3
Source: C:\Program Files\FastestVPN\Resources\sp\release\nfregdrv.exe	Code function: 25_2_0040148B SetUnhandledExceptionFilter,	25_2_0040148B
Source: C:\Program Files\FastestVPN\Resources\sp\release\nfregdrv.exe	Code function: 25_2_0040134A IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	25_2_0040134A
Source: C:\Program Files\FastestVPN\Resources\sp\release\nfregdrv.exe	Code function: 25_2_00402D4D IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	25_2_00402D4D
Source: C:\Program Files\FastestVPN\Resources\sp\release\nfregdrv.exe	Code function: 25_2_100081EF _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	25_2_100081EF
Source: C:\Program Files\FastestVPN\Resources\sp\release\nfregdrv.exe	Code function: 25_2_1000B228 _raise,_memset,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	25_2_1000B228
Source: C:\Program Files\FastestVPN\Resources\sp\release\nfregdrv.exe	Code function: 25_2_10007CCF IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	25_2_10007CCF
Source: C:\Program Files\FastestVPN\subinacl.exe	Code function: 43_2_0103DEE7 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	43_2_0103DEE7

Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe

Memory allocated: page read and write | page guard

HIPS / PFW / Operating System Protection Evasion

Found direct / indirect Syscall (likely to bypass EDR)

Source: C:\Program Files\FastestVPN\Resources\ComDebug.exe	NtProtectVirtualMemory: Direct from: 0x100000
Source: C:\Users\user\AppData\Local\Temp\Launcher.exe	NtQuerySystemInformation: Direct from: 0x272B020
Source: C:\Program Files\FastestVPN\Resources\ComDebug.exe	NtCreateNamedPipeFile: Direct from: 0x7FF8C88ED570
Source: C:\Users\user\AppData\Local\Temp\Launcher.exe	NtCreateFile: Direct from: 0x3A4E59
Source: C:\Users\user\AppData\Local\Temp\Launcher.exe	NtCreateMutant: Direct from: 0x3A530F
Source: C:\Program Files\FastestVPN\Resources\ComDebug.exe	NtAllocateVirtualMemory: Direct from: 0x25FA1E01860
Source: C:\Program Files\FastestVPN\Resources\ComDebug.exe	NtProtectVirtualMemory: Direct from: 0x7FF8C88A26A1
Source: C:\Program Files\FastestVPN\Resources\ComDebug.exe	NtAllocateVirtualMemory: Direct from: 0x7FF810010011
Source: C:\Program Files\FastestVPN\Resources\ComDebug.exe	NtProtectVirtualMemory: Direct from: 0x7FF8C6F50000
Source: C:\Program Files\FastestVPN\Resources\ComDebug.exe	NtCreateFile: Direct from: 0x7FF8C7A18E1C
Source: C:\Program Files\FastestVPN\Resources\ComDebug.exe	NtQueryValueKey: Direct from: 0x7FF800000061
Source: C:\Users\user\AppData\Local\Temp\Launcher.exe	NtAllocateVirtualMemory: Direct from: 0x3A5D8C
Source: C:\Program Files\FastestVPN\Resources\ComDebug.exe	NtAllocateVirtualMemory: Direct from: 0x7FF8C7A135E7
Source: C:\Program Files\FastestVPN\Resources\ComDebug.exe	NtReadFile: Direct from: 0x7FF8C7A185FB
Source: C:\Program Files\FastestVPN\Resources\ComDebug.exe	NtQueryAttributesFile: Direct from: 0x7FF8C7A1540E
Source: C:\Users\user\AppData\Local\Temp\Launcher.exe	NtQuerySystemInformation: Direct from: 0x76EE7B2E
Source: C:\Program Files\FastestVPN\Resources\ComDebug.exe	NtQuerySystemInformation: Direct from: 0xC82BF6DE59
Source: C:\Program Files\FastestVPN\Resources\ComDebug.exe	NtProtectVirtualMemory: Direct from: 0x25FA1E026CC
Source: C:\Program Files\FastestVPN\Resources\ComDebug.exe	NtClose: Direct from: 0x7FF8C7A18E74
Source: C:\Program Files\FastestVPN\Resources\ComDebug.exe	NtWriteFile: Direct from: 0x7FF8C7A18E52
Source: C:\Program Files\FastestVPN\Resources\ComDebug.exe	NtCreateFile: Direct from: 0x7FF8C7A185AD
Source: C:\Program Files\FastestVPN\Resources\ComDebug.exe	NtCreateFile: Direct from: 0xC82BF6DDE8
Source: C:\Program Files\FastestVPN\Resources\ComDebug.exe	NtQuerySystemInformation: Direct from: 0x25F00000000
Source: C:\Program Files\FastestVPN\Resources\ComDebug.exe	NtProtectVirtualMemory: Direct from: 0x7FF8C6F74B60

LummaC encrypted strings found

Source: netsh.exe, 00000032.00000002.2825340131.00000000047B0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: benchillppwo.shop
Source: netsh.exe, 00000032.00000002.2825340131.00000000047B0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: publicitttyps.shop
Source: netsh.exe, 00000032.00000002.2825340131.00000000047B0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: answerrsdo.shop
Source: netsh.exe, 00000032.00000002.2825340131.00000000047B0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: radiationnopp.shop
Source: netsh.exe, 00000032.00000002.2825340131.00000000047B0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: affecthorsedpo.shop
Source: netsh.exe, 00000032.00000002.2825340131.00000000047B0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: bargainnykwo.shop
Source: netsh.exe, 00000032.00000002.2825340131.00000000047B0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: bannngwko.shop
Source: netsh.exe, 00000032.00000002.2825340131.00000000047B0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: bouncedgowp.shop
Source: netsh.exe, 00000032.00000002.2825340131.00000000047B0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: scatterdshsadyi.shop

Maps a DLL or memory area into another process

Source: C:\Program Files\FastestVPN\Resources\ComDebug.exe

Section loaded: NULL target: C:\Windows\SysWOW64\netsh.exe protection: read write

Writes to foreign memory regions

Source: C:\Windows\SysWOW64\netsh.exe	Memory written: C:\Users\user\AppData\Local\Temp\Launcher.exe base: 3A2178
Source: C:\Windows\SysWOW64\netsh.exe	Memory written: C:\Users\user\AppData\Local\Temp\Launcher.exe base: 531008
Source: C:\Windows\SysWOW64\netsh.exe	Memory written: C:\Users\user\AppData\Local\Temp\Launcher.exe base: 790000

Contains functionality to execute programs as a different user

Source: C:\Program Files\FastestVPN\subinacl.exe

Code function: 43_2_010383F6 __EH_prolog,#540,#538,#540,#540,#538,#2910,#861,#4197,#2755,#2910,#800,#800,#800,#800,#800,#2910,#2910,#2910,#2910,#2910,#2910,#2910,#2910,#2910,#2910,#2910,#4124,#858,#800,#2910,#2910,#2910,#2755,#4272,#858,#800,#4197,#6563,#2910,#2755,#4272,#858,#800,#4197,#6563,#2910,#2755,#4272,#858,#800,#2910,#2910,#2910,#2910,#2910,#2910,#2910,#2756,#2910,swscanf,#2910,#2910,#2910,#2910,#2755,#4272,#858,#800,#825,#4199,#2910,ConvertStringSecurityDescriptorToSecurityDescriptorW,GetLastError,GetSecurityDescriptorLength,#823,GetLastError,#2910,#2910,LocalFree,LocalFree,GetLastError,#2910,#2910,#2910,#2755,#4272,#858,#800,#2910,_wtoi,#2910,#2755,#4272,#858,#800,#858,GetLastError,#2910,#2910,#2910,#2910,#2910,#2755,#4272,#858,#800,#6278,#6279,wcscmp,#2910,swscanf,#2910,#2910,#2910,#2910,#2910,#2910,#2910,#2910,#2910,#2910,#2910,#2910,#2755,#4272,#858,#800,#540,#540,#2755,#858,#861,#4272,#858,#800,#4124,#858,#800,#2910,wcscmp,#2910,#2910,LogonUserW,GetLastError,#2910,#2910,#800,#800,#800,#800,#2910,#2755,#4272,#858,#800,#858,#861,#861,GetLastError,#2910,#2910,#2910,#2755,#4272,#858,#800,#2755,#538,#4272,#858,#800,#4124,#858,#800,#2910,#2910,#858,GetLastError,#2910,#2910,#2910,#2755,#4272,#858,#800,#2755,#4272,#4124,#858,#800,#4197,#2910,#2910,#2910,#2910,#2910,#800,#537,#800,GetComputerNameW,#861,#927,#858,#800,#538,#922,#800,#800,#2910,#2910,#2910,#2910,#800,#2910,wcsncpy,#861,#861,#800,#2910,#2910,#2910,#2755,#4272,#858,#800,#2756,#2756,#2756,#2756,#2910,#2755,#4272,#858,#800,#5679,#861,#4273,#858,#800,#858,#941,#2910,#2755,#4272,#858,#800,#538,#925,#800,#2910,#2755,#4272,#858,#800,#2755,#4124,#858,#800,#4272,#858,#800,#2755,#540,#4272,#858,#800,#4124,#858,#800,#2756,#2756,#4124,#858,#800,#2910,#2910,wcscmp,GetComputerNameW,#861,#927,#858,#800,#538,#922,#800,#800,#2910,#2910,#2910,#2910,#2910,#800,#800,GetLastError,#2910,#2910,#2910,wcsncpy,wcsncpy,#2910,wcsncpy,#800,#800,#2755,#4272,#858,#800,#2755,#4124,#858,#800,#4272,#858,#800,#2910,#858,GetLastError,#2910,#2910,#858,GetLastError,#2910,#2910,#2910,#2910,#2910,#2755,#4272,#858,#800,#2755,#858,#861,#4124,#858,#800,#4272,#858,#800,#2910,#2910,#2910,#858,GetLastError,#2910,#2910,#2755,#4124,#858,#800,wcsncpy,#2910,GetLengthSid,GetLengthSid,#2910,#2910,#2910,#2755,#4272,#858,#800,#2756,#4124,#858,#800,#6278,#6279,#4272,#858,#800,GetLastError,#2910,#2910,#2910,swscanf,#2910,GetLengthSid,GetLengthSid,GetLengthSid,#2755,#4272,#858,#800,#858,GetLastError,#2910,#2755,#4272,#858,#800,#858,GetLastError,#2910,

43_2_010383F6

Creates a process in suspended mode (likely to inject code)

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\reg.exe reg Query "HKLM\Hardware\Description\System\CentralProcessor\0"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\find.exe find /i "x86"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c ver	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exe tapinstall.exe remove tap0901	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exe tapinstall.exe install OemVista.inf tap0901	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc stop fastestvpndriver	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\reg.exe reg Query "HKLM\Hardware\Description\System\CentralProcessor\0"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\find.exe find /i "x86"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\reg.exe reg QUERY "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\find.exe find /i "Windows 7"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\xcopy.exe xcopy /y driver\windows8\amd64\fastestvpndriver.sys C:\Windows\system32\drivers	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\FastestVPN\Resources\sp\release\nfregdrv.exe release\nfregdrv.exe -u fastestvpndriver	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\FastestVPN\Resources\sp\release\nfregdrv.exe release\nfregdrv.exe fastestvpndriver	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 6276 -ip 6276
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 6276 -s 1076
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "powershell" -windowstyle hidden get-wmiobject Win32_ComputerSystemProduct \| Select-Object -ExpandProperty UUID
Source: C:\Program Files\FastestVPN\Resources\ComDebug.exe	Process created: C:\Windows\SysWOW64\netsh.exe C:\Windows\SysWOW64\netsh.exe
Source: C:\Windows\SysWOW64\netsh.exe	Process created: C:\Users\user\AppData\Local\Temp\Launcher.exe C:\Users\user\AppData\Local\Temp\Launcher.exe

Source: FastestVPN.exe, FastestVPN.exe, 00000022.00000002.3327281264.00000000060A2000.00000002.00000001.01000000.0000001F.sdmp	Binary or memory string: Shell_TrayWnd
Source: PVUfopbGfc.tmp, 00000001.00000003.2675219520.00000000054B0000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: RegDeleteKeyWRegEnumKeyExWRegEnumValueWRegOpenKeyExWRoundingMode(RtlGetVersionRtlInitStringRtlMoveMemorySelectedCountSetBrushOrgExSetScrollInfoSetWindowLongShellExecuteWShell_TrayWndShutting downStartServiceWStarting%s %sSysFreeStringSysListView32Thread32FirstUnknown stateValueOverflowVirtualUnlockWTSFreeMemoryWireGuard: %sWriteConsoleWbad flushGen bad map statedalTLDpSugct?debugCall2048effect == nilexchange fullfatal error: getTypeInfo: gethostbynamegetservbynameinvalid UTF-8invalid base invalid indexinvalid stylelevel 3 resetload64 failedmin too largenil stackbasenot availableout of memoryparsing time runtime: seq=runtime: val=srmount errortimer expiredtraceStackTabvalue method wglShareListswireguard-%s-wireguard.dllxadd64 failedxchg64 failed}

Language, Device and Operating System Detection

Contains functionality to query CPU information (cpuid)

Source: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exe

Code function: 10_2_00007FF70AA31B20 cpuid

10_2_00007FF70AA31B20

Contains functionality to query locales information (e.g. system language)

Source: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exe	Code function: try_get_function,GetLocaleInfoW,	10_2_00007FF70AA18B44
Source: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exe	Code function: EnumSystemLocalesW,	10_2_00007FF70AA24CB8
Source: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exe	Code function: TranslateName,TranslateName,GetACP,IsValidCodePage,GetLocaleInfoW,	10_2_00007FF70AA24960
Source: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exe	Code function: EnumSystemLocalesW,	10_2_00007FF70AA24E0C
Source: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exe	Code function: EnumSystemLocalesW,	10_2_00007FF70AA24D3C
Source: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,	10_2_00007FF70AA24ED0
Source: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exe	Code function: EnumSystemLocalesW,	10_2_00007FF70AA17BF8
Source: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exe	Code function: EnumSystemLocalesW,	10_2_00007FF70AA17B7C
Source: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exe	Code function: EnumSystemLocalesW,	10_2_00007FF70AA17A70
Source: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exe	Code function: GetLocaleInfoW,	10_2_00007FF70AA2534C
Source: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exe	Code function: EnumSystemLocalesW,GetUserDefaultLCID,ProcessCodePage,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	10_2_00007FF70AA25478
Source: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exe	Code function: GetLocaleInfoW,	10_2_00007FF70AA25120
Source: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	10_2_00007FF70AA25278
Source: C:\Program Files\FastestVPN\Resources\sp\release\nfregdrv.exe	Code function: GetLocaleInfoA,	25_2_00406C2C
Source: C:\Program Files\FastestVPN\Resources\sp\release\nfregdrv.exe	Code function: GetLocaleInfoA,	25_2_10011E31

Queries device information via Setup API

Source: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exe

Code function: 10_2_00007FF70A9E4820 SetupDiGetDeviceRegistryPropertyW,GetLastError,SetupDiGetDeviceRegistryPropertyW,

10_2_00007FF70A9E4820

Queries information about the installed CPU (vendor, model number etc)

Source: C:\Windows\System32\reg.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\System32\reg.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\System32\reg.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\System32\reg.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\System32\reg.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\System32\reg.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\System32\reg.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0
Source: C:\Windows\System32\reg.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0
Source: C:\Windows\System32\reg.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0
Source: C:\Windows\System32\reg.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0
Source: C:\Windows\System32\reg.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0
Source: C:\Windows\System32\reg.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0

Queries the installation date of Windows

Source: C:\Windows\System32\reg.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion InstallDate

Queries the product ID of Windows

Source: C:\Windows\System32\reg.exe	Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion ProductId
Source: C:\Windows\System32\reg.exe	Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion DigitalProductId
Source: C:\Windows\System32\reg.exe	Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion DigitalProductId4

Queries the volume information (name, serial number etc) of a device

Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exe	Queries volume information: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tap0901.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\drvinst.exe	Queries volume information: C:\Windows\System32\DriverStore\Temp\{3501cea1-1def-284d-aeaa-53ba66ad3796}\tap0901.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe	Queries volume information: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe VolumeInformation
Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceProcess\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.ServiceProcess.dll VolumeInformation
Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe	Queries volume information: C:\Program Files\FastestVPN\Service\Microsoft.AspNet.SignalR.Core.dll VolumeInformation
Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe	Queries volume information: C:\Program Files\FastestVPN\Service\VPN.Common.dll VolumeInformation
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Queries volume information: C:\Program Files\FastestVPN\FastestVPN.exe VolumeInformation
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Queries volume information: C:\Program Files\FastestVPN\SingleInstanceApplication.dll VolumeInformation
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Runtime.Remoting\v4.0_4.0.0.0__b77a5c561934e089\System.Runtime.Remoting.dll VolumeInformation
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Queries volume information: C:\Program Files\FastestVPN\FastestVPN.Common.dll VolumeInformation
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Queries volume information: C:\Program Files\FastestVPN\FastestVPN.DI.dll VolumeInformation
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Queries volume information: C:\Program Files\FastestVPN\Microsoft.Extensions.DependencyInjection.Abstractions.dll VolumeInformation
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Queries volume information: C:\Program Files\FastestVPN\Microsoft.Extensions.DependencyInjection.dll VolumeInformation
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Queries volume information: C:\Program Files\FastestVPN\Microsoft.Bcl.AsyncInterfaces.dll VolumeInformation
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Queries volume information: C:\Program Files\FastestVPN\System.Threading.Tasks.Extensions.dll VolumeInformation
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Queries volume information: C:\Program Files\FastestVPN\FastestVPN.ViewModel.dll VolumeInformation
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Queries volume information: C:\Program Files\FastestVPN\VPN.Common.dll VolumeInformation
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Queries volume information: C:\Program Files\FastestVPN\FastestVPN.Diagnostics.dll VolumeInformation
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Queries volume information: C:\Program Files\FastestVPN\FastestVPN.BLL.dll VolumeInformation
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Queries volume information: C:\Program Files\FastestVPN\FastestVPN.Data.Local.dll VolumeInformation
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Queries volume information: C:\Program Files\FastestVPN\FastestVPN.Data.Remote.dll VolumeInformation
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Queries volume information: C:\Program Files\FastestVPN\Hardcodet.NotifyIcon.Wpf.dll VolumeInformation
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Queries volume information: C:\Program Files\FastestVPN\WpfAnimatedGif.dll VolumeInformation
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Queries volume information: C:\Program Files\FastestVPN\Newtonsoft.Json.dll VolumeInformation
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\PresentationFramework-SystemXml\v4.0_4.0.0.0__b77a5c561934e089\PresentationFramework-SystemXml.dll VolumeInformation
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Queries volume information: C:\Windows\Fonts\segoeui.ttf VolumeInformation
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Queries volume information: C:\Windows\Fonts\segoeui.ttf VolumeInformation
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\UIAutomationTypes\v4.0_4.0.0.0__31bf3856ad364e35\UIAutomationTypes.dll VolumeInformation
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\UIAutomationProvider\v4.0_4.0.0.0__31bf3856ad364e35\UIAutomationProvider.dll VolumeInformation
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Queries volume information: C:\Windows\Fonts\segoeui.ttf VolumeInformation
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Queries volume information: C:\Program Files\FastestVPN\Microsoft.AppCenter.dll VolumeInformation
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Queries volume information: C:\Program Files\FastestVPN\Microsoft.AppCenter.Analytics.dll VolumeInformation
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.CSharp\v4.0_4.0.0.0__b03f5f7f11d50a3a\Microsoft.CSharp.dll VolumeInformation
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Dynamic\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Dynamic.dll VolumeInformation
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Queries volume information: C:\Program Files\FastestVPN\SQLitePCLRaw.batteries_v2.dll VolumeInformation
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Queries volume information: C:\Program Files\FastestVPN\SQLitePCLRaw.core.dll VolumeInformation
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Queries volume information: C:\Program Files\FastestVPN\SQLitePCLRaw.provider.dynamic_cdecl.dll VolumeInformation
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\netstandard\v4.0_2.0.0.0__cc7b13ffcd2ddd51\netstandard.dll VolumeInformation
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Queries volume information: C:\Program Files\FastestVPN\System.Memory.dll VolumeInformation
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Runtime.InteropServices.RuntimeInformation\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Runtime.InteropServices.RuntimeInformation.dll VolumeInformation
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ValueTuple\v4.0_4.0.0.0__cc7b13ffcd2ddd51\System.ValueTuple.dll VolumeInformation
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Queries volume information: C:\Program Files\FastestVPN\System.Runtime.CompilerServices.Unsafe.dll VolumeInformation
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Deployment\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Deployment.dll VolumeInformation
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Queries volume information: C:\Program Files\FastestVPN\Flurl.Http.dll VolumeInformation
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Queries volume information: C:\Program Files\FastestVPN\Flurl.dll VolumeInformation
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Queries volume information: C:\Program Files\FastestVPN\BouncyCastle.Crypto.dll VolumeInformation
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Queries volume information: C:\Windows\Fonts\seguisb.ttf VolumeInformation
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Queries volume information: C:\Windows\Fonts\segoeui.ttf VolumeInformation
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Queries volume information: C:\Windows\Fonts\seguisb.ttf VolumeInformation
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Queries volume information: C:\Windows\Fonts\segoeui.ttf VolumeInformation
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Queries volume information: C:\Windows\Fonts\seguisb.ttf VolumeInformation
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Web\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Web.dll VolumeInformation
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Queries volume information: C:\Windows\Fonts\segoeui.ttf VolumeInformation
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Queries volume information: C:\Windows\Fonts\seguisb.ttf VolumeInformation
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Queries volume information: C:\Windows\Fonts\seguisb.ttf VolumeInformation
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Queries volume information: C:\Windows\Fonts\segoeui.ttf VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceProcess\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.ServiceProcess.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe	Queries volume information: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe VolumeInformation
Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceProcess\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.ServiceProcess.dll VolumeInformation
Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe	Queries volume information: C:\Program Files\FastestVPN\Service\Microsoft.AspNet.SignalR.Core.dll VolumeInformation
Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe	Queries volume information: C:\Program Files\FastestVPN\Service\VPN.Common.dll VolumeInformation
Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\SMDiagnostics\v4.0_4.0.0.0__b77a5c561934e089\SMDiagnostics.dll VolumeInformation
Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel.Internals\v4.0_4.0.0.0__31bf3856ad364e35\System.ServiceModel.Internals.dll VolumeInformation
Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe	Queries volume information: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe VolumeInformation
Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceProcess\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.ServiceProcess.dll VolumeInformation
Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe	Queries volume information: C:\Program Files\FastestVPN\Service\FastestVPN.Common.dll VolumeInformation
Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe	Queries volume information: C:\Program Files\FastestVPN\Service\Microsoft.Owin.Hosting.dll VolumeInformation
Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe	Queries volume information: C:\Program Files\FastestVPN\Service\Microsoft.Owin.dll VolumeInformation
Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe	Queries volume information: C:\Program Files\FastestVPN\Service\Owin.dll VolumeInformation
Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe	Queries volume information: C:\Program Files\FastestVPN\Service\Microsoft.Owin.Host.HttpListener.dll VolumeInformation
Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe	Queries volume information: C:\Program Files\FastestVPN\Service\FastestVPN.Common.dll VolumeInformation
Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe	Queries volume information: C:\Program Files\FastestVPN\Service\fix-dns-leak-32.dll VolumeInformation
Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe	Queries volume information: C:\Program Files\FastestVPN\Service\iphelperclose.dll VolumeInformation
Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe	Queries volume information: C:\Program Files\FastestVPN\Service\Microsoft.AspNet.SignalR.Core.dll VolumeInformation
Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe	Queries volume information: C:\Program Files\FastestVPN\Service\Microsoft.Owin.Cors.dll VolumeInformation
Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe	Queries volume information: C:\Program Files\FastestVPN\Service\Microsoft.Owin.Cors.dll VolumeInformation
Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe	Queries volume information: C:\Program Files\FastestVPN\Service\Microsoft.Owin.Diagnostics.dll VolumeInformation
Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe	Queries volume information: C:\Program Files\FastestVPN\Service\Microsoft.Owin.Diagnostics.dll VolumeInformation
Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe	Queries volume information: C:\Program Files\FastestVPN\Service\Microsoft.Owin.dll VolumeInformation
Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe	Queries volume information: C:\Program Files\FastestVPN\Service\Microsoft.Owin.Host.HttpListener.dll VolumeInformation
Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe	Queries volume information: C:\Program Files\FastestVPN\Service\Microsoft.Owin.Hosting.dll VolumeInformation
Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe	Queries volume information: C:\Program Files\FastestVPN\Service\Microsoft.Owin.Security.dll VolumeInformation
Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe	Queries volume information: C:\Program Files\FastestVPN\Service\Newtonsoft.Json.dll VolumeInformation
Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe	Queries volume information: C:\Program Files\FastestVPN\Service\Newtonsoft.Json.dll VolumeInformation
Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe	Queries volume information: C:\Program Files\FastestVPN\Service\Owin.dll VolumeInformation
Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe	Queries volume information: C:\Program Files\FastestVPN\Service\System.Web.Cors.dll VolumeInformation
Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe	Queries volume information: C:\Program Files\FastestVPN\Service\VPN.AdvancedNetwork.dll VolumeInformation
Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe	Queries volume information: C:\Program Files\FastestVPN\Service\VPN.Common.dll VolumeInformation
Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe	Queries volume information: C:\Program Files\FastestVPN\Service\VPN.Common.dll VolumeInformation
Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe	Queries volume information: C:\Program Files\FastestVPN\Service\VPN.dll VolumeInformation
Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe	Queries volume information: C:\Program Files\FastestVPN\Service\VPN.OpenVpn.dll VolumeInformation
Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe	Queries volume information: C:\Program Files\FastestVPN\Service\VPN.OpenVpn.dll VolumeInformation
Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe	Queries volume information: C:\Program Files\FastestVPN\Service\VPN.RAS.dll VolumeInformation
Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe	Queries volume information: C:\Program Files\FastestVPN\Service\VPN.RAS.dll VolumeInformation
Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe	Queries volume information: C:\Program Files\FastestVPN\Service\subinacl.exe VolumeInformation
Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe	Queries volume information: C:\Program Files\FastestVPN\Service\FastestVPN.Common.dll VolumeInformation
Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe	Queries volume information: C:\Program Files\FastestVPN\Service\fix-dns-leak-32.dll VolumeInformation
Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe	Queries volume information: C:\Program Files\FastestVPN\Service\iphelperclose.dll VolumeInformation
Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe	Queries volume information: C:\Program Files\FastestVPN\Service\Microsoft.Owin.Diagnostics.dll VolumeInformation
Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe	Queries volume information: C:\Program Files\FastestVPN\Service\Newtonsoft.Json.dll VolumeInformation
Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe	Queries volume information: C:\Program Files\FastestVPN\Service\VPN.dll VolumeInformation
Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe	Queries volume information: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe VolumeInformation
Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation
Source: C:\Windows\SysWOW64\netsh.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Queries volume information: C:\Program Files\FastestVPN\FastestVPN.exe VolumeInformation
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Queries volume information: C:\Program Files\FastestVPN\SingleInstanceApplication.dll VolumeInformation
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Runtime.Remoting\v4.0_4.0.0.0__b77a5c561934e089\System.Runtime.Remoting.dll VolumeInformation

Source: C:\Program Files\FastestVPN\FastestVPN.exe

Code function: 34_2_02D227C8 CreateNamedPipeA,

34_2_02D227C8

Source: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exe

Code function: 10_2_00007FF70AA18BC8 try_get_function,GetSystemTimeAsFileTime,

10_2_00007FF70AA18BC8

Source: C:\Program Files\FastestVPN\subinacl.exe

Code function: 43_2_0102E7AC __EH_prolog,#540,#2755,#858,#2910,#2910,LookupAccountNameW,#861,#942,#940,#4197,#4197,#800,#2910,#2910,LookupAccountNameW,#858,

43_2_0102E7AC

Source: C:\Program Files\FastestVPN\Resources\sp\release\nfregdrv.exe

Code function: 25_2_00401160 GetStartupInfoA,GetProcessHeap,GetProcessHeap,HeapAlloc,_fast_error_exit,GetVersionExA,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,_fast_error_exit,_fast_error_exit,__RTC_Initialize,__ioinit,__amsg_exit,GetCommandLineA,___crtGetEnvironmentStringsA,__setargv,__amsg_exit,__setenvp,__amsg_exit,__cinit,__amsg_exit,__wincmdln,

25_2_00401160

Source: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Lowering of HIPS / PFW / Operating System Security Settings

Uses netsh to modify the Windows network and firewall settings

Source: C:\Program Files\FastestVPN\Resources\ComDebug.exe

Process created: C:\Windows\SysWOW64\netsh.exe C:\Windows\SysWOW64\netsh.exe

Adds / modifies Windows certificates

Source: C:\Windows\System32\svchost.exe

Registry key created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\8CF427FD790C3AD166068DE81E57EFBB932272D4 Blob

Stealing of Sensitive Information

Yara detected LummaC Stealer

Source: Yara match

File source: decrypted.memstr, type: MEMORYSTR

Modifies the DNS server

Source: C:\Windows\System32\svchost.exe

Registry value created:

Jump to behavior

OS version to string mapping found (often used in BOTs)

Source: FastestVPN.WindowsService.exe, 0000002F.00000002.3308225688.0000000004542000.00000002.00000001.01000000.00000037.sdmp	Binary or memory string: OWIN_SERVER@Microsoft.Owin.Host.HttpListener
Source: FastestVPN.WindowsService.exe, 0000002F.00000002.3308225688.0000000004542000.00000002.00000001.01000000.00000037.sdmp	Binary or memory string: OWIN_SERVERAMicrosoft.Owin.Host.HttpListenerPORT
Source: FastestVPN.WindowsService.exe, 0000002F.00000002.3304056218.0000000001BCC000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OWIN_SERVER
Source: FastestVPN.WindowsService.exe	Binary or memory string: WIN_SERVER

Remote Access Functionality

Yara detected LummaC Stealer

Source: Yara match

File source: decrypted.memstr, type: MEMORYSTR

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Source: C:\Program Files\FastestVPN\Resources\sp\release\nfregdrv.exe	Code function: 25_2_10014170 ?nf_deleteBindingRules@nfapi@@YA?AW4_NF_STATUS@@XZ,EnterCriticalSection,LeaveCriticalSection,DeviceIoControl,LeaveCriticalSection,LeaveCriticalSection,		25_2_10014170
Source: C:\Program Files\FastestVPN\Resources\sp\release\nfregdrv.exe	Code function: 25_2_100141E0 ?nf_addBindingRule@nfapi@@YA?AW4_NF_STATUS@@PAU_NF_BINDING_RULE@1@H@Z,EnterCriticalSection,LeaveCriticalSection,DeviceIoControl,LeaveCriticalSection,LeaveCriticalSection,		25_2_100141E0

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	1 Scripting	1 Valid Accounts	1 Windows Management Instrumentation	1 Scripting	1 Abuse Elevation Control Mechanism	111 Disable or Modify Tools	1 Network Sniffing	1 System Time Discovery	Remote Services	1 Archive Collected Data	11 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	1 LSASS Driver	1 LSASS Driver	11 Deobfuscate/Decode Files or Information	11 Input Capture	1 Account Discovery	Remote Desktop Protocol	11 Input Capture	2 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	13 Command and Scripting Interpreter	11 DLL Side-Loading	11 DLL Side-Loading	1 Abuse Elevation Control Mechanism	Security Account Manager	4 File and Directory Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	13 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	13 Service Execution	1 Valid Accounts	1 Valid Accounts	3 Obfuscated Files or Information	NTDS	1 Network Sniffing	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	2 PowerShell	45 Windows Service	11 Access Token Manipulation	2 Software Packing	LSA Secrets	295 System Information Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	2 Registry Run Keys / Startup Folder	45 Windows Service	1 Timestomp	Cached Domain Credentials	2 Query Registry	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	213 Process Injection	11 DLL Side-Loading	DCSync	351 Security Software Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	2 Registry Run Keys / Startup Folder	1 File Deletion	Proc Filesystem	2 Process Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	43 Masquerading	/etc/passwd and /etc/shadow	61 Virtualization/Sandbox Evasion	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	1 Valid Accounts	Network Sniffing	1 Application Window Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement
Network Security Appliances	Domains	Compromise Software Dependencies and Development Tools	AppleScript	Launchd	Launchd	2 Modify Registry	Input Capture	3 System Owner/User Discovery	Software Deployment Tools	Remote Data Staging	Mail Protocols	Exfiltration Over Unencrypted Non-C2 Protocol	Firmware Corruption
Gather Victim Org Information	DNS Server	Compromise Software Supply Chain	Windows Command Shell	Scheduled Task	Scheduled Task	61 Virtualization/Sandbox Evasion	Keylogging	Process Discovery	Taint Shared Content	Screen Capture	DNS	Exfiltration Over Physical Medium	Resource Hijacking
Determine Physical Locations	Virtual Private Server	Compromise Hardware Supply Chain	Unix Shell	Systemd Timers	Systemd Timers	11 Access Token Manipulation	GUI Input Capture	Permission Groups Discovery	Replication Through Removable Media	Email Collection	Proxy	Exfiltration over USB	Network Denial of Service
Business Relationships	Server	Trusted Relationship	Visual Basic	Container Orchestration Job	Container Orchestration Job	213 Process Injection	Web Portal Capture	Local Groups	Component Object Model and Distributed COM	Local Email Collection	Internal Proxy	Commonly Used Port	Direct Network Flood

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
PVUfopbGfc.exe	21%	ReversingLabs

Dropped Files

Source	Detection	Scanner	Label
C:\Program Files\FastestVPN\BouncyCastle.Crypto.dll (copy)	0%	ReversingLabs
C:\Program Files\FastestVPN\FastestVPN.BLL.dll (copy)	0%	ReversingLabs
C:\Program Files\FastestVPN\FastestVPN.Common.dll (copy)	0%	ReversingLabs
C:\Program Files\FastestVPN\FastestVPN.DI.dll (copy)	0%	ReversingLabs
C:\Program Files\FastestVPN\FastestVPN.Data.Local.dll (copy)	0%	ReversingLabs
C:\Program Files\FastestVPN\FastestVPN.Data.Remote.dll (copy)	0%	ReversingLabs
C:\Program Files\FastestVPN\FastestVPN.Diagnostics.dll (copy)	0%	ReversingLabs
C:\Program Files\FastestVPN\FastestVPN.ViewModel.dll (copy)	0%	ReversingLabs
C:\Program Files\FastestVPN\FastestVPN.exe (copy)	0%	ReversingLabs
C:\Program Files\FastestVPN\Flurl.Http.dll (copy)	0%	ReversingLabs
C:\Program Files\FastestVPN\Flurl.dll (copy)	0%	ReversingLabs
C:\Program Files\FastestVPN\Hardcodet.NotifyIcon.Wpf.dll (copy)	0%	ReversingLabs
C:\Program Files\FastestVPN\Microsoft.AppCenter.Analytics.dll (copy)	0%	ReversingLabs
C:\Program Files\FastestVPN\Microsoft.AppCenter.Crashes.dll (copy)	0%	ReversingLabs
C:\Program Files\FastestVPN\Microsoft.AppCenter.dll (copy)	0%	ReversingLabs
C:\Program Files\FastestVPN\Microsoft.AspNet.SignalR.Client.dll (copy)	0%	ReversingLabs
C:\Program Files\FastestVPN\Microsoft.Bcl.AsyncInterfaces.dll (copy)	0%	ReversingLabs
C:\Program Files\FastestVPN\Microsoft.Extensions.DependencyInjection.Abstractions.dll (copy)	0%	ReversingLabs
C:\Program Files\FastestVPN\Microsoft.Extensions.DependencyInjection.dll (copy)	0%	ReversingLabs
C:\Program Files\FastestVPN\Newtonsoft.Json.dll (copy)	0%	ReversingLabs
C:\Program Files\FastestVPN\Resources\ComDebug.exe (copy)	0%	ReversingLabs
C:\Program Files\FastestVPN\Resources\desktop_drop_plugin.dll (copy)	62%	ReversingLabs	Win64.Downloader.Rugmi
C:\Program Files\FastestVPN\Resources\desktop_multi_window_plugin.dll (copy)	0%	ReversingLabs
C:\Program Files\FastestVPN\Resources\devcon.exe (copy)	0%	ReversingLabs
C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\is-6LAFJ.tmp	0%	ReversingLabs
C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\is-ISUTF.tmp	0%	ReversingLabs
C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tap0901.sys (copy)	0%	ReversingLabs
C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exe (copy)	0%	ReversingLabs
C:\Program Files\FastestVPN\Resources\driver\windows10\i386\is-5P6ME.tmp	0%	ReversingLabs
C:\Program Files\FastestVPN\Resources\driver\windows10\i386\is-GNQS3.tmp	0%	ReversingLabs
C:\Program Files\FastestVPN\Resources\driver\windows10\i386\tap0901.sys (copy)	0%	ReversingLabs
C:\Program Files\FastestVPN\Resources\driver\windows10\i386\tapinstall.exe (copy)	0%	ReversingLabs
C:\Program Files\FastestVPN\Resources\driver\windows\amd64\is-7J76O.tmp	0%	ReversingLabs
C:\Program Files\FastestVPN\Resources\driver\windows\amd64\is-9NM46.tmp	0%	ReversingLabs
C:\Program Files\FastestVPN\Resources\driver\windows\amd64\tap0901.sys (copy)	0%	ReversingLabs
C:\Program Files\FastestVPN\Resources\driver\windows\amd64\tapinstall.exe (copy)	0%	ReversingLabs
C:\Program Files\FastestVPN\Resources\driver\windows\i386\is-PBM2F.tmp	0%	ReversingLabs
C:\Program Files\FastestVPN\Resources\driver\windows\i386\is-QN43A.tmp	0%	ReversingLabs
C:\Program Files\FastestVPN\Resources\driver\windows\i386\tap0901.sys (copy)	0%	ReversingLabs
C:\Program Files\FastestVPN\Resources\driver\windows\i386\tapinstall.exe (copy)	0%	ReversingLabs
C:\Program Files\FastestVPN\Resources\file_selector_windows_plugin.dll (copy)	0%	ReversingLabs
C:\Program Files\FastestVPN\Resources\flutter_custom_cursor_plugin.dll (copy)	0%	ReversingLabs
C:\Program Files\FastestVPN\Resources\flutter_gpu_texture_renderer_plugin.dll (copy)	0%	ReversingLabs
C:\Program Files\FastestVPN\Resources\flutter_windows.dll (copy)	0%	ReversingLabs
C:\Program Files\FastestVPN\Resources\is-1155O.tmp	0%	ReversingLabs
C:\Program Files\FastestVPN\Resources\is-4JUC4.tmp	0%	ReversingLabs
C:\Program Files\FastestVPN\Resources\is-4R4LE.tmp	0%	ReversingLabs
C:\Program Files\FastestVPN\Resources\is-5M6KM.tmp	0%	ReversingLabs
C:\Program Files\FastestVPN\Resources\is-5RDD6.tmp	0%	ReversingLabs
C:\Program Files\FastestVPN\Resources\is-71J6V.tmp	0%	ReversingLabs
C:\Program Files\FastestVPN\Resources\is-71JPL.tmp	0%	ReversingLabs
C:\Program Files\FastestVPN\Resources\is-7L7U1.tmp	0%	ReversingLabs
C:\Program Files\FastestVPN\Resources\is-8UK12.tmp	0%	ReversingLabs
C:\Program Files\FastestVPN\Resources\is-9BMN3.tmp	0%	ReversingLabs
C:\Program Files\FastestVPN\Resources\is-9HBCL.tmp	0%	ReversingLabs
C:\Program Files\FastestVPN\Resources\is-BERNA.tmp	0%	ReversingLabs
C:\Program Files\FastestVPN\Resources\is-BTQQJ.tmp	0%	ReversingLabs
C:\Program Files\FastestVPN\Resources\is-EJ1T1.tmp	0%	ReversingLabs
C:\Program Files\FastestVPN\Resources\is-FO4BS.tmp	0%	ReversingLabs
C:\Program Files\FastestVPN\Resources\is-J49VG.tmp	0%	ReversingLabs
C:\Program Files\FastestVPN\Resources\is-J9ANF.tmp	0%	ReversingLabs
C:\Program Files\FastestVPN\Resources\is-JF6RJ.tmp	62%	ReversingLabs	Win64.Downloader.Rugmi
C:\Program Files\FastestVPN\Resources\is-K889R.tmp	0%	ReversingLabs
C:\Program Files\FastestVPN\Resources\is-KHPQG.tmp	0%	ReversingLabs
C:\Program Files\FastestVPN\Resources\is-MI83V.tmp	0%	ReversingLabs
C:\Program Files\FastestVPN\Resources\is-O5204.tmp	0%	ReversingLabs
C:\Program Files\FastestVPN\Resources\is-OJSLF.tmp	0%	ReversingLabs
C:\Program Files\FastestVPN\Resources\is-Q7RHP.tmp	0%	ReversingLabs
C:\Program Files\FastestVPN\Resources\is-QG142.tmp	0%	ReversingLabs
C:\Program Files\FastestVPN\Resources\is-QLSLT.tmp	0%	ReversingLabs
C:\Program Files\FastestVPN\Resources\is-QN5KA.tmp	0%	ReversingLabs
C:\Program Files\FastestVPN\Resources\is-QOP0D.tmp	0%	ReversingLabs
C:\Program Files\FastestVPN\Resources\is-SADIQ.tmp	0%	ReversingLabs
C:\Program Files\FastestVPN\Resources\is-T7NGU.tmp	0%	ReversingLabs
C:\Program Files\FastestVPN\Resources\is-TSTOA.tmp	0%	ReversingLabs
C:\Program Files\FastestVPN\Resources\is-UCO86.tmp	0%	ReversingLabs
C:\Program Files\FastestVPN\Resources\libcrypto-1_1-x64.dll (copy)	0%	ReversingLabs
C:\Program Files\FastestVPN\Resources\libeay32.dll (copy)	0%	ReversingLabs
C:\Program Files\FastestVPN\Resources\liblzo2-2.dll (copy)	0%	ReversingLabs
C:\Program Files\FastestVPN\Resources\libpkcs11-helper-1.dll (copy)	0%	ReversingLabs
C:\Program Files\FastestVPN\Resources\libssl-1_1-x64.dll (copy)	0%	ReversingLabs
C:\Program Files\FastestVPN\Resources\libssl32.dll (copy)	0%	ReversingLabs
C:\Program Files\FastestVPN\Resources\msvcr100.dll (copy)	0%	ReversingLabs
C:\Program Files\FastestVPN\Resources\openssl.exe (copy)	0%	ReversingLabs
C:\Program Files\FastestVPN\Resources\openvpn.exe (copy)	0%	ReversingLabs
C:\Program Files\FastestVPN\Resources\openvpnserv.exe (copy)	0%	ReversingLabs
C:\Program Files\FastestVPN\Resources\openvpnserv2.exe (copy)	0%	ReversingLabs
C:\Program Files\FastestVPN\Resources\screen_retriever_plugin.dll (copy)	0%	ReversingLabs
C:\Program Files\FastestVPN\Resources\sp\driver\windows7\amd64\fastestvpndriver.sys (copy)	0%	ReversingLabs

Source	Detection	Scanner	Label
https://www.innosetup.com/	0%	URL Reputation	safe
http://ip-api.com/json	0%	URL Reputation	safe
http://crt.sectigo.com/SectigoPublicCodeSigningRootR46.p7c0#	0%	URL Reputation	safe
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/02/trust/Issue	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/02/sc	0%	URL Reputation	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
api.fastestvpn.com	104.22.21.170	true	false		unknown
fp2e7a.wpc.phicdn.net	192.229.221.95	true	false		unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
answerrsdo.shop	true		unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://www.vmware.com/0	ComDebug.exe, 00000030.00000002.2669578005.0000025FA4009000.00000004.00000020.00020000.00000000.sdmp, netsh.exe, 00000032.00000002.2825661828.0000000005235000.00000004.00000800.00020000.00000000.sdmp, Launcher.exe, 00000035.00000002.2857488192.0000000002774000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://schemas.datacontract.org	FastestVPN.WindowsService.exe, 0000002A.00000002.2608877205.00000000027F5000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://anglebug.com/8280enableTranslatedShaderSubstitutionCheck	ComDebug.exe, 00000030.00000002.2672367606.00007FF8A80B8000.00000002.00000001.01000000.00000048.sdmp	false		unknown
http://anglebug.com/4633	ComDebug.exe, 00000030.00000002.2672367606.00007FF8A80B8000.00000002.00000001.01000000.00000048.sdmp	false		unknown
http://crt.sectigo.com/SectigoPublicCodeSigningCAEVR36.crt0#	PVUfopbGfc.tmp, 00000001.00000003.2675219520.00000000054B0000.00000004.00001000.00020000.00000000.sdmp, ComDebug.exe, 00000030.00000003.2658642223.0000025FA3CF1000.00000004.00000020.00020000.00000000.sdmp, ComDebug.exe, 00000030.00000003.2658999518.0000025FA3CF1000.00000004.00000020.00020000.00000000.sdmp, ComDebug.exe, 00000030.00000003.2656545355.0000025FA3CF1000.00000004.00000020.00020000.00000000.sdmp, ComDebug.exe, 00000030.00000003.2656053801.0000025FA3F72000.00000004.00000020.00020000.00000000.sdmp, ComDebug.exe, 00000030.00000003.2655997626.0000025FA3CF2000.00000004.00000020.00020000.00000000.sdmp, ComDebug.exe, 00000030.00000003.2641290540.0000025FA46F0000.00000004.00000001.00020000.00000000.sdmp, is-QN5KA.tmp.1.dr, file_selector_windows_plugin.dll.48.dr, is-QG142.tmp.1.dr, is-1ASBC.tmp.1.dr, is-K889R.tmp.1.dr, is-71J6V.tmp.1.dr	false		unknown
https://anglebug.com/7382	ComDebug.exe, 00000030.00000002.2672367606.00007FF8A80B8000.00000002.00000001.01000000.00000048.sdmp	false		unknown
https://github.com/aspnet/AspNetKatanad	FastestVPN.WindowsService.exe, 0000002F.00000002.3304056218.0000000001BCC000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-	svchost.exe, 00000021.00000003.2542019425.0000019750F76000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://crbug.com/1356053	ComDebug.exe, 00000030.00000002.2672367606.00007FF8A80B8000.00000002.00000001.01000000.00000048.sdmp	false		unknown
http://schemas.datacontract.org/2004/07/System.ServiceProcess	FastestVPN.WindowsService.exe, 0000002A.00000002.2608877205.00000000027F5000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://github.com/dotnet/corefx/tree/7601f4f6225089ff	FastestVPN.exe	false		unknown
https://scripts.sil.org/OFL	FastestVPN.exe, 00000022.00000002.3338344676.0000000009112000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://www.fastestvpn.com/	PVUfopbGfc.exe, 00000000.00000003.2704325303.0000000002316000.00000004.00001000.00020000.00000000.sdmp, PVUfopbGfc.exe, 00000000.00000003.2036701725.0000000002870000.00000004.00001000.00020000.00000000.sdmp, PVUfopbGfc.tmp, 00000001.00000003.2042009552.00000000034D0000.00000004.00001000.00020000.00000000.sdmp	false		unknown
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xs	svchost.exe, 00000021.00000003.2542019425.0000019750F76000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://crbug.com/110263	ComDebug.exe, 00000030.00000002.2672367606.00007FF8A80B8000.00000002.00000001.01000000.00000048.sdmp	false		unknown
https://www.innosetup.com/	PVUfopbGfc.exe, 00000000.00000003.2038232664.000000007FB7B000.00000004.00001000.00020000.00000000.sdmp, PVUfopbGfc.exe, 00000000.00000003.2037873390.0000000002870000.00000004.00001000.00020000.00000000.sdmp, PVUfopbGfc.tmp, 00000001.00000000.2039732775.0000000000401000.00000020.00000001.01000000.00000004.sdmp	false	URL Reputation: safe	unknown
https://login.microsoftonline.com/ppsecure/DeviceDisassociate.srf.	svchost.exe, 00000021.00000002.3300708756.0000019750645000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://anglebug.com/6929	ComDebug.exe, 00000030.00000002.2672367606.00007FF8A80B8000.00000002.00000001.01000000.00000048.sdmp	false		unknown
http://signalr.net/	FastestVPN.WindowsService.exe, FastestVPN.WindowsService.exe, 0000001D.00000002.2584816506.0000000005A92000.00000002.00000001.01000000.0000000E.sdmp	false		unknown
https://in.appcenter.ms./logs?api-version=1.0.0	FastestVPN.exe, 00000022.00000002.3330868755.00000000065B2000.00000002.00000001.01000000.0000002A.sdmp	false		unknown
http://Passport.NET/tb_	svchost.exe, 00000021.00000002.3300907602.0000019750681000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000021.00000002.3303486786.00000197514AD000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://anglebug.com/7246	ComDebug.exe, 00000030.00000002.2672367606.00007FF8A80B8000.00000002.00000001.01000000.00000048.sdmp	false		unknown
https://anglebug.com/7369	ComDebug.exe, 00000030.00000002.2672367606.00007FF8A80B8000.00000002.00000001.01000000.00000048.sdmp	false		unknown
https://anglebug.com/7489	ComDebug.exe, 00000030.00000002.2672367606.00007FF8A80B8000.00000002.00000001.01000000.00000048.sdmp	false		unknown
https://crbug.com/593024	ComDebug.exe, 00000030.00000002.2672367606.00007FF8A80B8000.00000002.00000001.01000000.00000048.sdmp	false		unknown
http://crl.ver)	svchost.exe, 00000021.00000002.3301375524.00000197506D3000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000021.00000003.2448782040.00000197506DB000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000026.00000002.3304311299.000001A809400000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://issuetracker.google.com/161903006	ComDebug.exe, 00000030.00000002.2672367606.00007FF8A80B8000.00000002.00000001.01000000.00000048.sdmp	false		unknown
https://crbug.com/1300575	ComDebug.exe, 00000030.00000002.2672367606.00007FF8A80B8000.00000002.00000001.01000000.00000048.sdmp	false		unknown
https://crbug.com/710443	ComDebug.exe, 00000030.00000002.2672367606.00007FF8A80B8000.00000002.00000001.01000000.00000048.sdmp	false		unknown
https://crbug.com/1060012	ComDebug.exe, 00000030.00000002.2672367606.00007FF8A80B8000.00000002.00000001.01000000.00000048.sdmp	false		unknown
http://anglebug.com/3997	ComDebug.exe, 00000030.00000002.2672367606.00007FF8A80B8000.00000002.00000001.01000000.00000048.sdmp	false		unknown
http://anglebug.com/4722	ComDebug.exe, 00000030.00000002.2672367606.00007FF8A80B8000.00000002.00000001.01000000.00000048.sdmp	false		unknown
http://crbug.com/642605	ComDebug.exe, 00000030.00000002.2672367606.00007FF8A80B8000.00000002.00000001.01000000.00000048.sdmp	false		unknown
https://github.com/hardcodet/wpf-notifyicon	FastestVPN.exe, FastestVPN.exe, 00000022.00000002.3327281264.00000000060A2000.00000002.00000001.01000000.0000001F.sdmp	false		unknown
http://anglebug.com/1452	ComDebug.exe, 00000030.00000002.2672367606.00007FF8A80B8000.00000002.00000001.01000000.00000048.sdmp	false		unknown
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsdes	svchost.exe, 00000021.00000003.2533154446.0000019750F6D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000021.00000003.2533181374.0000019750F77000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000021.00000003.2542019425.0000019750F76000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://login.ecur	svchost.exe, 00000021.00000002.3300708756.0000019750645000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://crl.entrust.net/ts2ca.crl0	PVUfopbGfc.tmp, 00000001.00000002.2700520104.000000000018C000.00000004.00000010.00020000.00000000.sdmp, PVUfopbGfc.tmp, 00000001.00000003.2675219520.00000000054B0000.00000004.00001000.00020000.00000000.sdmp, FastestVPN.WindowsService.exe, 0000002A.00000002.2608775109.0000000000ED0000.00000004.00000020.00020000.00000000.sdmp, FastestVPN.WindowsService.exe, 0000002A.00000002.2606870926.0000000000AB7000.00000004.00000020.00020000.00000000.sdmp, is-O5MTV.tmp.1.dr, is-OTL5D.tmp.1.dr, is-1ASBC.tmp.1.dr, is-K889R.tmp.1.dr, is-21P0F.tmp.1.dr, is-71J6V.tmp.1.dr	false		unknown
https://crbug.com/650547callClearTwiceUsing	ComDebug.exe, 00000030.00000002.2672367606.00007FF8A80B8000.00000002.00000001.01000000.00000048.sdmp	false		unknown
http://crl.entrust.net/g2ca.crl0	PVUfopbGfc.tmp, 00000001.00000002.2700520104.000000000018C000.00000004.00000010.00020000.00000000.sdmp, PVUfopbGfc.tmp, 00000001.00000003.2675219520.00000000054B0000.00000004.00001000.00020000.00000000.sdmp, FastestVPN.WindowsService.exe, 0000002A.00000002.2608775109.0000000000ED0000.00000004.00000020.00020000.00000000.sdmp, is-O5MTV.tmp.1.dr, is-OTL5D.tmp.1.dr, is-1ASBC.tmp.1.dr, is-K889R.tmp.1.dr, is-21P0F.tmp.1.dr, is-71J6V.tmp.1.dr	false		unknown
http://crbug.com/1420130	ComDebug.exe, 00000030.00000002.2672367606.00007FF8A80B8000.00000002.00000001.01000000.00000048.sdmp	false		unknown
http://anglebug.com/3502	ComDebug.exe, 00000030.00000002.2672367606.00007FF8A80B8000.00000002.00000001.01000000.00000048.sdmp	false		unknown
http://anglebug.com/3623	ComDebug.exe, 00000030.00000002.2672367606.00007FF8A80B8000.00000002.00000001.01000000.00000048.sdmp	false		unknown
http://anglebug.com/3625	ComDebug.exe, 00000030.00000002.2672367606.00007FF8A80B8000.00000002.00000001.01000000.00000048.sdmp	false		unknown
https://login.microsoftonline.com/ppsecure/deviceremovecredential.srf	svchost.exe, 00000021.00000002.3300708756.0000019750645000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://anglebug.com/3624	ComDebug.exe, 00000030.00000002.2672367606.00007FF8A80B8000.00000002.00000001.01000000.00000048.sdmp	false		unknown
http://anglebug.com/2894	ComDebug.exe, 00000030.00000002.2672367606.00007FF8A80B8000.00000002.00000001.01000000.00000048.sdmp	false		unknown
http://ip-api.com/json	FastestVPN.exe, FastestVPN.exe, 00000022.00000002.3325390125.0000000005DE2000.00000002.00000001.01000000.0000001E.sdmp	false	URL Reputation: safe	unknown
https://login.microsoftonline.com/ppsecure/DeviceQuery.srf	svchost.exe, 00000021.00000003.2438224753.0000019750F3B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000021.00000002.3300708756.0000019750645000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000021.00000003.2438294098.0000019750F63000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000021.00000003.2438269726.0000019750F40000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://anglebug.com/3862	ComDebug.exe, 00000030.00000002.2672367606.00007FF8A80B8000.00000002.00000001.01000000.00000048.sdmp	false		unknown
https://www.wireguard.com/donations/key	PVUfopbGfc.tmp, 00000001.00000003.2675219520.00000000054B0000.00000004.00001000.00020000.00000000.sdmp	false		unknown
http://schemas.datacontract.org/2004/07/System.ServiceProcessd	FastestVPN.WindowsService.exe, 0000002A.00000002.2608877205.00000000027F5000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://anglebug.com/4836	ComDebug.exe, 00000030.00000002.2672367606.00007FF8A80B8000.00000002.00000001.01000000.00000048.sdmp	false		unknown
https://issuetracker.google.com/issues/166475273	ComDebug.exe, 00000030.00000002.2672367606.00007FF8A80B8000.00000002.00000001.01000000.00000048.sdmp	false		unknown
http://crt.sectigo.com/SectigoPublicCodeSigningRootR46.p7c0#	PVUfopbGfc.tmp, 00000001.00000003.2675219520.00000000054B0000.00000004.00001000.00020000.00000000.sdmp, ComDebug.exe, 00000030.00000002.2669578005.0000025FA4009000.00000004.00000020.00020000.00000000.sdmp, netsh.exe, 00000032.00000002.2825661828.0000000005235000.00000004.00000800.00020000.00000000.sdmp, Launcher.exe, 00000035.00000002.2857488192.0000000002774000.00000004.00000800.00020000.00000000.sdmp, is-1ASBC.tmp.1.dr, is-K889R.tmp.1.dr, is-71J6V.tmp.1.dr	false	URL Reputation: safe	unknown
https://login.microsoftonline.com/ppsecure/DeviceUpdate.srf%	svchost.exe, 00000021.00000002.3300708756.0000019750645000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://anglebug.com/3970	ComDebug.exe, 00000030.00000002.2672367606.00007FF8A80B8000.00000002.00000001.01000000.00000048.sdmp	false		unknown
http://www.w3.o	FastestVPN.WindowsService.exe, 0000002A.00000002.2608877205.00000000027F5000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd	svchost.exe, 00000021.00000003.2542019425.0000019750F76000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000021.00000002.3302496212.0000019750F82000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://signup.live.com/signup.aspx	svchost.exe, 00000021.00000003.2438269726.0000019750F40000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://account.live.com/inlinesignup.aspx?iww=1&id=80601	svchost.exe, 00000021.00000003.2438583076.0000019750F56000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000021.00000003.2438073307.0000019750F52000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://account.live.com/inlinesignup.aspx?iww=1&id=80603	svchost.exe, 00000021.00000003.2438073307.0000019750F52000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://anglebug.com/5901	ComDebug.exe, 00000030.00000002.2672367606.00007FF8A80B8000.00000002.00000001.01000000.00000048.sdmp	false		unknown
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsdAAAAAA	svchost.exe, 00000021.00000003.2501552028.0000019750F29000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://anglebug.com/3965	ComDebug.exe, 00000030.00000002.2672367606.00007FF8A80B8000.00000002.00000001.01000000.00000048.sdmp	false		unknown
https://account.live.com/inlinesignup.aspx?iww=1&id=80605	svchost.exe, 00000021.00000003.2438073307.0000019750F52000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000021.00000003.2438372704.0000019750F2C000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://anglebug.com/7161	ComDebug.exe, 00000030.00000002.2672367606.00007FF8A80B8000.00000002.00000001.01000000.00000048.sdmp	false		unknown
https://account.live.com/inlinesignup.aspx?iww=1&id=80604	svchost.exe, 00000021.00000003.2438073307.0000019750F52000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://github.com/ericsink/SQLitePCL.rawX	FastestVPN.exe, 00000022.00000002.3351200547.000000000BE32000.00000002.00000001.01000000.0000002E.sdmp	false		unknown
https://anglebug.com/7162	ComDebug.exe, 00000030.00000002.2672367606.00007FF8A80B8000.00000002.00000001.01000000.00000048.sdmp	false		unknown
http://anglebug.com/3729	ComDebug.exe, 00000030.00000002.2672367606.00007FF8A80B8000.00000002.00000001.01000000.00000048.sdmp	false		unknown
http://anglebug.com/5906	ComDebug.exe, 00000030.00000002.2672367606.00007FF8A80B8000.00000002.00000001.01000000.00000048.sdmp	false		unknown
http://crbug.com/830046	ComDebug.exe, 00000030.00000002.2672367606.00007FF8A80B8000.00000002.00000001.01000000.00000048.sdmp	false		unknown
http://anglebug.com/2517	ComDebug.exe, 00000030.00000002.2672367606.00007FF8A80B8000.00000002.00000001.01000000.00000048.sdmp	false		unknown
http://anglebug.com/4937	ComDebug.exe, 00000030.00000002.2672367606.00007FF8A80B8000.00000002.00000001.01000000.00000048.sdmp	false		unknown
http://schemas.xmlsoap.org/ws/2005/02/trust/Issuesue1	svchost.exe, 00000021.00000003.2533154446.0000019750F6D000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://fastestvpn.com/faq?device=windows	FastestVPN.exe, FastestVPN.exe, 00000022.00000002.3324911285.0000000005D72000.00000002.00000001.01000000.0000001A.sdmp	false		unknown
https://issuetracker.google.com/166809097	ComDebug.exe, 00000030.00000002.2672367606.00007FF8A80B8000.00000002.00000001.01000000.00000048.sdmp	false		unknown
http://ocsp.digicert.co	ComDebug.exe, 00000030.00000002.2669360248.0000025FA3DB0000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://schemas.xmlsoap.org/ws/2005/02/trust/Issue	svchost.exe, 00000021.00000003.2555530538.00000197506CF000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://github.com/ericsink/SQLitePCL.rawH	FastestVPN.exe, 00000022.00000002.3352299163.000000000C172000.00000002.00000001.01000000.0000002F.sdmp	false		unknown
http://crbug.com/672380	ComDebug.exe, 00000030.00000002.2672367606.00007FF8A80B8000.00000002.00000001.01000000.00000048.sdmp	false		unknown
https://github.com/SignalR/SignalR/tree/7f53f266daf1aad3dabb1b6d7a71d4c1501ec8dc	FastestVPN.WindowsService.exe, FastestVPN.WindowsService.exe, 0000001D.00000002.2584816506.0000000005A92000.00000002.00000001.01000000.0000000E.sdmp	false		unknown
https://g.live.com/odclientsettings/Prod/C:	svchost.exe, 00000026.00000003.2482684273.000001A8092C3000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://crbug.com/941620allowTranslateUniformBlockToStructuredBufferThere	ComDebug.exe, 00000030.00000002.2672367606.00007FF8A80B8000.00000002.00000001.01000000.00000048.sdmp	false		unknown
http://schemas.xmlsoap.org/ws/2005/02/sc	svchost.exe, 00000021.00000002.3302070338.0000019750F13000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000021.00000003.2849011574.0000019750F74000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000021.00000002.3302224787.0000019750F5F000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://anglebug.com/3832	ComDebug.exe, 00000030.00000002.2672367606.00007FF8A80B8000.00000002.00000001.01000000.00000048.sdmp	false		unknown
https://github.com/tmenier/Flurl.git	FastestVPN.exe, FastestVPN.exe, 00000022.00000002.3351506959.000000000BE72000.00000002.00000001.01000000.00000032.sdmp, FastestVPN.exe, 00000022.00000002.3351847731.000000000BE92000.00000002.00000001.01000000.00000033.sdmp	false		unknown
https://crbug.com/811661	ComDebug.exe, 00000030.00000002.2672367606.00007FF8A80B8000.00000002.00000001.01000000.00000048.sdmp	false		unknown
https://github.com/SignalR/SignalR/tree/7f53f266daf1aad3dabb1b6d7a71d4c1501ec8dcd	FastestVPN.WindowsService.exe, 0000002F.00000002.3304056218.0000000001BCC000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://anglebug.com/8172	ComDebug.exe, 00000030.00000002.2672367606.00007FF8A80B8000.00000002.00000001.01000000.00000048.sdmp	false		unknown
https://crbug.com/1091824	ComDebug.exe, 00000030.00000002.2672367606.00007FF8A80B8000.00000002.00000001.01000000.00000048.sdmp	false		unknown
http://anglebug.com/1085	ComDebug.exe, 00000030.00000002.2672367606.00007FF8A80B8000.00000002.00000001.01000000.00000048.sdmp	false		unknown
https://jrsoftware.org/ishelp/index.php?topic=setupcmdlineSetupU	PVUfopbGfc.exe, 00000000.00000000.2036244476.0000000000401000.00000020.00000001.01000000.00000003.sdmp	false		unknown
http://anglebug.com/6651	ComDebug.exe, 00000030.00000002.2672367606.00007FF8A80B8000.00000002.00000001.01000000.00000048.sdmp	false		unknown
https://anglebug.com/4830	ComDebug.exe, 00000030.00000002.2672367606.00007FF8A80B8000.00000002.00000001.01000000.00000048.sdmp	false		unknown
http://anglebug.com/5007disableDrawBuffersIndexedDisable	ComDebug.exe, 00000030.00000002.2672367606.00007FF8A80B8000.00000002.00000001.01000000.00000048.sdmp	false		unknown
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsdP	svchost.exe, 00000021.00000003.2554874023.0000019750F79000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://github.com/dotnet/corefx/tree/c6cf790234e063b855fcdb50f3fb1b3cfac732758	FastestVPN.exe, 00000022.00000002.3352911178.000000000C1E2000.00000002.00000001.01000000.00000030.sdmp	false		unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
104.22.21.170	api.fastestvpn.com	United States		13335	CLOUDFLARENETUS	false

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1524840
Start date and time:	2024-10-03 10:28:07 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 12m 41s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	54
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	PVUfopbGfc.exe renamed because original name is a hash value
Original Sample Name:	402aacbb8dc07d96733eee2292f709d89d65efbe82d55e0dd4b7764cdde287b5.exe
Detection:	MAL
Classification:	mal76.troj.spyw.expl.evad.winEXE@83/372@1/2
EGA Information:	Successful, ratio: 87.5%
HCA Information:	Successful, ratio: 97% Number of executed functions: 209 Number of non-executed functions: 234
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe
Excluded IPs from analysis (whitelisted): 192.229.221.95, 20.190.159.73, 40.126.31.71, 20.190.159.23, 40.126.31.73, 20.190.159.68, 20.190.159.71, 20.190.159.2, 20.190.159.64, 184.28.90.27, 20.189.173.20, 20.42.65.92
Excluded domains from analysis (whitelisted): prdv4a.aadg.msidentity.com, fs.microsoft.com, slscr.update.microsoft.com, www.tm.v4.a.prd.aadg.akadns.net, cacerts.digicert.com, onedsblobprdwus15.westus.cloudapp.azure.com, ctldl.windowsupdate.com, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, login.msa.msidentity.com, fe3cr.delivery.mp.microsoft.com, onedsblobprdeus17.eastus.cloudapp.azure.com, ocsp.digicert.com, ocsps.ssl.com, login.live.com, e16604.g.akamaiedge.net, blobcollector.events.data.trafficmanager.net, umwatson.events.data.microsoft.com, prod.fs.microsoft.com.akadns.net, www.tm.lg.prod.aadmsa.trafficmanager.net
Execution Graph export aborted for target powershell.exe, PID 5836 because it is empty
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.
Report size getting too big, too many NtSetInformationFile calls found.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: PVUfopbGfc.exe

Simulations

Behavior and APIs

Time	Type	Description
04:29:41	API Interceptor	2x Sleep call for process: svchost.exe modified
04:29:42	API Interceptor	4x Sleep call for process: powershell.exe modified
04:29:45	API Interceptor	23x Sleep call for process: FastestVPN.exe modified
04:29:51	API Interceptor	1x Sleep call for process: WerFault.exe modified
04:29:57	API Interceptor	1x Sleep call for process: dllhost.exe modified
04:30:00	API Interceptor	1x Sleep call for process: ComDebug.exe modified
04:30:07	API Interceptor	3x Sleep call for process: netsh.exe modified
10:29:31	Autostart	Run: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\FastestVPN.lnk

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
fp2e7a.wpc.phicdn.net	OqAVRCkQ3T.exe	Get hash	malicious	LummaC	Browse	192.229.221.95
	mapMd1URzq.exe	Get hash	malicious	Unknown	Browse	192.229.221.95
	mnFHs2DuKg.exe	Get hash	malicious	Unknown	Browse	192.229.221.95
	https://email.mg.pmctraining.com/c/eJwkkcuSojAUhp_muJOKJyHAgoXTyMw41lxaa9TepZNwkUvoEER8-i7o3Vf5_tS5qVhRobla6XgTYBCSaMP9VRFHAWWMaKZYqJifqSALMoEkyiiXWvBsVcZaCn-jwmCtA63XQaTFmoVhuNZSURVo5RPCgJEm97pGOivKtmxzT5pmVceFc10PdAuYAqbjOHq5MXmtPWm8oQJMB1sDTT-AJqz9rc_hMPwrt93h9id50qkA5FY6oMnlyEiJ-zFZQtMkT4C8F0ATB8h1byXQL5fmu5cteUx9uGswPcwxM1ipgSaAXKr5y5GfwtqEw05apk_lGF1-zE7M8tL9rZJs_1WwTvb_j-QKyO96lo9bW7n6w07X8_j289urze-_APkgliZnmsdJRNMB-pjWMhN9UZrWWd2qft7J8l6Zyiyw3-TiuJAUnZOFWBgwvZ4fncRoODRdcUW3VU39FJfX5xUj8v49Hd5e_Ns7EqDJysaiLnvTejchK2DkXval66VxtWjVcoZ7jJ8BAAD__0X-oIk	Get hash	malicious	Unknown	Browse	192.229.221.95
	oRdgOQMxjr.exe	Get hash	malicious	RedLine	Browse	192.229.221.95
	https://globalairt.com/arull.php?7104797967704b536932307464507a53744a4c53704a7a4d77727273784c7a7453725374524c7a732f564c3477776474594841413d3dkkirkman@ssc.nsw.gov.au	Get hash	malicious	HTMLPhisher	Browse	192.229.221.95
	v173TV3V11.exe	Get hash	malicious	SmokeLoader	Browse	192.229.221.95
	0k3ibTiMjy.exe	Get hash	malicious	SmokeLoader	Browse	192.229.221.95
	http://www.sunsetsafaris.com.au//home	Get hash	malicious	Unknown	Browse	192.229.221.95
	http://ryo-blog-for-life.com/	Get hash	malicious	Unknown	Browse	192.229.221.95

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	https://fr089029.page.link/jdF1	Get hash	malicious	HTMLPhisher	Browse	104.18.95.41
	tYeFOUhVLd.exe	Get hash	malicious	RedLine	Browse	104.20.3.235
	hH4dbIGfGT.exe	Get hash	malicious	FormBook	Browse	172.67.194.98
	QT2Q1292300924.xla.xlsx	Get hash	malicious	Unknown	Browse	188.114.97.3
	QT2Q1292300924.xla.xlsx	Get hash	malicious	Unknown	Browse	188.114.96.3
	QT2Q1292300924.xla.xlsx	Get hash	malicious	Unknown	Browse	188.114.96.3
	KBGC_1200O000000_98756.docx.doc	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	188.114.96.3
	A&CMetrology_10002099678.xls	Get hash	malicious	Remcos	Browse	188.114.96.3
	Updated New Order.xls	Get hash	malicious	Snake Keylogger	Browse	188.114.96.3
	pl4VFaWQr8.exe	Get hash	malicious	LummaC	Browse	172.67.183.74

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
3b5074b1b5d032e5620f69f9f700ff0e	dNNMgwxY4f.exe	Get hash	malicious	Xehook Stealer	Browse	104.22.21.170
	tYeFOUhVLd.exe	Get hash	malicious	RedLine	Browse	104.22.21.170
	SKMBT_77122012816310TD0128_17311_XLS.vbs	Get hash	malicious	Remcos	Browse	104.22.21.170
	Purchase Order - PO14895.vbs	Get hash	malicious	Remcos	Browse	104.22.21.170
	GeriOdemeBildirimi942.rar.xlxs.pdf.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	104.22.21.170
	justificante de transferencia.vbs	Get hash	malicious	FormBook	Browse	104.22.21.170
	Comprobante.lnk.lnk	Get hash	malicious	Lokibot	Browse	104.22.21.170
	Comprobante.lnk.lnk	Get hash	malicious	Lokibot	Browse	104.22.21.170
	08(2)_00.exe	Get hash	malicious	AgentTesla	Browse	104.22.21.170
	Hesaphareketi-01.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	104.22.21.170

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Program Files\FastestVPN\BouncyCastle.Crypto.dll (copy)	OqAVRCkQ3T.exe	Get hash	malicious	LummaC	Browse
	mapMd1URzq.exe	Get hash	malicious	Unknown	Browse
	mnFHs2DuKg.exe	Get hash	malicious	Unknown	Browse
	External.exe	Get hash	malicious	Ades Stealer, BlackGuard, VEGA Stealer	Browse
	newvideozones.click.ps1	Get hash	malicious	Unknown	Browse
	use_2024_t#U043e_#U043epen.zip	Get hash	malicious	Unknown	Browse
	JetBrains.dotPeek.2024.1.3.web.exe	Get hash	malicious	Unknown	Browse
	JetBrains.dotPeek.2024.1.3.web.exe	Get hash	malicious	Unknown	Browse
	EmbravaConnect.msi	Get hash	malicious	PrivateLoader	Browse

Created / dropped Files

C:\Program Files\FastestVPN\BouncyCastle.Crypto.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	3316968
Entropy (8bit):	6.532906510598102
Encrypted:	false
SSDEEP:	49152:JIBbo0WIgmjljFtXCdRLRBcJd+KaGxHIkMNqzP56O8lZ7qXUqi9Y:6BbBWIgWljGxRB/LLY
MD5:	0CF454B6ED4D9E46BC40306421E4B800
SHA1:	9611AA929D35CBD86B87E40B628F60D5177D2411
SHA-256:	E51721DC0647F4838B1ABC592BD95FD8CB924716E8A64F83D4B947821FA1FA42
SHA-512:	85262F1BC67A89911640F59A759B476B30CA644BD1A1D9CD3213CC8AAE16D7CC6EA689815F19B146DB1D26F7A75772CEB48E71E27940E3686A83EB2CF7E46048
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: OqAVRCkQ3T.exe, Detection: malicious, Browse Filename: mapMd1URzq.exe, Detection: malicious, Browse Filename: mnFHs2DuKg.exe, Detection: malicious, Browse Filename: External.exe, Detection: malicious, Browse Filename: newvideozones.click.ps1, Detection: malicious, Browse Filename: use_2024_t#U043e_#U043epen.zip, Detection: malicious, Browse Filename: JetBrains.dotPeek.2024.1.3.web.exe, Detection: malicious, Browse Filename: JetBrains.dotPeek.2024.1.3.web.exe, Detection: malicious, Browse Filename: EmbravaConnect.msi, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....R............" ..0..r2..........&1.. ....2...... ........................2.....6Q3...@.................................G&1.O.....2..............\|2.. ....2.....X.(.p............................................ ............... ..H............text....p2.. ...r2................. ..`.rsrc.........2......t2.............@..@.reloc........2......z2.............@..B................{&1.....H...........$....................(.....................................V!........s..........~....-(....o....o....o.........~....-.~.........~......( ......0..G.......(!....o"....s.1....s,..%..(.... ....o.....o 0...Zo....t....o8(..(......0..$..........(.....(....o.....(!.......io#...z...(....(!....o"...o....(......0............T....r...p.(O....o$....(......0..I.......sG...sB)..s.(..s.(...(....s6(....,..o%....2...(....sV(....+.....%..ox.....( ...*V.(&.....}......}..

C:\Program Files\FastestVPN\FastestVPN.BLL.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	30888
Entropy (8bit):	6.550270680442998
Encrypted:	false
SSDEEP:	384:RzfFYXOvijvSGpUprWHEvgr0KnB4C7GrhIYiRSk0FP27NBY3Yuv+U:RxyOg9bxr9qaGKYi8K/Y/+U
MD5:	96D7E9527C5D8BDBA798F72B5FD9B94A
SHA1:	C9CE9813C74493084D6E3DDA37C35C8822CA381F
SHA-256:	6942DC9FDBB229D066BA3E1844883B9DA3EAE21F7035FFF2674C3F19C6331B55
SHA-512:	BE88433F513C4D9F58BDDFED57427DEC12BA0490E2D7C79176144732FBB7969956FA55B03E462C50EA3508389B3C29BC5A559F4B6002C6022C93D059C65B5C44
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...f6............" ..0..F...........e... ........... ....................................`..................................e..O....................N..............d..8............................................ ............... ..H............text....E... ...F.................. ..`.rsrc................H..............@..@.reloc...............L..............@..B................be......H.......\4..$0............................................................(......{...."..}......{...."..}....V.(......(......(.....0..7.........(....}.......}.......}......\|......(...+..\|....(......{...."..}......{...."..}......{...."..}......{...."..}......(......(......(......(.......(.....0..?.........(....}3......}4......}5......}2.....\|3.....(...+..\|3...(......0..7.........(....}#......}$......}".....\|#.....(...+..\|#...(....*..0..?.........(....}.......}

C:\Program Files\FastestVPN\FastestVPN.Common.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	70824
Entropy (8bit):	6.23750269831583
Encrypted:	false
SSDEEP:	1536:rMDv5NwVvDK0HBDk4rVHe061i/kObvmaLLJBr+tTe7TK/SB0:UorK0HBDk4rV21HObvm2LJB4eHK/SO
MD5:	0F7D6DEE75C3FBB958529AB6A351CBDF
SHA1:	1CA639AB692ECD972C51C8BF826BF9BF089359FE
SHA-256:	C5B07CBACD0FF045485A0A4CE6FB3CCB330A0623E3EFE347D61DA4E698FDE412
SHA-512:	58F0B5ED44E3290D6C9FB0E624F2A351CD5BB4744A84AC55AC47FB1B087026DE4DBAA6BBC83255EEC51A2BB3ED9A680EF53E8FC7035586B4A74CA68016AE0F5D
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.... F..........." ..0.............J.... ... ....... .......................`...........`.....................................O.... ......................@......D...8............................................ ............... ..H............text...P.... ...................... ..`.rsrc........ ......................@..@.reloc.......@......................@..B................,.......H.......0<................................................................("...^.("......I...%...}....:.(".....}....b.{....%-.&..s#...o$....0..)........{.........(%...t......\|......(...+...3.....0..)........{.........('...t......\|......(...+...3...((.....{...."..}......{...."..}......{...."..}....2.(....s).....{...."..}......{...."..}......{...."..}......((.....{...."..}......{...."..}......{...."..}......{...."..}......((.....{...."..}......{

C:\Program Files\FastestVPN\FastestVPN.DI.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	19112
Entropy (8bit):	6.821071301483957
Encrypted:	false
SSDEEP:	384:LVVVVVwhr+vtlzIYilpm0FP27NBY3Yuv+Z:LVVVVVwhKvtl8YijnK/Y/+Z
MD5:	64E2269D156CA2AA5704E2E0908506F9
SHA1:	0F7D6EECE52D8A9A91E389736BE1092739AA3014
SHA-256:	B012720952E3FE9CB303E9EDB4314F924CB388D9C24FB63A968A3479113B665D
SHA-512:	C845E7EB96ED29C564C28D42F07F5EB81C27568F0F89C343533384BF8E704B99566EA073E46259D9F3740A7A3D41AAB5BFA78AEAB05697100B3A179F5C1EDFB6
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....c............" ..0..............6... ...@....... ..............................hj....`.................................16..O....@............... ......`......t5..8............................................ ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B................e6......H.......("..L............................................................~.............s......s......0..B.......(....,.s....(....(....(....(....(....(.....(....(....(.....(......(...+F.(...+(...+(...+F.(...+(...+(...+F.(...+(...+(...+.0..f........(...+(...+(...+(...+(...+(...+(...+(...+(...+(...+(...+(...+(...+(...+(...+(...+(...+(...+(...+(...+..(...+...0...........-......8.......%o.....%o.....o........E........ ...>...+X..(....-...(....+....(......+:..(....-...

C:\Program Files\FastestVPN\FastestVPN.DI.dll.config (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	432
Entropy (8bit):	5.0141792226861375
Encrypted:	false
SSDEEP:	12:MMHdGzNFF7ap+5v5OXrRf/2//FicYo4xT:JduPF7NhOXrRH2/d9y
MD5:	8F6EB9E75E6A6F0C0D58FB697C10CEDF
SHA1:	6944935DFDC33E0C6DB26869BF25EDA85A2622D8
SHA-256:	E2B8677434501735FB0233ED0CC2FFEE5BF6FB4387C51DBCB2585A70E42E4F08
SHA-512:	A946252B2E3705EAE751A2672D4ADE1499ECEB28C48B4BE6150C4201EE20A7B9A4450C75E06B07F5DAA3528041A566931D988FBD0C2EA90240D61008895BA44A
Malicious:	false
Preview:	.<?xml version="1.0" encoding="utf-8"?>..<configuration>.. <runtime>.. <assemblyBinding xmlns="urn:schemas-microsoft-com:asm.v1">.. <dependentAssembly>.. <assemblyIdentity name="Newtonsoft.Json" publicKeyToken="30ad4fe6b2a6aeed" culture="neutral" />.. <bindingRedirect oldVersion="0.0.0.0-13.0.0.0" newVersion="13.0.0.0" />.. </dependentAssembly>.. </assemblyBinding>.. </runtime>..</configuration>

C:\Program Files\FastestVPN\FastestVPN.Data.Local.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	25768
Entropy (8bit):	6.623350319992477
Encrypted:	false
SSDEEP:	384:21Vrp7wobZBVBhB3GmLiVWgktWe9JHEDIYirwt0FP27NBY3Yuv+1WyT1g:21VV7TbXX72MtWQJHEsYi/K/Y/+1Wy5g
MD5:	D92BF2C8E0A192E18B1F0B24CCB75171
SHA1:	2A6343C3409172E1D426B763151E0CBA3B35E473
SHA-256:	BEED084878EACA4A745A53CC21FAAD1A76F4F82C955BB507496B5B9F23032F1C
SHA-512:	71AD4963BCEBE516FD9EE526F2DD1ECB13F10E1424D0D3CED08A19A38D902DA562C9B1D0E308C4B898E30187773F040CF6A437210EFEF52B957623F798E59459
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...R.s..........." ..0..2..........:Q... ...`....... ..............................I/....`..................................P..O....`...............:.............,P..8............................................ ............... ..H............text...@1... ...2.................. ..`.rsrc........`.......4..............@..@.reloc...............8..............@..B.................Q......H.......`(...'...........................................................0..M........r...p}.....r...p}.....(......{..... (....(....(......{..... (....(....(....^~....-.s.........~......{...."..}......{...."..}......0..8........(........(.....(.....o....r...p(....o.......&..r...p.........--.......0..(.......(.....o........(.....(.......&..r...p..................0..X........o.....[.&......+9...Z.o.... ....(........Z.X.o.... ....(......b`.......X...o.....[2...0..V...

C:\Program Files\FastestVPN\FastestVPN.Data.Remote.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	29352
Entropy (8bit):	6.56368110636982
Encrypted:	false
SSDEEP:	768:vT6rilChUvVsYQTJMS6V4B6PYikK/Y/+V7:7qSsYOwP7kK/77
MD5:	1CFBF0CBA3C87653D9639ADA438C3291
SHA1:	07E36A34319EAD85857CC022E277B69EA132750B
SHA-256:	3525FCE82E2687D8EFAF992147B196881818856EA9EA851A8DC930751329A8DD
SHA-512:	E95FC978E889BD62E92975EFD8F39161B6E43FE97451068552E3A71635943F990E4E8697323794D75F77BB12F3DE4E2CFADB5B9D80EF90F1992C82298EBFD00B
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...t.i..........." ..0..@...........^... ...`....... ....................................`.................................:^..O....`...............H.............\|]..8............................................ ............... ..H............text....>... ...@.................. ..`.rsrc........`.......B..............@..@.reloc...............F..............@..B................n^......H........1...+............................................................{....:.(......}......0..)........u..........,.(.....{.....{....o......v .5Q' )UU.Z(.....{....o....X..0..:........r...p......%..{.......%q.........-.&.+.......o.....(......{....:.(......}........0..)........u..........,.(.....{.....{....o......v . .q )UU.Z(.....{....o....X..0..:........r-..p......%..{.......%q.........-.&.+.......o.....(......{......{....V.(......}......}.....0..A.......

C:\Program Files\FastestVPN\FastestVPN.Data.Remote.dll.config (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	432
Entropy (8bit):	5.0141792226861375
Encrypted:	false
SSDEEP:	12:MMHdGzNFF7ap+5v5OXrRf/2//FicYo4xT:JduPF7NhOXrRH2/d9y
MD5:	8F6EB9E75E6A6F0C0D58FB697C10CEDF
SHA1:	6944935DFDC33E0C6DB26869BF25EDA85A2622D8
SHA-256:	E2B8677434501735FB0233ED0CC2FFEE5BF6FB4387C51DBCB2585A70E42E4F08
SHA-512:	A946252B2E3705EAE751A2672D4ADE1499ECEB28C48B4BE6150C4201EE20A7B9A4450C75E06B07F5DAA3528041A566931D988FBD0C2EA90240D61008895BA44A
Malicious:	false
Preview:	.<?xml version="1.0" encoding="utf-8"?>..<configuration>.. <runtime>.. <assemblyBinding xmlns="urn:schemas-microsoft-com:asm.v1">.. <dependentAssembly>.. <assemblyIdentity name="Newtonsoft.Json" publicKeyToken="30ad4fe6b2a6aeed" culture="neutral" />.. <bindingRedirect oldVersion="0.0.0.0-13.0.0.0" newVersion="13.0.0.0" />.. </dependentAssembly>.. </assemblyBinding>.. </runtime>..</configuration>

C:\Program Files\FastestVPN\FastestVPN.Diagnostics.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	19624
Entropy (8bit):	6.761472837087098
Encrypted:	false
SSDEEP:	384:pwG3NNuGs7lkviba8FLdwIYieB0FP27NBY3Yuv+4pdS:F+V7PpFLdZYixK/Y/+4S
MD5:	12A69C58D97C26D0132D493111E42345
SHA1:	0DCC8570C7D76B660746A0F657607864F8764AD4
SHA-256:	E6682B67F0C489BEB53C93C399D46CEAEBDD7096AD7DB984BF99DCC68E476F4C
SHA-512:	3335371222BB282C55F1309432CD776CD146EFA9B6D17BF23997EFA6E3A741512FD95B9382EB719F400C6A70BD13E6A445A6011716B4C7637CF1083C8D669BE6
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L................." ..0..............8... ...@....... ...............................P....`.................................j8..O....@..............."......`.......7..8............................................ ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`....... ..............@..B.................8......H.......L'..`............................................................0..?.........(....}.......}.......}.......}......\|......(...+..\|....(......0..7.........(....}.......}.......}......\|......(...+..\|....(......0../.........(....}.......}......\|......(...+..\|....(......0..7.........(....}.......}.......}......\|......(...+..\|....(....6..(...+(......(......(......{..........%..#...(.....%..!...(.....(.....(....*.0..e........{......E....8............(....o ......(!...

C:\Program Files\FastestVPN\FastestVPN.Diagnostics.dll.config (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	1192
Entropy (8bit):	5.059106104983516
Encrypted:	false
SSDEEP:	24:JduPF7NV+TkH2/17zVVXBOH2/17zVQ7uH2/XVUrPH2/+C9y:327Gwg1BOg1SagXSg+Cw
MD5:	66373624F8B60F41B8FEC0E61779C0AC
SHA1:	0D3BE3C009F0A2260F89C3FBC9FFEBA0061C17F2
SHA-256:	FE0A5830D875B8BD0864BF4F85705D4F2E3D7A575C07B2B5A18041558DBA1386
SHA-512:	74F084B2697F936122E371042FEF5740BF205914B3FA276F8F7C72561680BF2C39A7DD2970BDEDF36AACC20970CD9552A719211F30090881E498815D91C6CDD0
Malicious:	false
Preview:	.<?xml version="1.0" encoding="utf-8"?>..<configuration>.. <runtime>.. <assemblyBinding xmlns="urn:schemas-microsoft-com:asm.v1">.. <dependentAssembly>.. <assemblyIdentity name="SQLitePCLRaw.core" publicKeyToken="1488e028ca7ab535" culture="neutral" />.. <bindingRedirect oldVersion="0.0.0.0-2.1.6.2060" newVersion="2.1.6.2060" />.. </dependentAssembly>.. <dependentAssembly>.. <assemblyIdentity name="SQLitePCLRaw.batteries_v2" publicKeyToken="8226ea5df37bcae9" culture="neutral" />.. <bindingRedirect oldVersion="0.0.0.0-2.1.6.2060" newVersion="2.1.6.2060" />.. </dependentAssembly>.. <dependentAssembly>.. <assemblyIdentity name="System.Runtime.CompilerServices.Unsafe" publicKeyToken="b03f5f7f11d50a3a" culture="neutral" />.. <bindingRedirect oldVersion="0.0.0.0-6.0.0.0" newVersion="6.0.0.0" />.. </dependentAssembly>.. <dependentAssembly>.. <assemblyIdentity name="System.Memory" publicKeyToken="cc7b13ffc

C:\Program Files\FastestVPN\FastestVPN.ViewModel.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	124072
Entropy (8bit):	6.169344446608534
Encrypted:	false
SSDEEP:	3072:LurAkSCDvkOtt+niUnQY8/LFEMnK8VQW5K/7:LJkSCDv+iUnQXLFEEM/7
MD5:	2DC3102392DAEF9B935CDF4939A9B132
SHA1:	F56261CE19BFC14F8317C2AA05F010E9ACFBCE02
SHA-256:	B6D9088505C220F23132D78675004BC31E0FB5C04257357C2B02072EF8C28DAD
SHA-512:	596AFAA1347CF730D2D0312857366EE3AD4C5C439E2F93BD6D38B29129C7B3530523B206FAEEF1DB3F6D9A18482162FF56321C9F1A1FA4F296F6B29AE8659321
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...q............" ..0.................. ........... ....................... ......Q.....`.....................................O......................................8............................................ ............... ..H............text........ ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................H.......d................................................................0...........s....%r...pr...po....%rk..pru..po....%r...pr...po....}......(....(...+o.....(...+o.......o....r!..p.o....(....}......o....}......o....}......o....}.....(....r%..p( ...-..(....re..p( ...,...}......}......{......{......{......{......{....J.......s!...s:....~....%-.&~..........s!...%.....s:...J.......s"...s#...J.......s!...s:.....0..........(...+o$.....E........9...^...*.r...pr...pr..

C:\Program Files\FastestVPN\FastestVPN.ViewModel.dll.config (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	432
Entropy (8bit):	5.0141792226861375
Encrypted:	false
SSDEEP:	12:MMHdGzNFF7ap+5v5OXrRf/2//FicYo4xT:JduPF7NhOXrRH2/d9y
MD5:	8F6EB9E75E6A6F0C0D58FB697C10CEDF
SHA1:	6944935DFDC33E0C6DB26869BF25EDA85A2622D8
SHA-256:	E2B8677434501735FB0233ED0CC2FFEE5BF6FB4387C51DBCB2585A70E42E4F08
SHA-512:	A946252B2E3705EAE751A2672D4ADE1499ECEB28C48B4BE6150C4201EE20A7B9A4450C75E06B07F5DAA3528041A566931D988FBD0C2EA90240D61008895BA44A
Malicious:	false
Preview:	.<?xml version="1.0" encoding="utf-8"?>..<configuration>.. <runtime>.. <assemblyBinding xmlns="urn:schemas-microsoft-com:asm.v1">.. <dependentAssembly>.. <assemblyIdentity name="Newtonsoft.Json" publicKeyToken="30ad4fe6b2a6aeed" culture="neutral" />.. <bindingRedirect oldVersion="0.0.0.0-13.0.0.0" newVersion="13.0.0.0" />.. </dependentAssembly>.. </assemblyBinding>.. </runtime>..</configuration>

C:\Program Files\FastestVPN\FastestVPN.exe (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	2059432
Entropy (8bit):	7.651137710710665
Encrypted:	false
SSDEEP:	24576:+3zNmj7tPN/PPINv2lYnvqfI1L3ciKKqjnTVlKJ+hgyiTebWmDXQHMkgXvYOdSYB:84vtPNvCv2Qqfobuvq+hqCTDgHMT
MD5:	01CF6EF766C41BB2C99A2CCCDECC69C1
SHA1:	8DD5EB983C1C8F2E3A2538E50295644BB778A69E
SHA-256:	9A9B95CA40D32FA23A615A122FA3AAF7AEB32FBEF2850D729F77C1169FFC0452
SHA-512:	9EE4D4D7852555F67CF0C9B372DCA87EC0727AB0A6FC5EAE309CF6BF5467FC75C6868A5E528D34AB605CDC736D30684D35A1451D4ABE3B99BA37D276474AC940
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....G............"...0......D........... ... ....@.. ...............................P ...`.................................^...O.... ...A...........B.................8............................................ ............... ..H............text........ ...................... ..`.rsrc....A... ...B..................@..@.reloc...............@..............@..B........................H.......DD..T`......-....... v...........................................0..O.......s....%.o....%.o ...%.o!...%..o".....o#........($........(%..._,...o&...(.......(......{...."..}......{...."..}......{...."..}......{...."..}.......(.......(....(.......(....(.......(....(......0..5........('...-...((.....o)...(...(+...(,.......,..o-.................)........(....2.(/...o0.....(1....(2...2.(....o3.....(....o4...&.(.....o5....(.....o5....(....o6...&2.(....o7

C:\Program Files\FastestVPN\FastestVPN.exe.config (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	1112
Entropy (8bit):	5.030466366630491
Encrypted:	false
SSDEEP:	24:JdArztW1oF7Nv+IcvH2/+GVTcvH2/+GVhOXrRH2/d9y:3Arzcq7h+Iag+GMg+G27Rgdw
MD5:	B94AE93769D64791440B3C36CC82AC69
SHA1:	E4AAAD9A0FB51051C8B25F768BC1563543F132C0
SHA-256:	432BFD182828A531147812566CB3439702A243BB7A4C45CC816192F9CB91D4A5
SHA-512:	AD978C59980C0194357D5070D53EA77C334493D14593C141B9DBEEF835FC688FD90C99236D687F50860FA7F4FD4125650E432A61EDF7917C77E4EE4E5E3D4E66
Malicious:	true
Preview:	.<?xml version="1.0" encoding="utf-8"?>..<configuration>.. <startup> .. <supportedRuntime version="v4.0" sku=".NETFramework,Version=v4.8" />.. </startup>.. <runtime>.. <legacyCorruptedStateExceptionsPolicy enabled="true" />.. <assemblyBinding xmlns="urn:schemas-microsoft-com:asm.v1">.. <dependentAssembly>.. <assemblyIdentity name="Microsoft.Expression.Interactions" publicKeyToken="31bf3856ad364e35" culture="neutral" />.. <bindingRedirect oldVersion="0.0.0.0-4.5.0.0" newVersion="4.5.0.0" />.. </dependentAssembly>.. <dependentAssembly>.. <assemblyIdentity name="System.Windows.Interactivity" publicKeyToken="31bf3856ad364e35" culture="neutral" />.. <bindingRedirect oldVersion="0.0.0.0-4.5.0.0" newVersion="4.5.0.0" />.. </dependentAssembly>.. <dependentAssembly>.. <assemblyIdentity name="Newtonsoft.Json" publicKeyToken="30ad4fe6b2a6aeed" culture="neutral" />.. <bindingRedirect oldVersion="0.0.0.0-13.0.0

C:\Program Files\FastestVPN\Flurl.Http.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	117928
Entropy (8bit):	6.160360774488817
Encrypted:	false
SSDEEP:	3072:Hzne5lbC/VlCG2OWMMdWWbWbWw+Hfz+8lKbchOD07PQCFP1IYmDe/WAbBuhEK/a:HFO4WMMdWWbWbWw+Hfz+8lKbchOD07PP
MD5:	FDFDFE021B53B630939D27C6C90CB435
SHA1:	AA0987A6EA6987BB9930B9167EC31C249EF9D885
SHA-256:	D753A7EF62BABC2ADB5D1DBEB0BEBAA2B042CC01CC219726F32F761BBB0A711D
SHA-512:	1FD0C74D0ED3AC4DF26D3E95C0F133E8024D77D1FD06E0C76C630D6AAC7B81124AA1DCA7CFFAC43BC34252A057414F8C3F8EC63A805323B1EF892B5F6A277D3B
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....8............" ..0................. ........... ..............................U.....`.................................w...O......................................T............................................ ............... ..H............text....... ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................H.........................................................................{ .....{!...V.(".....} .....}!......0..A........u........4.,/(#....{ ....{ ...o$...,.(%....{!....{!...o&...... '.(k )UU.Z(#....{ ...o'...X )UU.Z(%....{!...o(...X...0..b........r...p......%..{ ......%q.........-.&.+.......o)....%..{!......%q.........-.&.+.......o)....(...>..su...%.}^......0...........(+...,.....(....o.....8t....o......-2.{,....{-.....g...%..".o.....(/...s0...sk....88....{,...r

C:\Program Files\FastestVPN\Flurl.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	49320
Entropy (8bit):	6.325351798150663
Encrypted:	false
SSDEEP:	768:Qmbo2ICFobV6wsLIcUIh/61jCouvi1Ys7ZYiG6K/Y/+Z:QmbrbU6ws0cGjCoei1Ys7Z7G6K/P
MD5:	C22900453EF4B917460ADEA7DE87225B
SHA1:	6878237656DA68C046FB95FAA8CAF3B4C719851B
SHA-256:	9AF8C8105093B7D62FC578DAE3497FF0AD796C9ABD638EB14269DED4270DFF96
SHA-512:	2E7D0EB99E2924FB375AAF8891968228193C65C133E362F66567C044E8B744ABC3A992EF7606644690D1BB81AD13A64A35D8107BDBDD9D5942BEA1DD1074EA3C
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L................." ..0................. ........... ....................................`.................................p...O.......,..............................T............................................ ............... ..H............text....... ...................... ..`.rsrc...,...........................@..@.reloc..............................@..B........................H........L...\............................................................{".....{#...V.($.....}".....}#......0..A........u........4.,/(%....{"....{"...o&...,.('....{#....{#...o(...... ?Y.. )UU.Z(%....{"...o)...X )UU.Z('....{#...o...X...0..b........r...p......%..{"......%q.........-.&.+.......o+....%..{#......%q.........-.&.+.......o+....(,.....{-.....{....V.($.....}-.....}.....0..A........u........4.,/(%....{-....{-...o&...,.('....{.....{....o(...... (... )UU.

C:\Program Files\FastestVPN\Hardcodet.NotifyIcon.Wpf.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	108200
Entropy (8bit):	7.332504567097915
Encrypted:	false
SSDEEP:	1536:Gn5VJM3T5szyxa9PuIKb8wmtyYVzH0cfNbQSi/GoP4YNjZ34A7GZK/ZIVQ:GWsEa9GIdyAUKWeYNl34AwK/ZV
MD5:	261A5044C94F318DEEA20D178ED9F36E
SHA1:	2A9704F70A543EE219481A3AA756A0CF151E1999
SHA-256:	D17E9B0C62C224D1BA56E7206D8A44FE382FE99752C511BA211A7725D83FEF43
SHA-512:	E53C320DBF6B2AAEEC01FE5AFF1FAD5A8D75B2483A78BA0E1B510F2A7A8C5C510ACD603541734F4A002748D0781FC11AFBF6967EBCDB41A6FC9A29C828ABC2A3
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...l.g..........." ..0..p.............. ........... ....................................`.....................................O....................\|.................p............................................ ............... ..H............text....n... ...p.................. ..`.rsrc................r..............@..@.reloc...............z..............@..B........................H........O..\|w..................,.......................................V!.)1......s............0..$........u......,...o.....u......,...o.....0..&........u......,....o ....u......,....o!......0..&........u......,....o"....u......,....o#...B.(Y...-.(.......{!..."..}!...>.{....o........0..9........(.....($.....(......,..o%...-..,..o&...-..,..o%.....*....0...........s'...}.....((....(....-..s....+.(....}......{....o....(....}.....(!....{...........s)...o.....{....

C:\Program Files\FastestVPN\Microsoft.AppCenter.Analytics.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	25976
Entropy (8bit):	6.331152456306087
Encrypted:	false
SSDEEP:	384:Z90ljCvGQJ+GlfmER/asDZ0WN1L4meT6pmOW2ZZWeQMWMLHRN7S37EHR9zCt+:Z9EIGk+GlfmERxcFz2ZSCL+7Ex9zS+
MD5:	3C5DFBB4E3F1AD153EB2E203B56EA0AE
SHA1:	59623BF1D67D87264C165E421F12426DA998AF46
SHA-256:	9E8252429D0E6529B87A2C79A13119F4DF56ABE924949F3750B024C51D747378
SHA-512:	94DF20E98A2E5D7AC93B63EFEBCE4DAAFBF25AB6B4A2B76AF0BB46D9EDE102AC8C8E1147D5813CDB879AADD5A8AA4073FD0E6066286AF4EF4D368FAB983BE3B5
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....w............" ..0..4...........S... ...`....... ....................................`..................................S..O....`...............>..x'..........XR..T............................................ ............... ..H............text....3... ...4.................. ..`.rsrc........`.......6..............@..@.reloc...............<..............@..B.................S......H.......l,..l%...................Q........................................(.....0..H.........~....,...~....~..........(......~....%-.&s....%...........,..(..............#<.......0..%.......~..........(...............,..(.........................0..........~..........(....(....o....(...+....,..(.................".......0..0.......~..........(....(.....o.....(...+....,..(...............$.......0..).......~..........(....(......o.......,..(.....*....................0..b...

C:\Program Files\FastestVPN\Microsoft.AppCenter.Crashes.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	53624
Entropy (8bit):	6.18841715621451
Encrypted:	false
SSDEEP:	768:mLtojuUUUbf/l0lwELEEEqi8g15qTLT5HGoV0weeezxSoL3G7Yl9zndG:mE17Iw8/i8gM5maee8SoL13zdG
MD5:	B7ABAF6A90E95E585E71C0C22D90AF73
SHA1:	C9756883D1738A9931D0BF58D6F69CBB8DFD5870
SHA-256:	3BA247FDCC6953B5CC672A361983B7B0AF3051A83128970BCEBAB22036D1E859
SHA-512:	3A67EF230A06FAE3095926EAD9AAF329009BC0F2ED6AA1E6683C426ADA29DDD9CB77EC3BE134DFC4CD10A1F675D518FB4986363C4FE649D4247770B96DBC7A56
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....#2..........." ..0.................. ........... ...............................0....`.....................................O.......................x'..........t...T............................................ ............... ..H............text........ ...................... ..`.rsrc...............................@..@.reloc..............................@..B.......................H........E...w..........................................................&...(....2.r...p(....V.(......}......}......{......{......{......(......}......}......}.......}.......}......{......{......{......{......{.......0..'.......~.........(....t............(...+...3...0..'.......~.........(....t............(...+...3...0..'.......~.........(....t............(...+...3...0..'.......~.........(....t............(...+...3...0..'.......~.........(....t............(...

C:\Program Files\FastestVPN\Microsoft.AppCenter.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	147848
Entropy (8bit):	6.032707503792338
Encrypted:	false
SSDEEP:	3072:yiq8kuub1o2/5pds7tUMZNFxtPwVrHlGZ6U1SiWUwBpXtNpTE1MNniv:WFwzFQ9FGZ1SityhtNpTECU
MD5:	B6DB385295FA78A6AABCF217FD3C3F83
SHA1:	71E2A93223A6B8204EED6B9834284C0FA1D7EBD0
SHA-256:	ABF40F07643E6D29D0817021991F9D27410B7DCAEF80980D849634ACEF255BDC
SHA-512:	122FDB77C0AC6A7A2ECF5519BB059097EF119390E6D3C34F9FAB303D60279EE8649175617E3B6FC2A3D118B422CE8BC1BFFC208332D0A9F012271325AC0A0EE7
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....@..........." ..0..............1... ...@....... ..............................0b....`.................................71..O....@...................'...`.......0..T............................................ ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B................k1......H.......8...d].................../.......................................0..s........r...p(......(....,.r...psK...z.rW..po....-.r[..pro..p(X....s.....~.....o....o......+8..o....t.........o.....o ...o!.....o.....o ...o!...o".....o#...-.....u........,...o$.....r...po%...,.r[..pr...p(X.....rS..po%...,.r[..prg..p(X....~&....~&......o%...,.....o'...&..o%...,.....o'...&.(....,..(....,.r...p.r...p((...sK...z.(....-&.(....-.r...p.r%..p((.....r)..p.((............U.E........(....*.

C:\Program Files\FastestVPN\Microsoft.AspNet.SignalR.Client.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	149896
Entropy (8bit):	6.136390335470081
Encrypted:	false
SSDEEP:	1536:PcRKLBm0ELV6Ra+eKBL24YzRk2XDuzEdnp+4WSspmfxPapkwN5RGV5xz/OEYW58R:qI0KRHeKBszRk2aApjsp7pBtZGh9
MD5:	70B1C15FDBBFB88F91965DC7BBC5527F
SHA1:	A473571DAC42819933CD7EF0C604F1EA0614D2F3
SHA-256:	109878A7A6F6BD13637B7E3A2EBC22D37423716ECD4E954CC09BACB84B92F62B
SHA-512:	C496EE2DDF6C401E9E48FB6D739C44200EBFE36B516E7608CECB3E32FEB620CE1531CC5DE26B1A4CD033C65FD002D6B6315B746CFB8B4D047A2954F6F33CA0A4
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...5A............" ..0..............;... ...@....... ..............................Ri....`.................................N;..O....@...............&...#...`......X:..T............................................ ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`.......$..............@..B.................;......H.......h....Y..........H'.......9........................................(...+.~.....~.....~......%-.&(......%-.&~ .......0..........(!......o"......(7..........................0..........(!......o...+...(...+........................~$...%-.&~%.....&...s'...%.$....(...+.0..D.............,:......o(.....,......o(....3.........o)....(....+.....(...+..0..9.......s......}+.....},.....}-................s/... ....(B...&....0..$........,...r...p......%.....o~......o0...*

C:\Program Files\FastestVPN\Microsoft.Bcl.AsyncInterfaces.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	26752
Entropy (8bit):	6.512503595653532
Encrypted:	false
SSDEEP:	768:DulwnBhYlTVv2wK5idcgF4of1n6K9zUYJ:ywHYFtKYdcg/f1nXzUYJ
MD5:	970B6E6478AE3AB699F277D77DE0CD19
SHA1:	5475CB28998D419B4714343FFA9511FF46322AC2
SHA-256:	5DC372A10F345B1F00EC6A8FA1A2CE569F7E5D63E4F1F8631BE367E46BFA34F4
SHA-512:	F3AD2088C5D3FCB770C6D8212650EED95507E107A34F9468CA9DB99DEFD8838443A95E0B59A5A6CB65A18EBBC529110C5348513A321B44223F537096C6D7D6E0
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...$:............" ..0..4...........S... ...`....... ....................................`..................................S..O....`...............@...(...........R..T............................................ ............... ..H............text....3... ...4.................. ..`.rsrc........`.......6..............@..@.reloc...............>..............@..B.................S......H........'..P..................,R........................................(......(....^.(.......1...%...}....:.(......}....:.(......}....:.(......}....:.(......}......(......(......(......(....:.(......}......{....:.(......}......{....:.(......}......{......(....:.(......}......{....^.(.......2...%...}....:.(......}......{....z.(......}.......2...%...}....V.(......}......}......{......{....:.(......}......{......{...."..}......{...."..}......{

C:\Program Files\FastestVPN\Microsoft.Extensions.DependencyInjection.Abstractions.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	48256
Entropy (8bit):	6.234996524588368
Encrypted:	false
SSDEEP:	768:AMWC5N7mKWPKz4VJ4e0jeuTGlBh0JzqPPxofk3l9z2I:Y67hCfV8j3TGlB+JsafkHzP
MD5:	37EB7CCE6E282D3572D64C880E1AC3C8
SHA1:	9A2952589A19D650932E7C633577EB9AFC04F959
SHA-256:	039155F155C5D14F5B73F4EE2CD1FBD9290F391B88A1D2A0BA815569205EDB74
SHA-512:	E3C2EF1CC52E3AA5BD77B74DEC93A4FC9E908DF823426F13CA304265D41605DE51970CC8C7E18C2E76319D3225707B2EA2D8613402A25C4FBD3951E70FCFD521
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....v..........." ..0.................. ........... ....................................`.....................................O........................(..............T............................................ ............... ..H............text........ ...................... ..`.rsrc...............................@..@.reloc..............................@..B.......................H........=..da..........0.................................................(......(....^.(.......>...%...}....:.(......}....:.(......}....:.(......}....:.(......}....*.-..(......s....z.~.......0..........(....,....(.....o.......&......................0...........(.......(....-..,....(....,.r...p......%...%...(......( ....(....,.r...p......%...%...%...(.......(!....(....,!r...p......%...%...%...%...(........(".....,&(....,..r...pr...p.(....(#.....($.....(.

C:\Program Files\FastestVPN\Microsoft.Extensions.DependencyInjection.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	88192
Entropy (8bit):	6.25584016939133
Encrypted:	false
SSDEEP:	1536:0kUuBN7CjSkp9oa++t1BVryVKXDORdDeCNia6Lj4Fu/qSGnJdo0Wzs:ju/t/VryVKXeDezVLj4F/JdWQ
MD5:	4186A905DC180A0CC2110403727BD792
SHA1:	E0563D20CA7E95688A60F4BFC1AB0127EAE1F651
SHA-256:	40DCB80A87A762745D0A15294B5CA7783A9EAD1D93AD352D25B5EDAF4994651E
SHA-512:	1C3459232B41C531F01BCCE54E46799F2FB3FCD6C87D7F908C633ABCC718D9726D98E65F964B1A870D416A38F545971779054FE65F7C1299905FC7DC24FA2DEC
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L................." ..0..&..........>E... ...`....... ....................................`..................................D..O....`...............0...(...........C..T............................................ ............... ..H............text...D%... ...&.................. ..`.rsrc........`.......(..............@..@.reloc..............................@..B.................E......H........l..@...........02..0...`C........................................(......(....^.(.......k...%...}....:.(......}....:.(......}....:.(......}....:.(......}.....~......0..........(....,....(.....o ......&......................0...........(.......(!...-..,....(....,.r...p......%...%...(".....(#....(....,.r...p......%...%...%...("......($....(....,!r...p......%...%...%...%...(".......(%.....,&(....,..r...pr...p.("...(&.....('....*.(....,.r...p......%...

C:\Program Files\FastestVPN\Newtonsoft.Json.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	711952
Entropy (8bit):	5.967185619483575
Encrypted:	false
SSDEEP:	12288:GBja5bBvR8Q0TE2HB0WLmvXbsVG1Gw03RzxNHgKhwFBkjSHXP36RMGy1NqTUO:GBjk38WuBcAbwoA/BkjSHXP36RMG/
MD5:	195FFB7167DB3219B217C4FD439EEDD6
SHA1:	1E76E6099570EDE620B76ED47CF8D03A936D49F8
SHA-256:	E1E27AF7B07EEEDF5CE71A9255F0422816A6FC5849A483C6714E1B472044FA9D
SHA-512:	56EB7F070929B239642DAB729537DDE2C2287BDB852AD9E80B5358C74B14BC2B2DDED910D0E3B6304EA27EB587E5F19DB0A92E1CBAE6A70FB20B4EF05057E4AC
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...p$?..........." ..0.............B.... ........... ....................... ............`....................................O......................../.......... ...T............................................ ............... ..H............text........ ...................... ..`.rsrc...............................@..@.reloc..............................@..B................$.......H.......x...(9............................................................(......(....^.(...........%...}....:.(......}....:.(......}......(....:.(......}......{......(......(....:.(......}......{.....(.............}.....(......{.....X.....}......0...........-.~.....~....X....b...aX...X...X..+....b....aX....X.....2.....cY.....cY....cY..\|....(......._..{........+,..{\|....3...{{......(....,...{{.....{}.......-.....0...........-.r...ps....z.o......-.~.....~....

C:\Program Files\FastestVPN\Resources\ComDebug.exe (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	256912
Entropy (8bit):	6.232383775712062
Encrypted:	false
SSDEEP:	6144:WEq38uejOBA0ItZ1PNWPQqLlXXXXVXDBsXdZC/R0EjW0VnXNvdroJ:/q0jOBARWPRLlXXXXVXSXdZk0EjW0VnM
MD5:	850A43E323656B86AE665D8B4FD71369
SHA1:	099D6E80C394CCC5233E1CBD6B29769DA9E0E2AA
SHA-256:	539423D2E436E198DF15B5577D816DC306BA4C03B1362F7731E675B51F4A5F42
SHA-512:	1F2778040E906EA2939A8B0A682E267599AA8422F81EA83BB6C980A304B569AD750EF3E81E1490EDD5B1D74E734A2CB82F428F47096C55436037E03E516D2378
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......w...3...3...3......6..........u..9....u..#....u..`......"......;......1... r..$...3...... r..:... r&.2...3.N.2... r..2...Rich3...........PE..d.....wf.........."....(.Z.....................@.............................0......#.....`.................................................Tq..T....... ........%........... .......#.......................%..(...`"..@............p.. ............................text....Y.......Z.................. ..`.rdata.......p.......^..............@..@.data....0...........v..............@....pdata...%.......&..................@..@.rsrc... ...........................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................

C:\Program Files\FastestVPN\Resources\Setup.Ps1 (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	359
Entropy (8bit):	5.09733291062762
Encrypted:	false
SSDEEP:	6:i4Z2TyUdkl9WUyUdkwc1+XMoHkyUdk3LASg0TqeXMFXA98XfFZ/FvjCzISMOmEm:jZELklIULktkXxELk35q0MhA98vFZ/FV
MD5:	777B3CBF81DDD8B238BDEDDDEA17AFED
SHA1:	C72F46715DCBC9BDA1E2BEEAC8AF2A64E7B48D08
SHA-256:	DACE14B4A5268728E67A9E78D8F0877F4C87F6B87DDD40DFF28A11E9E42945CF
SHA-512:	5C6D302F93381EBF65ADD3DAA0EB4813270C5D9A042AD9B8A48A575ADC4E751D3834292BB61AEF6A5458036AE6E3C83C8EDFAE5CF828D81317ACAE6675B8E619
Malicious:	false
Preview:	If (-NOT ([Security.Principal.WindowsPrincipal][Security.Principal.WindowsIdentity]::GetCurrent()).IsInRole([Security.Principal.WindowsBuiltInRole] "Administrator"))..{ ..$arguments = "& '" + $myinvocation.mycommand.definition + "'"..Start-Process powershell -Verb runAs -ArgumentList $arguments..Break..}.. Set-NetConnectionProfile -NetworkCategory Private

C:\Program Files\FastestVPN\Resources\data\ca1.ca (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp
File Type:	PEM certificate
Category:	dropped
Size (bytes):	1912
Entropy (8bit):	6.013187457463572
Encrypted:	false
SSDEEP:	48:LrZOGn3n3+NKHqtdSLuARqhs9WWRR21mB4LearXRvW:Lrz3nnYhhfwc1eCearhvW
MD5:	94F25D41487F654EF2371FA92544003C
SHA1:	41A561AA773A21C240F74AF4F14DB7FB2479F630
SHA-256:	E6A1EEFBCA63DDCE20065B080C202BF63686F473B91F2C64461434AFD071018C
SHA-512:	281DCBF7852E3B81B3E09A889045C2B4357F684B4F511835A874BC98DEC7D4A77AD1EC1C0FE1D55D9616670278715FBFE9772F2518C3861933F6C392B6A939A4
Malicious:	false
Preview:	-----BEGIN CERTIFICATE-----..MIIFQjCCAyqgAwIBAgIIUfxepT+rr8owDQYJKoZIhvcNAQEMBQAwPzELMAkGA1UE..BhMCS1kxEzARBgNVBAoTCkZhc3Rlc3RWUE4xGzAZBgNVBAMTEkZhc3Rlc3RWUE4g..Um9vdCBDQTAeFw0xNzA5MTYwMDAxNDZaFw0yNzA5MTQwMDAxNDZaMD8xCzAJBgNV..BAYTAktZMRMwEQYDVQQKEwpGYXN0ZXN0VlBOMRswGQYDVQQDExJGYXN0ZXN0VlBO..IFJvb3QgQ0EwggIiMA0GCSqGSIb3DQEBAQUAA4ICDwAwggIKAoICAQC1Xj+WfPTo..zFynFqc+c3CVrggIllaXEl5bY5VgFynXkqCTM6lSrfC4pNjGXUbqWe6RnGJbM4/6..kUn+lQDjFSQV1rzP2eDS8+r5+X2WXh4AoeNRUWhvSG+HiHD/B2EFK+Nd5BRSdUjp..KWAtsCmT2bBt7nT0jN1OdeNrLJeyF8siAqv/oQzKznF9aIe/N01b2M8ZOFTzoXi2..fZAckgGWui8NB/lzkVIJqSkAPRL8qiJLuRCPVOX1PFD8vV//R8/QumtfbcYBMo6v..Ck2HmWdrh5OQHPxb3KJtbtG+Z1j8x6HGEAe17djYepBiRMyCEQvYgfD6tvFylc4I..quhqE9yaP60PJod5TxpWnRQ6HIGSeBm+S+rYSMalTZ8+pUqOOA+IQCYpfpx6EKIJ..L/VsW2C7cXdvudxDhXPI5lR/QidCb9Ohq3WkfxXaYwzrngdg2avmNqId9R4KESuM..9GoHW0dszfyBCh5wYfeaffMElfDam3B92NUwyhZwtIiv623WVXY9PPz+EDjSJsIA..u2Vi1vdJyA4nD4k9Lwmx/1zTc/UaYVLsiBqL2WdfvFTeoWoV+dNxQXSEPhB8gwi8..x4O4lZW0cwVy/6fa8KMY8gZbcbSTr7U5bRERfW8l+jY+mYK

C:\Program Files\FastestVPN\Resources\data\ca2.ca (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp
File Type:	PEM certificate
Category:	dropped
Size (bytes):	1912
Entropy (8bit):	6.013187457463572
Encrypted:	false
SSDEEP:	48:LrZOGn3n3+NKHqtdSLuARqhs9WWRR21mB4LearXRvW:Lrz3nnYhhfwc1eCearhvW
MD5:	94F25D41487F654EF2371FA92544003C
SHA1:	41A561AA773A21C240F74AF4F14DB7FB2479F630
SHA-256:	E6A1EEFBCA63DDCE20065B080C202BF63686F473B91F2C64461434AFD071018C
SHA-512:	281DCBF7852E3B81B3E09A889045C2B4357F684B4F511835A874BC98DEC7D4A77AD1EC1C0FE1D55D9616670278715FBFE9772F2518C3861933F6C392B6A939A4
Malicious:	false
Preview:	-----BEGIN CERTIFICATE-----..MIIFQjCCAyqgAwIBAgIIUfxepT+rr8owDQYJKoZIhvcNAQEMBQAwPzELMAkGA1UE..BhMCS1kxEzARBgNVBAoTCkZhc3Rlc3RWUE4xGzAZBgNVBAMTEkZhc3Rlc3RWUE4g..Um9vdCBDQTAeFw0xNzA5MTYwMDAxNDZaFw0yNzA5MTQwMDAxNDZaMD8xCzAJBgNV..BAYTAktZMRMwEQYDVQQKEwpGYXN0ZXN0VlBOMRswGQYDVQQDExJGYXN0ZXN0VlBO..IFJvb3QgQ0EwggIiMA0GCSqGSIb3DQEBAQUAA4ICDwAwggIKAoICAQC1Xj+WfPTo..zFynFqc+c3CVrggIllaXEl5bY5VgFynXkqCTM6lSrfC4pNjGXUbqWe6RnGJbM4/6..kUn+lQDjFSQV1rzP2eDS8+r5+X2WXh4AoeNRUWhvSG+HiHD/B2EFK+Nd5BRSdUjp..KWAtsCmT2bBt7nT0jN1OdeNrLJeyF8siAqv/oQzKznF9aIe/N01b2M8ZOFTzoXi2..fZAckgGWui8NB/lzkVIJqSkAPRL8qiJLuRCPVOX1PFD8vV//R8/QumtfbcYBMo6v..Ck2HmWdrh5OQHPxb3KJtbtG+Z1j8x6HGEAe17djYepBiRMyCEQvYgfD6tvFylc4I..quhqE9yaP60PJod5TxpWnRQ6HIGSeBm+S+rYSMalTZ8+pUqOOA+IQCYpfpx6EKIJ..L/VsW2C7cXdvudxDhXPI5lR/QidCb9Ohq3WkfxXaYwzrngdg2avmNqId9R4KESuM..9GoHW0dszfyBCh5wYfeaffMElfDam3B92NUwyhZwtIiv623WVXY9PPz+EDjSJsIA..u2Vi1vdJyA4nD4k9Lwmx/1zTc/UaYVLsiBqL2WdfvFTeoWoV+dNxQXSEPhB8gwi8..x4O4lZW0cwVy/6fa8KMY8gZbcbSTr7U5bRERfW8l+jY+mYK

C:\Program Files\FastestVPN\Resources\data\is-CUGSD.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	618
Entropy (8bit):	4.532694766524299
Encrypted:	false
SSDEEP:	12:LrkTt/+xYnhEKMhS64Ar24EgJroQXj2OrcV7TdRwPXYGFc6895C1v:LrkTtcYnhEKoP4AK4EgJkCj2OrnoGFFx
MD5:	005BF2A1B29FB74EF9ED7402A69D5CD5
SHA1:	ADEFC73E4B4F34F304E78FD4DB2D3B6AD09C6AF7
SHA-256:	F7FE79400908B148EB8E8AF16B0F1AFDF7CBCD33DCE23F96177473D0BF11DAFF
SHA-512:	381CA1E2146A66D1ACC46F7E9F9081962BB96014C10EB5AA0AE60478B8DD902F1975D63AEE18675B95A71D90594338753D8C91CD21ED0939237562E61D0D3D69
Malicious:	false
Preview:	-----BEGIN OpenVPN Static key V1-----..697fe793b32cb5091d30f2326d5d124a..9412e93d0a44ef7361395d76528fcbfc..82c3859dccea70a93cfa8fae409709bf..f75f844cf5ff0c237f426d0c20969233..db0e706edb6bdf195ec3dc11b3f76bc8..07a77e74662d9a800c8cd1144ebb67b7..f0d3f1281d1baf522bfe03b7c3f963b1..364fc0769400e413b61ca7b43ab19fac..9e0f77e41efd4bda7fd77b1de2d7d785..5cbbe3e620cecceac72c21a825b243e6..51f44d90e290e09c3ad650de8fca99c8..58bc7caad584bc69b11e5c9fd9381c69..c505ec487a65912c672d83ed0113b5a7..4ddfbd3ab33b3683cec593557520a72c..4d6cce46111f56f3396cc3ce7183edce..553c68ea0796cf6c4375fad00aaa2a42..-----END OpenVPN Static key V1-----

C:\Program Files\FastestVPN\Resources\data\is-GM9LU.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	618
Entropy (8bit):	4.532694766524299
Encrypted:	false
SSDEEP:	12:LrkTt/+xYnhEKMhS64Ar24EgJroQXj2OrcV7TdRwPXYGFc6895C1v:LrkTtcYnhEKoP4AK4EgJkCj2OrnoGFFx
MD5:	005BF2A1B29FB74EF9ED7402A69D5CD5
SHA1:	ADEFC73E4B4F34F304E78FD4DB2D3B6AD09C6AF7
SHA-256:	F7FE79400908B148EB8E8AF16B0F1AFDF7CBCD33DCE23F96177473D0BF11DAFF
SHA-512:	381CA1E2146A66D1ACC46F7E9F9081962BB96014C10EB5AA0AE60478B8DD902F1975D63AEE18675B95A71D90594338753D8C91CD21ED0939237562E61D0D3D69
Malicious:	false
Preview:	-----BEGIN OpenVPN Static key V1-----..697fe793b32cb5091d30f2326d5d124a..9412e93d0a44ef7361395d76528fcbfc..82c3859dccea70a93cfa8fae409709bf..f75f844cf5ff0c237f426d0c20969233..db0e706edb6bdf195ec3dc11b3f76bc8..07a77e74662d9a800c8cd1144ebb67b7..f0d3f1281d1baf522bfe03b7c3f963b1..364fc0769400e413b61ca7b43ab19fac..9e0f77e41efd4bda7fd77b1de2d7d785..5cbbe3e620cecceac72c21a825b243e6..51f44d90e290e09c3ad650de8fca99c8..58bc7caad584bc69b11e5c9fd9381c69..c505ec487a65912c672d83ed0113b5a7..4ddfbd3ab33b3683cec593557520a72c..4d6cce46111f56f3396cc3ce7183edce..553c68ea0796cf6c4375fad00aaa2a42..-----END OpenVPN Static key V1-----

C:\Program Files\FastestVPN\Resources\data\is-HMKT1.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp
File Type:	PEM certificate
Category:	dropped
Size (bytes):	1912
Entropy (8bit):	6.013187457463572
Encrypted:	false
SSDEEP:	48:LrZOGn3n3+NKHqtdSLuARqhs9WWRR21mB4LearXRvW:Lrz3nnYhhfwc1eCearhvW
MD5:	94F25D41487F654EF2371FA92544003C
SHA1:	41A561AA773A21C240F74AF4F14DB7FB2479F630
SHA-256:	E6A1EEFBCA63DDCE20065B080C202BF63686F473B91F2C64461434AFD071018C
SHA-512:	281DCBF7852E3B81B3E09A889045C2B4357F684B4F511835A874BC98DEC7D4A77AD1EC1C0FE1D55D9616670278715FBFE9772F2518C3861933F6C392B6A939A4
Malicious:	false
Preview:	-----BEGIN CERTIFICATE-----..MIIFQjCCAyqgAwIBAgIIUfxepT+rr8owDQYJKoZIhvcNAQEMBQAwPzELMAkGA1UE..BhMCS1kxEzARBgNVBAoTCkZhc3Rlc3RWUE4xGzAZBgNVBAMTEkZhc3Rlc3RWUE4g..Um9vdCBDQTAeFw0xNzA5MTYwMDAxNDZaFw0yNzA5MTQwMDAxNDZaMD8xCzAJBgNV..BAYTAktZMRMwEQYDVQQKEwpGYXN0ZXN0VlBOMRswGQYDVQQDExJGYXN0ZXN0VlBO..IFJvb3QgQ0EwggIiMA0GCSqGSIb3DQEBAQUAA4ICDwAwggIKAoICAQC1Xj+WfPTo..zFynFqc+c3CVrggIllaXEl5bY5VgFynXkqCTM6lSrfC4pNjGXUbqWe6RnGJbM4/6..kUn+lQDjFSQV1rzP2eDS8+r5+X2WXh4AoeNRUWhvSG+HiHD/B2EFK+Nd5BRSdUjp..KWAtsCmT2bBt7nT0jN1OdeNrLJeyF8siAqv/oQzKznF9aIe/N01b2M8ZOFTzoXi2..fZAckgGWui8NB/lzkVIJqSkAPRL8qiJLuRCPVOX1PFD8vV//R8/QumtfbcYBMo6v..Ck2HmWdrh5OQHPxb3KJtbtG+Z1j8x6HGEAe17djYepBiRMyCEQvYgfD6tvFylc4I..quhqE9yaP60PJod5TxpWnRQ6HIGSeBm+S+rYSMalTZ8+pUqOOA+IQCYpfpx6EKIJ..L/VsW2C7cXdvudxDhXPI5lR/QidCb9Ohq3WkfxXaYwzrngdg2avmNqId9R4KESuM..9GoHW0dszfyBCh5wYfeaffMElfDam3B92NUwyhZwtIiv623WVXY9PPz+EDjSJsIA..u2Vi1vdJyA4nD4k9Lwmx/1zTc/UaYVLsiBqL2WdfvFTeoWoV+dNxQXSEPhB8gwi8..x4O4lZW0cwVy/6fa8KMY8gZbcbSTr7U5bRERfW8l+jY+mYK

C:\Program Files\FastestVPN\Resources\data\is-NI40A.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp
File Type:	PEM certificate
Category:	dropped
Size (bytes):	1912
Entropy (8bit):	6.013187457463572
Encrypted:	false
SSDEEP:	48:LrZOGn3n3+NKHqtdSLuARqhs9WWRR21mB4LearXRvW:Lrz3nnYhhfwc1eCearhvW
MD5:	94F25D41487F654EF2371FA92544003C
SHA1:	41A561AA773A21C240F74AF4F14DB7FB2479F630
SHA-256:	E6A1EEFBCA63DDCE20065B080C202BF63686F473B91F2C64461434AFD071018C
SHA-512:	281DCBF7852E3B81B3E09A889045C2B4357F684B4F511835A874BC98DEC7D4A77AD1EC1C0FE1D55D9616670278715FBFE9772F2518C3861933F6C392B6A939A4
Malicious:	false
Preview:	-----BEGIN CERTIFICATE-----..MIIFQjCCAyqgAwIBAgIIUfxepT+rr8owDQYJKoZIhvcNAQEMBQAwPzELMAkGA1UE..BhMCS1kxEzARBgNVBAoTCkZhc3Rlc3RWUE4xGzAZBgNVBAMTEkZhc3Rlc3RWUE4g..Um9vdCBDQTAeFw0xNzA5MTYwMDAxNDZaFw0yNzA5MTQwMDAxNDZaMD8xCzAJBgNV..BAYTAktZMRMwEQYDVQQKEwpGYXN0ZXN0VlBOMRswGQYDVQQDExJGYXN0ZXN0VlBO..IFJvb3QgQ0EwggIiMA0GCSqGSIb3DQEBAQUAA4ICDwAwggIKAoICAQC1Xj+WfPTo..zFynFqc+c3CVrggIllaXEl5bY5VgFynXkqCTM6lSrfC4pNjGXUbqWe6RnGJbM4/6..kUn+lQDjFSQV1rzP2eDS8+r5+X2WXh4AoeNRUWhvSG+HiHD/B2EFK+Nd5BRSdUjp..KWAtsCmT2bBt7nT0jN1OdeNrLJeyF8siAqv/oQzKznF9aIe/N01b2M8ZOFTzoXi2..fZAckgGWui8NB/lzkVIJqSkAPRL8qiJLuRCPVOX1PFD8vV//R8/QumtfbcYBMo6v..Ck2HmWdrh5OQHPxb3KJtbtG+Z1j8x6HGEAe17djYepBiRMyCEQvYgfD6tvFylc4I..quhqE9yaP60PJod5TxpWnRQ6HIGSeBm+S+rYSMalTZ8+pUqOOA+IQCYpfpx6EKIJ..L/VsW2C7cXdvudxDhXPI5lR/QidCb9Ohq3WkfxXaYwzrngdg2avmNqId9R4KESuM..9GoHW0dszfyBCh5wYfeaffMElfDam3B92NUwyhZwtIiv623WVXY9PPz+EDjSJsIA..u2Vi1vdJyA4nD4k9Lwmx/1zTc/UaYVLsiBqL2WdfvFTeoWoV+dNxQXSEPhB8gwi8..x4O4lZW0cwVy/6fa8KMY8gZbcbSTr7U5bRERfW8l+jY+mYK

C:\Program Files\FastestVPN\Resources\data\tcp.tls (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	618
Entropy (8bit):	4.532694766524299
Encrypted:	false
SSDEEP:	12:LrkTt/+xYnhEKMhS64Ar24EgJroQXj2OrcV7TdRwPXYGFc6895C1v:LrkTtcYnhEKoP4AK4EgJkCj2OrnoGFFx
MD5:	005BF2A1B29FB74EF9ED7402A69D5CD5
SHA1:	ADEFC73E4B4F34F304E78FD4DB2D3B6AD09C6AF7
SHA-256:	F7FE79400908B148EB8E8AF16B0F1AFDF7CBCD33DCE23F96177473D0BF11DAFF
SHA-512:	381CA1E2146A66D1ACC46F7E9F9081962BB96014C10EB5AA0AE60478B8DD902F1975D63AEE18675B95A71D90594338753D8C91CD21ED0939237562E61D0D3D69
Malicious:	false
Preview:	-----BEGIN OpenVPN Static key V1-----..697fe793b32cb5091d30f2326d5d124a..9412e93d0a44ef7361395d76528fcbfc..82c3859dccea70a93cfa8fae409709bf..f75f844cf5ff0c237f426d0c20969233..db0e706edb6bdf195ec3dc11b3f76bc8..07a77e74662d9a800c8cd1144ebb67b7..f0d3f1281d1baf522bfe03b7c3f963b1..364fc0769400e413b61ca7b43ab19fac..9e0f77e41efd4bda7fd77b1de2d7d785..5cbbe3e620cecceac72c21a825b243e6..51f44d90e290e09c3ad650de8fca99c8..58bc7caad584bc69b11e5c9fd9381c69..c505ec487a65912c672d83ed0113b5a7..4ddfbd3ab33b3683cec593557520a72c..4d6cce46111f56f3396cc3ce7183edce..553c68ea0796cf6c4375fad00aaa2a42..-----END OpenVPN Static key V1-----

C:\Program Files\FastestVPN\Resources\data\udp.tls (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	618
Entropy (8bit):	4.532694766524299
Encrypted:	false
SSDEEP:	12:LrkTt/+xYnhEKMhS64Ar24EgJroQXj2OrcV7TdRwPXYGFc6895C1v:LrkTtcYnhEKoP4AK4EgJkCj2OrnoGFFx
MD5:	005BF2A1B29FB74EF9ED7402A69D5CD5
SHA1:	ADEFC73E4B4F34F304E78FD4DB2D3B6AD09C6AF7
SHA-256:	F7FE79400908B148EB8E8AF16B0F1AFDF7CBCD33DCE23F96177473D0BF11DAFF
SHA-512:	381CA1E2146A66D1ACC46F7E9F9081962BB96014C10EB5AA0AE60478B8DD902F1975D63AEE18675B95A71D90594338753D8C91CD21ED0939237562E61D0D3D69
Malicious:	false
Preview:	-----BEGIN OpenVPN Static key V1-----..697fe793b32cb5091d30f2326d5d124a..9412e93d0a44ef7361395d76528fcbfc..82c3859dccea70a93cfa8fae409709bf..f75f844cf5ff0c237f426d0c20969233..db0e706edb6bdf195ec3dc11b3f76bc8..07a77e74662d9a800c8cd1144ebb67b7..f0d3f1281d1baf522bfe03b7c3f963b1..364fc0769400e413b61ca7b43ab19fac..9e0f77e41efd4bda7fd77b1de2d7d785..5cbbe3e620cecceac72c21a825b243e6..51f44d90e290e09c3ad650de8fca99c8..58bc7caad584bc69b11e5c9fd9381c69..c505ec487a65912c672d83ed0113b5a7..4ddfbd3ab33b3683cec593557520a72c..4d6cce46111f56f3396cc3ce7183edce..553c68ea0796cf6c4375fad00aaa2a42..-----END OpenVPN Static key V1-----

C:\Program Files\FastestVPN\Resources\desktop_drop_plugin.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	321936
Entropy (8bit):	6.249416182192696
Encrypted:	false
SSDEEP:	6144:49C2dRHqGR0N9BdVLATWWFQEDyhNSDEAIjUoMfqC9ulMdUBIKL:Z2dRHqGRyhAT9FxoSIAIx/C9ulMe2KL
MD5:	5C1752EF16C7E3B28D9662E3C08FB08F
SHA1:	4B3F3BE508D4C6CD8374FBB812EE30E99F8128C0
SHA-256:	1BF45DF354D53D400EAF644E205DADDB0C07B408EB0C03D8CCFF765BD6659FB3
SHA-512:	296F8AA642527C3A2364B9FA0E1C9F3EE3B7AD6F82D51685F71601F4E4A0E5DA5327FF1E1884F6264E7961417D54028B4E9BBE1B836968FF0F9D6685EBEE0327
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 62%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........Z.H.;...;...;..6K...;..6K..q;.......;.......;.......;..6K...;..6K...;...G...;...;...;.......;.......;....p..;.......;..Rich.;..........................PE..d...O.wf.........." ...(............0....................................... ......h1....`..........................................t..t...Du..x................-..............................................(.......@............@...............................text...,(......................... ..`.rdata..rC...@...D..................@..@.data...x7....... ...r..............@....pdata...-..........................@..@.rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................

C:\Program Files\FastestVPN\Resources\desktop_multi_window_plugin.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	397712
Entropy (8bit):	6.40156340476818
Encrypted:	false
SSDEEP:	12288:ThaEhq4cY0f8IlE6BZR2nUx9lYOUgLZUrd:T4EhqR5lE6xSUx9lYOUg6rd
MD5:	42C063882FD7CEDD3CC62356450D8987
SHA1:	A09DB77F70A6F7D7C59418FC08250A8E13E8A60D
SHA-256:	37D1EBFC8F423BF02DEC598C6421E4124C8C5666C27782180D84003039E88DFF
SHA-512:	77AC9C670F91059B2CAA12DA9B5417CD71D525F900B7DDA51FFCF499AA2882734B342F6803814C6FDE1B527C9742ED9CF67AB1EE8D141CB437B57C979D89B456
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......Q{.?...l...l...l.j.m...l.j.m...l.j.m...l..m...l..m...l..mY..l.j.m...l.f.m...l...m...l...l...l...m...l...m...l..zl...l...l...l...m...lRich...l........PE..d...j.wf.........." ...(.....L......l........................................0......E.....`..........................................*......x+..........h[.......3........... ..`...............................(...p...@............................................text...\|........................... ..`.rdata...o.......p..................@..@.data....?...@...(...2..............@....pdata...3.......4...Z..............@..@.rsrc...h[.......\..................@..@.reloc..`.... ......................@..B........................................................................................................................................................................................................................

C:\Program Files\FastestVPN\Resources\devcon.exe (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp
File Type:	PE32+ executable (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	93832
Entropy (8bit):	5.48517352660103
Encrypted:	false
SSDEEP:	1536:kP2K0pa0WfEYp9Y/XQhpgnbP212YCJpDhiF4O7WGHK/CT:kePOYe4bu1epDh8RWGHK/M
MD5:	A2ADF4897942B99FE0738F8C37FD15C0
SHA1:	4192A2221F5C48A16427BF1898C0443CA27A29BB
SHA-256:	B339B9A93A93B52F3EA0A5F2161E4B16BDA0CA7396D53ECA14C7D7F3E963A3A3
SHA-512:	DF383B4B70C980C613F3C3EC4E99980DA6DB15F123D617197B644314233D1E2ADEC9F9162D6DBB7B874D885119082E01840102F0976F3CC767A78B5E467EF4A8
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........X...9...9...9...AF..9...AW..9...A@..9...9..f9...AP.9...AY..9.......9...AG..9...AB..9..Rich.9..........................PE..d.....pK.........."......~...........s.......................................p......r.....@.......... ......................................X}..........p.......T....@.......`......0................................................................................text....\|.......~.................. ..`.data...x...........................@....pdata..T...........................@..@.rsrc...p...........................@..@.reloc..p....`.......>..............@..B................................................................................................................................................................................................................................................................................................

C:\Program Files\FastestVPN\Resources\driver\install_tap.bat (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp
File Type:	DOS batch file, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	316
Entropy (8bit):	5.3985610361996965
Encrypted:	false
SSDEEP:	6:kCaFvHBvyXOBS7WFNiKGWxtfGT26BuXFoAyzyFEQRFQ1jt0V09:k9vBv5Y7WCKGWXOT7/+iQjOh0W
MD5:	259CE13E63C08F5198A5D7337DCCC0C0
SHA1:	E25C50EFBC8AF1D70BB42C72CB0D0246EBF6BCBC
SHA-256:	CE97CB0477C8F8F626A50B6935EB817062EC69136443E1F62691700CBC0D4456
SHA-512:	AD5319E8941E90D9C2FA60AD18B8061CAC31D0EE39DFDC1494E1A2B0A1F57AB661F034E6D60D8421FE07FB395B4FAF4F72B1C3C6E9459277A13961FC5EDB2CCC
Malicious:	false
Preview:	@echo OFF..@cd /d %~dp0..set OS=windows;....reg Query "HKLM\Hardware\Description\System\CentralProcessor\0" \| find /i "x86" > NUL && set ARCH=i386 \|\| set ARCH=amd64....for /f "tokens=4-5 delims=. " %%i in ('ver') do set VERSION=%%i.%%j..if "%version%" == "10.0" set OS=windows10......call %OS%\%ARCH%\install_tap.bat

C:\Program Files\FastestVPN\Resources\driver\is-90S23.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp
File Type:	DOS batch file, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	302
Entropy (8bit):	5.3909078265911585
Encrypted:	false
SSDEEP:	6:6vyXOBS7WFNiKGWxtfGT26BuXFoAyzyFEQRFQ1OoKG9:6v5Y7WCKGWXOT7/+iQjOOo1
MD5:	6D857A141F9C245E6ACD7012120A0704
SHA1:	66666950BDB2486C58B1C2D11132A98BF3A54EA8
SHA-256:	992D1891016B4C45BACB4DB700195096F438BB10070484D63088F52E8063EEF7
SHA-512:	8ACE3FA96B4FDA7B036A12EBF8DFC3E8C1FFCF212ED8F2A60FEB64806C26AABF926FF3D02D656EECE10B6F760F846E4196A9116FFF83BC00408697F7C3EEE180
Malicious:	false
Preview:	@echo OFF..set OS=windows;....reg Query "HKLM\Hardware\Description\System\CentralProcessor\0" \| find /i "x86" > NUL && set ARCH=i386 \|\| set ARCH=amd64....for /f "tokens=4-5 delims=. " %%i in ('ver') do set VERSION=%%i.%%j..if "%version%" == "10.0" set OS=windows10....call %OS%\%ARCH%\uninstall_tap.bat

C:\Program Files\FastestVPN\Resources\driver\is-SAIVV.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp
File Type:	DOS batch file, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	316
Entropy (8bit):	5.3985610361996965
Encrypted:	false
SSDEEP:	6:kCaFvHBvyXOBS7WFNiKGWxtfGT26BuXFoAyzyFEQRFQ1jt0V09:k9vBv5Y7WCKGWXOT7/+iQjOh0W
MD5:	259CE13E63C08F5198A5D7337DCCC0C0
SHA1:	E25C50EFBC8AF1D70BB42C72CB0D0246EBF6BCBC
SHA-256:	CE97CB0477C8F8F626A50B6935EB817062EC69136443E1F62691700CBC0D4456
SHA-512:	AD5319E8941E90D9C2FA60AD18B8061CAC31D0EE39DFDC1494E1A2B0A1F57AB661F034E6D60D8421FE07FB395B4FAF4F72B1C3C6E9459277A13961FC5EDB2CCC
Malicious:	false
Preview:	@echo OFF..@cd /d %~dp0..set OS=windows;....reg Query "HKLM\Hardware\Description\System\CentralProcessor\0" \| find /i "x86" > NUL && set ARCH=i386 \|\| set ARCH=amd64....for /f "tokens=4-5 delims=. " %%i in ('ver') do set VERSION=%%i.%%j..if "%version%" == "10.0" set OS=windows10......call %OS%\%ARCH%\install_tap.bat

C:\Program Files\FastestVPN\Resources\driver\uninstall_tap.bat (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp
File Type:	DOS batch file, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	302
Entropy (8bit):	5.3909078265911585
Encrypted:	false
SSDEEP:	6:6vyXOBS7WFNiKGWxtfGT26BuXFoAyzyFEQRFQ1OoKG9:6v5Y7WCKGWXOT7/+iQjOOo1
MD5:	6D857A141F9C245E6ACD7012120A0704
SHA1:	66666950BDB2486C58B1C2D11132A98BF3A54EA8
SHA-256:	992D1891016B4C45BACB4DB700195096F438BB10070484D63088F52E8063EEF7
SHA-512:	8ACE3FA96B4FDA7B036A12EBF8DFC3E8C1FFCF212ED8F2A60FEB64806C26AABF926FF3D02D656EECE10B6F760F846E4196A9116FFF83BC00408697F7C3EEE180
Malicious:	false
Preview:	@echo OFF..set OS=windows;....reg Query "HKLM\Hardware\Description\System\CentralProcessor\0" \| find /i "x86" > NUL && set ARCH=i386 \|\| set ARCH=amd64....for /f "tokens=4-5 delims=. " %%i in ('ver') do set VERSION=%%i.%%j..if "%version%" == "10.0" set OS=windows10....call %OS%\%ARCH%\uninstall_tap.bat

C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\OemVista.inf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp
File Type:	Windows setup INFormation
Category:	dropped
Size (bytes):	7537
Entropy (8bit):	5.046488463217706
Encrypted:	false
SSDEEP:	192:wr8tW9yCTi3K4vlQd22bjR+iAUC7bdP+io3DcNSj6jvKFkinuEQTXvzLd4Z:LWlGMdkxzo3DcNSj6jvKFkinuEQTXvzq
MD5:	50D29CA2E3DDB8A696923420EC2AC4FA
SHA1:	D85F4E65FE10F13DED1780DDBD074EDFC75F2D25
SHA-256:	817DFF7F4944A255A0A33B8D74EB60A755D8D268CC7AFD46FCE41E102E0A004B
SHA-512:	03778A9CDDD23639C88E24BB5D0446DA3A400BB6B3321FB35887CD23D88D0F7AD3FE911642CC7F8D16D29CD9E42106851B0028379E8DBCB3C6721C238FC4A0D3
Malicious:	false
Preview:	; ***************************************************************************..; Copyright (C) 2002-2014 OpenVPN Technologies, Inc. ..; This program is free software; you can redistribute it and/or modify ..; it under the terms of the GNU General Public License version 2 ..; as published by the Free Software Foundation. ..; *************************************************************************....; SYNTAX CHECKER..; cd \WINDDK\3790\tools\chkinf..; chkinf c:\src\openvpn\tap-win32\i386\oemvista.inf..; OUTPUT -> file:///c:/WINDDK/3790/tools/chkinf/htm/c%23+src+openvpn+tap-win32+i386+__OemWin2k.htm....; INSTALL/REMOVE DRIVER..; tapinstall install OemVista.inf tapoas..; tapinstall update OemVista.inf tapoas..; tapinstall remove tapoas....;*******************************************************..; Note to Developers:..;..; If you are bundling the TAP-Windows driver with your app,..; you should try

C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\install_tap.bat (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp
File Type:	DOS batch file, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	228
Entropy (8bit):	4.832057381123706
Encrypted:	false
SSDEEP:	6:hiPFvPuaYkVVkZ0BNLllYYLV3GZ0Q/RLQ8NGN8BP:E9HuaYcyZcNLllYbZh/a8NGNc
MD5:	939DFFC36D36E4C85EE6703C812987E5
SHA1:	3BA5F451B1F5C269B4F51E847DA79A3C619CB9C9
SHA-256:	843C2DFB5FE8DFE7C5266F8F79D1E0AC0BA3E40D5C883D4AF879B6F273B7499E
SHA-512:	8958432897981533C2822AC7355D56FC490EB89157423FAA5DF13A5EC00E75A9E791A3ECF478561C3B13988C553FD739FD2047C37EF91972DBF61AB55D475314
Malicious:	false
Preview:	@echo off..@cd /d %~dp0..echo Removing old TAP driver.....tapinstall.exe remove tap0901 ..echo Installing TAP driver.....tapinstall.exe install OemVista.inf tap0901 ..echo TAP Driver Re-Installation completed successfully!..exit

C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\is-3MVJ1.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp
File Type:	Windows setup INFormation
Category:	dropped
Size (bytes):	7537
Entropy (8bit):	5.046488463217706
Encrypted:	false
SSDEEP:	192:wr8tW9yCTi3K4vlQd22bjR+iAUC7bdP+io3DcNSj6jvKFkinuEQTXvzLd4Z:LWlGMdkxzo3DcNSj6jvKFkinuEQTXvzq
MD5:	50D29CA2E3DDB8A696923420EC2AC4FA
SHA1:	D85F4E65FE10F13DED1780DDBD074EDFC75F2D25
SHA-256:	817DFF7F4944A255A0A33B8D74EB60A755D8D268CC7AFD46FCE41E102E0A004B
SHA-512:	03778A9CDDD23639C88E24BB5D0446DA3A400BB6B3321FB35887CD23D88D0F7AD3FE911642CC7F8D16D29CD9E42106851B0028379E8DBCB3C6721C238FC4A0D3
Malicious:	false
Preview:	; ***************************************************************************..; Copyright (C) 2002-2014 OpenVPN Technologies, Inc. ..; This program is free software; you can redistribute it and/or modify ..; it under the terms of the GNU General Public License version 2 ..; as published by the Free Software Foundation. ..; *************************************************************************....; SYNTAX CHECKER..; cd \WINDDK\3790\tools\chkinf..; chkinf c:\src\openvpn\tap-win32\i386\oemvista.inf..; OUTPUT -> file:///c:/WINDDK/3790/tools/chkinf/htm/c%23+src+openvpn+tap-win32+i386+__OemWin2k.htm....; INSTALL/REMOVE DRIVER..; tapinstall install OemVista.inf tapoas..; tapinstall update OemVista.inf tapoas..; tapinstall remove tapoas....;*******************************************************..; Note to Developers:..;..; If you are bundling the TAP-Windows driver with your app,..; you should try

C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\is-6LAFJ.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp
File Type:	PE32+ executable (native) x86-64, for MS Windows
Category:	dropped
Size (bytes):	39920
Entropy (8bit):	6.333649052940754
Encrypted:	false
SSDEEP:	768:bCxLEO/+ApBG35KBOXZZoZmTD11a+uiExMFYQjdJxh63NOe:tCI46F1a+jExMFFjzv69
MD5:	059E578D456043A8C3B76EC365B375F3
SHA1:	42189B6A1B8C736397113BFC2283F5E1E1A44E8E
SHA-256:	A0170CF78105CE757E0549D79E4AE7C412240E8B81D262A24D76A047F181F881
SHA-512:	99E6B6AF018D0E3509D9DBE00301A7D5D6645A2070A8144ACFF04842F8BBACCD81E7651578D08F47639CD2B7D00EB64ACDDFA8725BCE9A073580B7FCF7964E6A
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........~..[...[...[....w..Z....w..^...[...m....w.._....w..^.../t..Q.../t..Z.../t..Z...Rich[...........................PE..d......].........."......Z.....................@....................................P.....`A....................................................<.......X....p..H....x...#...........R..8............................S...............P...............................text...W>.......@.................. ..h.rdata..\|....P.......D..............@..H.data........`.......P..............@....pdata..H....p.......R..............@..HPAGE.................V.............. ..`INIT.................d.............. ..b.rsrc...X............p..............@..B.reloc...............v..............@..B................................................................................................................................................................................

C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\is-9C393.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp
File Type:	DOS batch file, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	142
Entropy (8bit):	4.838122400792552
Encrypted:	false
SSDEEP:	3:mKDD2G2FuyPuCkjLoOMXrHt9QVVkUoYmdFwLMiREl32AGN8BvAOA:hiPFvPullYkVVkxYmQLNREVNGN8B6
MD5:	012961E4DD4402DA78BC174AF09B77F9
SHA1:	900CA53983FAA217DD134664A9E694138E9A6FDF
SHA-256:	E7D73C9323599320AFA243DB5313F1A55ADFC34EDE66A4A656CA9172BF3C273D
SHA-512:	332A6BA6D1923A020DDB36E6E6FA80141B737ECC51EE52EE0D147B85DBC95DD3E97DA20083EAB3F5218DD9F4CA37DA986D35989F251F72C2512A42CBB6B462B9
Malicious:	false
Preview:	@echo off..@cd /d %~dp0..echo Removing TAP driver.....tapinstall.exe remove tap0901..echo TAP Driver Uninstall completed successfully!..exit..

C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\is-DDCD3.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp
File Type:	data
Category:	dropped
Size (bytes):	10711
Entropy (8bit):	7.2254581318251425
Encrypted:	false
SSDEEP:	192:PqDhDNF748XJCO39JnxrEwJqKkhYCxXA6qnaj/rHr:OXPJxXxkh3xXhlzX
MD5:	225E7BA0E5E2D46813E5C858A4D0D5B0
SHA1:	5DD49014764F634164520583FD0CEC87AB1A1625
SHA-256:	B0BAF5CB84FA4ACB34B77A6231052061DA6B8676D216833724B7A602622161FB
SHA-512:	9C77ADF7E71ACA94489DFEB536F796A017B7C05771962274BAE2C614E2AE6799CCEB36CC58AC470184C37F52DEAC75988BB14E6A329F432C6D7CEDBCA18272A8
Malicious:	false
Preview:	0.)....H........).0.)....1.0...`.H.e......0..M..+.....7.....>0..:0...+.....7..........dG.'$....g..191023085812Z0...+.....7.....0..T0.... .}..ID.U..;.t.`.U..h.z.F.......K1..0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.:.1.0...0...0<..+.....7...1.0,...F.i.l.e........o.e.m.v.i.s.t.a...i.n.f...0U..+.....7...1G0E0...+.....7.......010...`.H.e....... .}..ID.U..;.t.`.U..h.z.F.......K0....._Ne...=.....N.._-%1..0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.:.1.0...0...0<..+.....7...1.0,...F.i.l.e........o.e.m.v.i.s.t.a...i.n.f...0.....D.......L..S.4..b.1..0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.:.1.0...0...0:..+.....7...1,0...F.i.l.e........t.a.p.0.9.0.1...s.y.s...0.... .?;..{.x....H..4...k).VB.......1..0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.:.1.0...0...0:..+.....7...1,0*...F.i.l.e........t.a.p.0.9.0.1...s.y.s...0]..+.....7...1O0M0...+.....7...0...........010...`.H.e....... .?;..{.x....H..4...k).VB...........0...0....+.

C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\is-ISUTF.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp
File Type:	PE32+ executable (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	507728
Entropy (8bit):	6.351404653031349
Encrypted:	false
SSDEEP:	3072:6VF7vR03+4YnfLU6wXnSmZb3lKm34AJ9Qvtk1Ai8mTnu5gtZXqg7VcoyUyHi6/Cw:6VXU/3TNfAkTnrZqkyh/agGxwNdUo1h
MD5:	E313336C82EB265542664CC7A360C5FF
SHA1:	184211A456E09AC606DB76F814332CC912C0F5EB
SHA-256:	B6B33F4CD19C606E4C616F08C11FD4AE775ACCB24B78EF66EB31C279CA403381
SHA-512:	F156F2F55AF7026F5B3D2C5634806C5764FD230521D71969E80BBF6F6571730636DD5F6FE6C1138FA742E12003E5CC5F7D82E729EF7506057F8B510384E52386
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......N....cv..cv..cv.Q.r..cv.Q.u..cv.Q.s..cv...s.#cv...r..cv...u..cv.Q.w..cv..cw..cv.~.s..cv.~....cv..c...cv.~.t..cv.Rich.cv.................PE..d......]..........".........d.......z.........@..........................................`..................................................S..x............... L...x..PG......D.......T............................................@...............................text....)......................... ..`.rdata...%...@...&..................@..@.data....(...p.......T..............@....pdata.. L.......N...d..............@..@_RDATA..............................@..@.rsrc...............................@..@.reloc..D............n..............@..B................................................................................................................................................................................................

C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\is-P6RB9.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp
File Type:	DOS batch file, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	228
Entropy (8bit):	4.832057381123706
Encrypted:	false
SSDEEP:	6:hiPFvPuaYkVVkZ0BNLllYYLV3GZ0Q/RLQ8NGN8BP:E9HuaYcyZcNLllYbZh/a8NGNc
MD5:	939DFFC36D36E4C85EE6703C812987E5
SHA1:	3BA5F451B1F5C269B4F51E847DA79A3C619CB9C9
SHA-256:	843C2DFB5FE8DFE7C5266F8F79D1E0AC0BA3E40D5C883D4AF879B6F273B7499E
SHA-512:	8958432897981533C2822AC7355D56FC490EB89157423FAA5DF13A5EC00E75A9E791A3ECF478561C3B13988C553FD739FD2047C37EF91972DBF61AB55D475314
Malicious:	false
Preview:	@echo off..@cd /d %~dp0..echo Removing old TAP driver.....tapinstall.exe remove tap0901 ..echo Installing TAP driver.....tapinstall.exe install OemVista.inf tap0901 ..echo TAP Driver Re-Installation completed successfully!..exit

C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tap0901.cat (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp
File Type:	data
Category:	dropped
Size (bytes):	10711
Entropy (8bit):	7.2254581318251425
Encrypted:	false
SSDEEP:	192:PqDhDNF748XJCO39JnxrEwJqKkhYCxXA6qnaj/rHr:OXPJxXxkh3xXhlzX
MD5:	225E7BA0E5E2D46813E5C858A4D0D5B0
SHA1:	5DD49014764F634164520583FD0CEC87AB1A1625
SHA-256:	B0BAF5CB84FA4ACB34B77A6231052061DA6B8676D216833724B7A602622161FB
SHA-512:	9C77ADF7E71ACA94489DFEB536F796A017B7C05771962274BAE2C614E2AE6799CCEB36CC58AC470184C37F52DEAC75988BB14E6A329F432C6D7CEDBCA18272A8
Malicious:	false
Preview:	0.)....H........).0.)....1.0...`.H.e......0..M..+.....7.....>0..:0...+.....7..........dG.'$....g..191023085812Z0...+.....7.....0..T0.... .}..ID.U..;.t.`.U..h.z.F.......K1..0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.:.1.0...0...0<..+.....7...1.0,...F.i.l.e........o.e.m.v.i.s.t.a...i.n.f...0U..+.....7...1G0E0...+.....7.......010...`.H.e....... .}..ID.U..;.t.`.U..h.z.F.......K0....._Ne...=.....N.._-%1..0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.:.1.0...0...0<..+.....7...1.0,...F.i.l.e........o.e.m.v.i.s.t.a...i.n.f...0.....D.......L..S.4..b.1..0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.:.1.0...0...0:..+.....7...1,0...F.i.l.e........t.a.p.0.9.0.1...s.y.s...0.... .?;..{.x....H..4...k).VB.......1..0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.:.1.0...0...0:..+.....7...1,0*...F.i.l.e........t.a.p.0.9.0.1...s.y.s...0]..+.....7...1O0M0...+.....7...0...........010...`.H.e....... .?;..{.x....H..4...k).VB...........0...0....+.

C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tap0901.sys (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp
File Type:	PE32+ executable (native) x86-64, for MS Windows
Category:	dropped
Size (bytes):	39920
Entropy (8bit):	6.333649052940754
Encrypted:	false
SSDEEP:	768:bCxLEO/+ApBG35KBOXZZoZmTD11a+uiExMFYQjdJxh63NOe:tCI46F1a+jExMFFjzv69
MD5:	059E578D456043A8C3B76EC365B375F3
SHA1:	42189B6A1B8C736397113BFC2283F5E1E1A44E8E
SHA-256:	A0170CF78105CE757E0549D79E4AE7C412240E8B81D262A24D76A047F181F881
SHA-512:	99E6B6AF018D0E3509D9DBE00301A7D5D6645A2070A8144ACFF04842F8BBACCD81E7651578D08F47639CD2B7D00EB64ACDDFA8725BCE9A073580B7FCF7964E6A
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........~..[...[...[....w..Z....w..^...[...m....w.._....w..^.../t..Q.../t..Z.../t..Z...Rich[...........................PE..d......].........."......Z.....................@....................................P.....`A....................................................<.......X....p..H....x...#...........R..8............................S...............P...............................text...W>.......@.................. ..h.rdata..\|....P.......D..............@..H.data........`.......P..............@....pdata..H....p.......R..............@..HPAGE.................V.............. ..`INIT.................d.............. ..b.rsrc...X............p..............@..B.reloc...............v..............@..B................................................................................................................................................................................

C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exe (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp
File Type:	PE32+ executable (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	507728
Entropy (8bit):	6.351404653031349
Encrypted:	false
SSDEEP:	3072:6VF7vR03+4YnfLU6wXnSmZb3lKm34AJ9Qvtk1Ai8mTnu5gtZXqg7VcoyUyHi6/Cw:6VXU/3TNfAkTnrZqkyh/agGxwNdUo1h
MD5:	E313336C82EB265542664CC7A360C5FF
SHA1:	184211A456E09AC606DB76F814332CC912C0F5EB
SHA-256:	B6B33F4CD19C606E4C616F08C11FD4AE775ACCB24B78EF66EB31C279CA403381
SHA-512:	F156F2F55AF7026F5B3D2C5634806C5764FD230521D71969E80BBF6F6571730636DD5F6FE6C1138FA742E12003E5CC5F7D82E729EF7506057F8B510384E52386
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......N....cv..cv..cv.Q.r..cv.Q.u..cv.Q.s..cv...s.#cv...r..cv...u..cv.Q.w..cv..cw..cv.~.s..cv.~....cv..c...cv.~.t..cv.Rich.cv.................PE..d......]..........".........d.......z.........@..........................................`..................................................S..x............... L...x..PG......D.......T............................................@...............................text....)......................... ..`.rdata...%...@...&..................@..@.data....(...p.......T..............@....pdata.. L.......N...d..............@..@_RDATA..............................@..@.rsrc...............................@..@.reloc..D............n..............@..B................................................................................................................................................................................................

C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\uninstall_tap.bat (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp
File Type:	DOS batch file, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	142
Entropy (8bit):	4.838122400792552
Encrypted:	false
SSDEEP:	3:mKDD2G2FuyPuCkjLoOMXrHt9QVVkUoYmdFwLMiREl32AGN8BvAOA:hiPFvPullYkVVkxYmQLNREVNGN8B6
MD5:	012961E4DD4402DA78BC174AF09B77F9
SHA1:	900CA53983FAA217DD134664A9E694138E9A6FDF
SHA-256:	E7D73C9323599320AFA243DB5313F1A55ADFC34EDE66A4A656CA9172BF3C273D
SHA-512:	332A6BA6D1923A020DDB36E6E6FA80141B737ECC51EE52EE0D147B85DBC95DD3E97DA20083EAB3F5218DD9F4CA37DA986D35989F251F72C2512A42CBB6B462B9
Malicious:	false
Preview:	@echo off..@cd /d %~dp0..echo Removing TAP driver.....tapinstall.exe remove tap0901..echo TAP Driver Uninstall completed successfully!..exit..

C:\Program Files\FastestVPN\Resources\driver\windows10\i386\OemVista.inf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp
File Type:	Windows setup INFormation
Category:	dropped
Size (bytes):	7533
Entropy (8bit):	5.046821594517318
Encrypted:	false
SSDEEP:	192:wr8tW9yCTi3K4vlP2bjR+iAUC7bdP+io3DcNSj6jvKFkinuEQTXvzLd4Z:LWlGTxzo3DcNSj6jvKFkinuEQTXvzaZ
MD5:	3A541F2BF9842CDE6F0C95E83DE14FFA
SHA1:	12C074F03AA19968893F2BE48FDEF42A293B7EE4
SHA-256:	598EAD8481136AB0C8C99E67CA30841DB3C32417B45D6FEEDE04802DB0C4C320
SHA-512:	F060851D26E978AFA6AC632E74C221FB837FDEEE7752762BEE210D7BE144195A27514E108EF8C19A642BC03486E94721BD1B9D4AC69DB26BD892DCAA7894D3D2
Malicious:	false
Preview:	; ***************************************************************************..; Copyright (C) 2002-2014 OpenVPN Technologies, Inc. ..; This program is free software; you can redistribute it and/or modify ..; it under the terms of the GNU General Public License version 2 ..; as published by the Free Software Foundation. ..; *************************************************************************....; SYNTAX CHECKER..; cd \WINDDK\3790\tools\chkinf..; chkinf c:\src\openvpn\tap-win32\i386\oemvista.inf..; OUTPUT -> file:///c:/WINDDK/3790/tools/chkinf/htm/c%23+src+openvpn+tap-win32+i386+__OemWin2k.htm....; INSTALL/REMOVE DRIVER..; tapinstall install OemVista.inf tapoas..; tapinstall update OemVista.inf tapoas..; tapinstall remove tapoas....;*******************************************************..; Note to Developers:..;..; If you are bundling the TAP-Windows driver with your app,..; you should try

C:\Program Files\FastestVPN\Resources\driver\windows10\i386\install_tap.bat (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp
File Type:	DOS batch file, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	228
Entropy (8bit):	4.832057381123706
Encrypted:	false
SSDEEP:	6:hiPFvPuaYkVVkZ0BNLllYYLV3GZ0Q/RLQ8NGN8BP:E9HuaYcyZcNLllYbZh/a8NGNc
MD5:	939DFFC36D36E4C85EE6703C812987E5
SHA1:	3BA5F451B1F5C269B4F51E847DA79A3C619CB9C9
SHA-256:	843C2DFB5FE8DFE7C5266F8F79D1E0AC0BA3E40D5C883D4AF879B6F273B7499E
SHA-512:	8958432897981533C2822AC7355D56FC490EB89157423FAA5DF13A5EC00E75A9E791A3ECF478561C3B13988C553FD739FD2047C37EF91972DBF61AB55D475314
Malicious:	false
Preview:	@echo off..@cd /d %~dp0..echo Removing old TAP driver.....tapinstall.exe remove tap0901 ..echo Installing TAP driver.....tapinstall.exe install OemVista.inf tap0901 ..echo TAP Driver Re-Installation completed successfully!..exit

C:\Program Files\FastestVPN\Resources\driver\windows10\i386\is-0IO2E.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp
File Type:	DOS batch file, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	228
Entropy (8bit):	4.832057381123706
Encrypted:	false
SSDEEP:	6:hiPFvPuaYkVVkZ0BNLllYYLV3GZ0Q/RLQ8NGN8BP:E9HuaYcyZcNLllYbZh/a8NGNc
MD5:	939DFFC36D36E4C85EE6703C812987E5
SHA1:	3BA5F451B1F5C269B4F51E847DA79A3C619CB9C9
SHA-256:	843C2DFB5FE8DFE7C5266F8F79D1E0AC0BA3E40D5C883D4AF879B6F273B7499E
SHA-512:	8958432897981533C2822AC7355D56FC490EB89157423FAA5DF13A5EC00E75A9E791A3ECF478561C3B13988C553FD739FD2047C37EF91972DBF61AB55D475314
Malicious:	false
Preview:	@echo off..@cd /d %~dp0..echo Removing old TAP driver.....tapinstall.exe remove tap0901 ..echo Installing TAP driver.....tapinstall.exe install OemVista.inf tap0901 ..echo TAP Driver Re-Installation completed successfully!..exit

C:\Program Files\FastestVPN\Resources\driver\windows10\i386\is-5P6ME.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp
File Type:	PE32 executable (native) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	35008
Entropy (8bit):	6.574406479237283
Encrypted:	false
SSDEEP:	768:nNoBjjOOA4dR/uEvBbuALxQbaxJxh639o:No9jyGu+BxLObev6No
MD5:	77E134EBCD2C8EA7D217EBD61DAAA7B6
SHA1:	F907526D7F1ED81A6F05BA040DE9E5DBEA421C52
SHA-256:	CDC110B59A650CF576D7E059DDB1E171BDE50789DD14ABE1199340312177EEDE
SHA-512:	57C6FFBB7D6D45EB461E2EAFDFA7B01FAAD0130511ED0C07931112FB72F7B1B18829BE3EBF1577DE4337B271F13C5F16528E588807F47A5B483A9BB4BFE6790C
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........C..."..."..."...J..."...J..."...J..."..."..."...J..."...I..."...I."...I..."..Rich."..................PE..L...g..].................N...................P....@.......................................@A....................................P.......X............d...$.......... R..8...........................XR..@............P...............................text....7.......8.................. ..h.rdata..,....P.......<..............@..H.data........`.......B..............@...PAGE....[....p.......D.............. ..`INIT....T............P.............. ..b.rsrc...X............Z..............@..B.reloc...............`..............@..B................................................................................................................................................................................................................................................

C:\Program Files\FastestVPN\Resources\driver\windows10\i386\is-922TB.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp
File Type:	Windows setup INFormation
Category:	dropped
Size (bytes):	7533
Entropy (8bit):	5.046821594517318
Encrypted:	false
SSDEEP:	192:wr8tW9yCTi3K4vlP2bjR+iAUC7bdP+io3DcNSj6jvKFkinuEQTXvzLd4Z:LWlGTxzo3DcNSj6jvKFkinuEQTXvzaZ
MD5:	3A541F2BF9842CDE6F0C95E83DE14FFA
SHA1:	12C074F03AA19968893F2BE48FDEF42A293B7EE4
SHA-256:	598EAD8481136AB0C8C99E67CA30841DB3C32417B45D6FEEDE04802DB0C4C320
SHA-512:	F060851D26E978AFA6AC632E74C221FB837FDEEE7752762BEE210D7BE144195A27514E108EF8C19A642BC03486E94721BD1B9D4AC69DB26BD892DCAA7894D3D2
Malicious:	false
Preview:	; ***************************************************************************..; Copyright (C) 2002-2014 OpenVPN Technologies, Inc. ..; This program is free software; you can redistribute it and/or modify ..; it under the terms of the GNU General Public License version 2 ..; as published by the Free Software Foundation. ..; *************************************************************************....; SYNTAX CHECKER..; cd \WINDDK\3790\tools\chkinf..; chkinf c:\src\openvpn\tap-win32\i386\oemvista.inf..; OUTPUT -> file:///c:/WINDDK/3790/tools/chkinf/htm/c%23+src+openvpn+tap-win32+i386+__OemWin2k.htm....; INSTALL/REMOVE DRIVER..; tapinstall install OemVista.inf tapoas..; tapinstall update OemVista.inf tapoas..; tapinstall remove tapoas....;*******************************************************..; Note to Developers:..;..; If you are bundling the TAP-Windows driver with your app,..; you should try

C:\Program Files\FastestVPN\Resources\driver\windows10\i386\is-GNQS3.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	396840
Entropy (8bit):	6.504700092936786
Encrypted:	false
SSDEEP:	12288:mkska7m3uFm4uy6b10MtxnOrPdmBe3oIkm:mAawb109dmBK5
MD5:	D680D27DCC19546B721F731384EE56DD
SHA1:	B418C1B8CB5E8259F9C8CBED29676AD101A15425
SHA-256:	E64E59A011D45C5D9D93AC79305A060244796040FCFBA112D7F8218F945C7602
SHA-512:	B495D60E97A782EDA01833F3A45AC03E5F2E6E629D7117ED34E6EA411E85FD8A012C21BD793ED59D7B352F3AA7552209F46203680974CCB57D003A1C690F476B
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........b...1...1...1..0...1..0{..1..0.1C.0..1C.0.1C.0.1..0...1...1b..1..0...1..p1...1...1...1..0...1Rich...1........PE..L......].................<..........`m.......P....@.......................................@.....................................x.......................(H.......$......T...........................(...@............P..h............................text....;.......<.................. ..`.rdata..J....P.......@..............@..@.data...l...........................@....rsrc...............................@..@.reloc...$.......&..................@..B........................................................................................................................................................................................................................................................................................................

C:\Program Files\FastestVPN\Resources\driver\windows10\i386\is-SPFH5.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp
File Type:	data
Category:	dropped
Size (bytes):	10866
Entropy (8bit):	7.241389894622462
Encrypted:	false
SSDEEP:	192:LBDMDT23rJCeS39JnxrEwJqKkhYC9jOVKEwkqnajNkwIetug:LXdoJxXxkh39qVKtklJGNg
MD5:	6A3C291EB986A23B427ECF92779C6902
SHA1:	C96B9791A0F5AC27F84E2F3E06E64C8513168477
SHA-256:	C996AA42A022F1DE293F14445FEC7038A7CDC6AA2C4632C5CCA07ED53F88F762
SHA-512:	1FC247B10FB3717344174FC66EDD6ACC5DF171EDF9F70081715CA4C62499D6673B777B635EA043B397F6933201150E8D8EE28309BFA7F6F96326562D43BB6640
Malicious:	false
Preview:	0.n...H........_0.[...1.0...`.H.e......0.....+.....7......0...0...+.....7.....atM...lN....n>....191023090129Z0...+.....7.....0..T0......t.:..h.?+...);~.1..0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.:.1.0...0...0<..+.....7...1.0,...F.i.l.e........o.e.m.v.i.s.t.a...i.n.f...0.... Y.....j...g.0....$..]o....-... 1..0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.:.1.0...0...0<..+.....7...1.0,...F.i.l.e........o.e.m.v.i.s.t.a...i.n.f...0U..+.....7...1G0E0...+.....7.......010...`.H.e....... Y.....j...g.0....$..]o....-... 0.......R.....Q.8Y....1..0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.:.1.0...0...0:..+.....7...1,0...F.i.l.e........t.a.p.0.9.0.1...s.y.s...0.... ..xq....X.QO@....\|s6...xV. .,.1..0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.:.1.0...0...0:..+.....7...1,0...F.i.l.e........t.a.p.0.9.0.1...s.y.s...0]..+.....7...1O0M0...+.....7...0...........010...`.H.e....... ..xq....X.QO@....\|s6..*.xV. .,...e0..a0....+.

C:\Program Files\FastestVPN\Resources\driver\windows10\i386\is-T49GN.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp
File Type:	DOS batch file, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	142
Entropy (8bit):	4.838122400792552
Encrypted:	false
SSDEEP:	3:mKDD2G2FuyPuCkjLoOMXrHt9QVVkUoYmdFwLMiREl32AGN8BvAOA:hiPFvPullYkVVkxYmQLNREVNGN8B6
MD5:	012961E4DD4402DA78BC174AF09B77F9
SHA1:	900CA53983FAA217DD134664A9E694138E9A6FDF
SHA-256:	E7D73C9323599320AFA243DB5313F1A55ADFC34EDE66A4A656CA9172BF3C273D
SHA-512:	332A6BA6D1923A020DDB36E6E6FA80141B737ECC51EE52EE0D147B85DBC95DD3E97DA20083EAB3F5218DD9F4CA37DA986D35989F251F72C2512A42CBB6B462B9
Malicious:	false
Preview:	@echo off..@cd /d %~dp0..echo Removing TAP driver.....tapinstall.exe remove tap0901..echo TAP Driver Uninstall completed successfully!..exit..

C:\Program Files\FastestVPN\Resources\driver\windows10\i386\tap0901.cat (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp
File Type:	data
Category:	dropped
Size (bytes):	10866
Entropy (8bit):	7.241389894622462
Encrypted:	false
SSDEEP:	192:LBDMDT23rJCeS39JnxrEwJqKkhYC9jOVKEwkqnajNkwIetug:LXdoJxXxkh39qVKtklJGNg
MD5:	6A3C291EB986A23B427ECF92779C6902
SHA1:	C96B9791A0F5AC27F84E2F3E06E64C8513168477
SHA-256:	C996AA42A022F1DE293F14445FEC7038A7CDC6AA2C4632C5CCA07ED53F88F762
SHA-512:	1FC247B10FB3717344174FC66EDD6ACC5DF171EDF9F70081715CA4C62499D6673B777B635EA043B397F6933201150E8D8EE28309BFA7F6F96326562D43BB6640
Malicious:	false
Preview:	0.n...H........_0.[...1.0...`.H.e......0.....+.....7......0...0...+.....7.....atM...lN....n>....191023090129Z0...+.....7.....0..T0......t.:..h.?+...);~.1..0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.:.1.0...0...0<..+.....7...1.0,...F.i.l.e........o.e.m.v.i.s.t.a...i.n.f...0.... Y.....j...g.0....$..]o....-... 1..0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.:.1.0...0...0<..+.....7...1.0,...F.i.l.e........o.e.m.v.i.s.t.a...i.n.f...0U..+.....7...1G0E0...+.....7.......010...`.H.e....... Y.....j...g.0....$..]o....-... 0.......R.....Q.8Y....1..0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.:.1.0...0...0:..+.....7...1,0...F.i.l.e........t.a.p.0.9.0.1...s.y.s...0.... ..xq....X.QO@....\|s6...xV. .,.1..0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.:.1.0...0...0:..+.....7...1,0...F.i.l.e........t.a.p.0.9.0.1...s.y.s...0]..+.....7...1O0M0...+.....7...0...........010...`.H.e....... ..xq....X.QO@....\|s6..*.xV. .,...e0..a0....+.

C:\Program Files\FastestVPN\Resources\driver\windows10\i386\tap0901.sys (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp
File Type:	PE32 executable (native) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	35008
Entropy (8bit):	6.574406479237283
Encrypted:	false
SSDEEP:	768:nNoBjjOOA4dR/uEvBbuALxQbaxJxh639o:No9jyGu+BxLObev6No
MD5:	77E134EBCD2C8EA7D217EBD61DAAA7B6
SHA1:	F907526D7F1ED81A6F05BA040DE9E5DBEA421C52
SHA-256:	CDC110B59A650CF576D7E059DDB1E171BDE50789DD14ABE1199340312177EEDE
SHA-512:	57C6FFBB7D6D45EB461E2EAFDFA7B01FAAD0130511ED0C07931112FB72F7B1B18829BE3EBF1577DE4337B271F13C5F16528E588807F47A5B483A9BB4BFE6790C
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........C..."..."..."...J..."...J..."...J..."..."..."...J..."...I..."...I."...I..."..Rich."..................PE..L...g..].................N...................P....@.......................................@A....................................P.......X............d...$.......... R..8...........................XR..@............P...............................text....7.......8.................. ..h.rdata..,....P.......<..............@..H.data........`.......B..............@...PAGE....[....p.......D.............. ..`INIT....T............P.............. ..b.rsrc...X............Z..............@..B.reloc...............`..............@..B................................................................................................................................................................................................................................................

C:\Program Files\FastestVPN\Resources\driver\windows10\i386\tapinstall.exe (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	396840
Entropy (8bit):	6.504700092936786
Encrypted:	false
SSDEEP:	12288:mkska7m3uFm4uy6b10MtxnOrPdmBe3oIkm:mAawb109dmBK5
MD5:	D680D27DCC19546B721F731384EE56DD
SHA1:	B418C1B8CB5E8259F9C8CBED29676AD101A15425
SHA-256:	E64E59A011D45C5D9D93AC79305A060244796040FCFBA112D7F8218F945C7602
SHA-512:	B495D60E97A782EDA01833F3A45AC03E5F2E6E629D7117ED34E6EA411E85FD8A012C21BD793ED59D7B352F3AA7552209F46203680974CCB57D003A1C690F476B
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........b...1...1...1..0...1..0{..1..0.1C.0..1C.0.1C.0.1..0...1...1b..1..0...1..p1...1...1...1..0...1Rich...1........PE..L......].................<..........`m.......P....@.......................................@.....................................x.......................(H.......$......T...........................(...@............P..h............................text....;.......<.................. ..`.rdata..J....P.......@..............@..@.data...l...........................@....rsrc...............................@..@.reloc...$.......&..................@..B........................................................................................................................................................................................................................................................................................................

C:\Program Files\FastestVPN\Resources\driver\windows10\i386\uninstall_tap.bat (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp
File Type:	DOS batch file, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	142
Entropy (8bit):	4.838122400792552
Encrypted:	false
SSDEEP:	3:mKDD2G2FuyPuCkjLoOMXrHt9QVVkUoYmdFwLMiREl32AGN8BvAOA:hiPFvPullYkVVkxYmQLNREVNGN8B6
MD5:	012961E4DD4402DA78BC174AF09B77F9
SHA1:	900CA53983FAA217DD134664A9E694138E9A6FDF
SHA-256:	E7D73C9323599320AFA243DB5313F1A55ADFC34EDE66A4A656CA9172BF3C273D
SHA-512:	332A6BA6D1923A020DDB36E6E6FA80141B737ECC51EE52EE0D147B85DBC95DD3E97DA20083EAB3F5218DD9F4CA37DA986D35989F251F72C2512A42CBB6B462B9
Malicious:	false
Preview:	@echo off..@cd /d %~dp0..echo Removing TAP driver.....tapinstall.exe remove tap0901..echo TAP Driver Uninstall completed successfully!..exit..

C:\Program Files\FastestVPN\Resources\driver\windows\amd64\OemVista.inf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp
File Type:	Windows setup INFormation
Category:	dropped
Size (bytes):	7537
Entropy (8bit):	5.046488463217706
Encrypted:	false
SSDEEP:	192:wr8tW9yCTi3K4vlQd22bjR+iAUC7bdP+io3DcNSj6jvKFkinuEQTXvzLd4Z:LWlGMdkxzo3DcNSj6jvKFkinuEQTXvzq
MD5:	50D29CA2E3DDB8A696923420EC2AC4FA
SHA1:	D85F4E65FE10F13DED1780DDBD074EDFC75F2D25
SHA-256:	817DFF7F4944A255A0A33B8D74EB60A755D8D268CC7AFD46FCE41E102E0A004B
SHA-512:	03778A9CDDD23639C88E24BB5D0446DA3A400BB6B3321FB35887CD23D88D0F7AD3FE911642CC7F8D16D29CD9E42106851B0028379E8DBCB3C6721C238FC4A0D3
Malicious:	false
Preview:	; ***************************************************************************..; Copyright (C) 2002-2014 OpenVPN Technologies, Inc. ..; This program is free software; you can redistribute it and/or modify ..; it under the terms of the GNU General Public License version 2 ..; as published by the Free Software Foundation. ..; *************************************************************************....; SYNTAX CHECKER..; cd \WINDDK\3790\tools\chkinf..; chkinf c:\src\openvpn\tap-win32\i386\oemvista.inf..; OUTPUT -> file:///c:/WINDDK/3790/tools/chkinf/htm/c%23+src+openvpn+tap-win32+i386+__OemWin2k.htm....; INSTALL/REMOVE DRIVER..; tapinstall install OemVista.inf tapoas..; tapinstall update OemVista.inf tapoas..; tapinstall remove tapoas....;*******************************************************..; Note to Developers:..;..; If you are bundling the TAP-Windows driver with your app,..; you should try

C:\Program Files\FastestVPN\Resources\driver\windows\amd64\install_tap.bat (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp
File Type:	DOS batch file, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	228
Entropy (8bit):	4.832057381123706
Encrypted:	false
SSDEEP:	6:hiPFvPuaYkVVkZ0BNLllYYLV3GZ0Q/RLQ8NGN8BP:E9HuaYcyZcNLllYbZh/a8NGNc
MD5:	939DFFC36D36E4C85EE6703C812987E5
SHA1:	3BA5F451B1F5C269B4F51E847DA79A3C619CB9C9
SHA-256:	843C2DFB5FE8DFE7C5266F8F79D1E0AC0BA3E40D5C883D4AF879B6F273B7499E
SHA-512:	8958432897981533C2822AC7355D56FC490EB89157423FAA5DF13A5EC00E75A9E791A3ECF478561C3B13988C553FD739FD2047C37EF91972DBF61AB55D475314
Malicious:	false
Preview:	@echo off..@cd /d %~dp0..echo Removing old TAP driver.....tapinstall.exe remove tap0901 ..echo Installing TAP driver.....tapinstall.exe install OemVista.inf tap0901 ..echo TAP Driver Re-Installation completed successfully!..exit

C:\Program Files\FastestVPN\Resources\driver\windows\amd64\is-0UT9M.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp
File Type:	DOS batch file, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	142
Entropy (8bit):	4.838122400792552
Encrypted:	false
SSDEEP:	3:mKDD2G2FuyPuCkjLoOMXrHt9QVVkUoYmdFwLMiREl32AGN8BvAOA:hiPFvPullYkVVkxYmQLNREVNGN8B6
MD5:	012961E4DD4402DA78BC174AF09B77F9
SHA1:	900CA53983FAA217DD134664A9E694138E9A6FDF
SHA-256:	E7D73C9323599320AFA243DB5313F1A55ADFC34EDE66A4A656CA9172BF3C273D
SHA-512:	332A6BA6D1923A020DDB36E6E6FA80141B737ECC51EE52EE0D147B85DBC95DD3E97DA20083EAB3F5218DD9F4CA37DA986D35989F251F72C2512A42CBB6B462B9
Malicious:	false
Preview:	@echo off..@cd /d %~dp0..echo Removing TAP driver.....tapinstall.exe remove tap0901..echo TAP Driver Uninstall completed successfully!..exit..

C:\Program Files\FastestVPN\Resources\driver\windows\amd64\is-7J76O.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp
File Type:	PE32+ executable (native) x86-64, for MS Windows
Category:	dropped
Size (bytes):	39384
Entropy (8bit):	6.220766637489946
Encrypted:	false
SSDEEP:	768:7CxLEO/+ApBG35KBOXZZoZmTf11a+uiExMFYQjEPKgz:NCI46R1a+jExMFFjWR
MD5:	2CCA8DC5DA7F197C8C97A2EEBCBFA908
SHA1:	1A463168F91A6AE254A3E99CE2691F9E7DBC2D46
SHA-256:	AA1EA00EA7D1FD8E404FB5FEFF948CFB86642F803BDF23D8262B8A0C1151B643
SHA-512:	AFBF92EA4A3C21048DC25FDC59779A0F20D6687CE9B2D0291268ED2D82A7020595AF2633EAE8623706162C36B24F6E8E70FA73F9D1088E2AB91BA8EAFB8E948F
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........~..[...[...[....w..Z....w..^...[...m....w.._....w..^.../t..Q.../t..Z.../t..Z...Rich[...........................PE..d....z.].........."......Z.....................@....................................:.....`A....................................................<.......X....p..H....x...!...........R..8............................S...............P...............................text...W>.......@.................. ..h.rdata..\|....P.......D..............@..H.data........`.......P..............@....pdata..H....p.......R..............@..HPAGE.................V.............. ..`INIT.................d.............. ..b.rsrc...X............p..............@..B.reloc...............v..............@..B................................................................................................................................................................................

C:\Program Files\FastestVPN\Resources\driver\windows\amd64\is-9NM46.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp
File Type:	PE32+ executable (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	498504
Entropy (8bit):	6.313132779768202
Encrypted:	false
SSDEEP:	3072:iVF7vR03+4YnfLU6wXnSmZb3lKm34AJ9Qvtk1Ai8mTnu5gtZXqg7VcoyUyHi6/Cz:iVXU/3TNfAkTnrZqkyh/agGKwNdUo15
MD5:	F19CFFFF76FF48E98F060A563DD8345B
SHA1:	C77F3FE9FFBA02DE288661FBB66656791196EDBC
SHA-256:	16D1FF6409065D9C0BC50FC2ADE61B3299A141CF2553749D8891BEDBEA43DE70
SHA-512:	0D4A53FA4B0D4FF71AF1FFF5888005570404BF5309942F477B1D754073F6D200ABADE20DAAFFA3FB6DA55F2B23588CA439273BD9268257B83B00F973B7B61841
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......N....cv..cv..cv.Q.r..cv.Q.u..cv.Q.s..cv...s.#cv...r..cv...u..cv.Q.w..cv..cw..cv.~.s..cv.~....cv..c...cv.~.t..cv.Rich.cv.................PE..d....z.]..........".........d.......z.........@..........................................`..................................................S..x............... L...x..H#......D.......T............................................@...............................text....)......................... ..`.rdata...%...@...&..................@..@.data....(...p.......T..............@....pdata.. L.......N...d..............@..@_RDATA..............................@..@.rsrc...............................@..@.reloc..D............n..............@..B................................................................................................................................................................................................

C:\Program Files\FastestVPN\Resources\driver\windows\amd64\is-FKPUT.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp
File Type:	Windows setup INFormation
Category:	dropped
Size (bytes):	7537
Entropy (8bit):	5.046488463217706
Encrypted:	false
SSDEEP:	192:wr8tW9yCTi3K4vlQd22bjR+iAUC7bdP+io3DcNSj6jvKFkinuEQTXvzLd4Z:LWlGMdkxzo3DcNSj6jvKFkinuEQTXvzq
MD5:	50D29CA2E3DDB8A696923420EC2AC4FA
SHA1:	D85F4E65FE10F13DED1780DDBD074EDFC75F2D25
SHA-256:	817DFF7F4944A255A0A33B8D74EB60A755D8D268CC7AFD46FCE41E102E0A004B
SHA-512:	03778A9CDDD23639C88E24BB5D0446DA3A400BB6B3321FB35887CD23D88D0F7AD3FE911642CC7F8D16D29CD9E42106851B0028379E8DBCB3C6721C238FC4A0D3
Malicious:	false
Preview:	; ***************************************************************************..; Copyright (C) 2002-2014 OpenVPN Technologies, Inc. ..; This program is free software; you can redistribute it and/or modify ..; it under the terms of the GNU General Public License version 2 ..; as published by the Free Software Foundation. ..; *************************************************************************....; SYNTAX CHECKER..; cd \WINDDK\3790\tools\chkinf..; chkinf c:\src\openvpn\tap-win32\i386\oemvista.inf..; OUTPUT -> file:///c:/WINDDK/3790/tools/chkinf/htm/c%23+src+openvpn+tap-win32+i386+__OemWin2k.htm....; INSTALL/REMOVE DRIVER..; tapinstall install OemVista.inf tapoas..; tapinstall update OemVista.inf tapoas..; tapinstall remove tapoas....;*******************************************************..; Note to Developers:..;..; If you are bundling the TAP-Windows driver with your app,..; you should try

C:\Program Files\FastestVPN\Resources\driver\windows\amd64\is-PG7JG.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp
File Type:	data
Category:	dropped
Size (bytes):	10042
Entropy (8bit):	7.139091215265505
Encrypted:	false
SSDEEP:	192:rrIa34E9odZubhd95wRLeOup+ZscF8Bd1LEqsa9sgfxIZH54o:nCZYQA9+ZsHLEhDgf2h54o
MD5:	685D08D5E2A2450648A40B518E2046FC
SHA1:	D99E38968DE1CA1850971A2B81BFDAB49626AAED
SHA-256:	56A658934ACC55AD665D685AE05913B4710E053A8FD385C0798B96041DA161B2
SHA-512:	619D08317328B351FEEA51C08C57B4704EEA0A92836D6ED3BE850478EA6A9C2A14DFA30C763581608E16983010AB2E12B51E3BEC68F3480EE45A04C0E857FDB7
Malicious:	false
Preview:	0.'6...H........''0.'#...1.0...`.H.e......0..Z..+.....7.....K0..G0...+.....7........N.u.C...y].7...191031061137Z0...+.....7.....0...0....R0.5.1.7.3.7.1.7.7.5.6.C.F.1.9.7.8.D.3.7.8.6.4.5.A.D.A.C.6.D.6.F.3.3.5.3.C.7.C.B...1../0:..+.....7...1,0...F.i.l.e........t.a.p.0.9.0.1...s.y.s...0>..+.....7...100....O.S.A.t.t.r........2.:.6...0.,.2.:.6...1...0M..+.....7...1?0=0...+.....7...0...........0!0...+..........7.ul.7.E..mo3S..0b..+.....7...1T0R.L.{.C.6.8.9.A.A.B.8.-.8.E.7.8.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}....0....RD.8.5.F.4.E.6.5.F.E.1.0.F.1.3.D.E.D.1.7.8.0.D.D.B.D.0.7.4.E.D.F.C.7.5.F.2.D.2.5...1..)0<..+.....7...1.0,...F.i.l.e........o.e.m.v.i.s.t.a...i.n.f...0>..+.....7...100....O.S.A.t.t.r........2.:.6...0.,.2.:.6...1...0E..+.....7...17050...+.....7.......0!0...+........._Ne...=.....N.._-%0b..+.....7...1T0R.L.{.D.E.3.5.1.A.4.2.-.8.E.5.9.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}.......0..0v..+.....7....h0f...O.S.......XV.i.s.t.a.X.6.4.,.S.e.r.v.e.r.2.0.0.8.X.6.4.,

C:\Program Files\FastestVPN\Resources\driver\windows\amd64\is-QA9TR.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp
File Type:	DOS batch file, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	228
Entropy (8bit):	4.832057381123706
Encrypted:	false
SSDEEP:	6:hiPFvPuaYkVVkZ0BNLllYYLV3GZ0Q/RLQ8NGN8BP:E9HuaYcyZcNLllYbZh/a8NGNc
MD5:	939DFFC36D36E4C85EE6703C812987E5
SHA1:	3BA5F451B1F5C269B4F51E847DA79A3C619CB9C9
SHA-256:	843C2DFB5FE8DFE7C5266F8F79D1E0AC0BA3E40D5C883D4AF879B6F273B7499E
SHA-512:	8958432897981533C2822AC7355D56FC490EB89157423FAA5DF13A5EC00E75A9E791A3ECF478561C3B13988C553FD739FD2047C37EF91972DBF61AB55D475314
Malicious:	false
Preview:	@echo off..@cd /d %~dp0..echo Removing old TAP driver.....tapinstall.exe remove tap0901 ..echo Installing TAP driver.....tapinstall.exe install OemVista.inf tap0901 ..echo TAP Driver Re-Installation completed successfully!..exit

C:\Program Files\FastestVPN\Resources\driver\windows\amd64\tap0901.cat (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp
File Type:	data
Category:	dropped
Size (bytes):	10042
Entropy (8bit):	7.139091215265505
Encrypted:	false
SSDEEP:	192:rrIa34E9odZubhd95wRLeOup+ZscF8Bd1LEqsa9sgfxIZH54o:nCZYQA9+ZsHLEhDgf2h54o
MD5:	685D08D5E2A2450648A40B518E2046FC
SHA1:	D99E38968DE1CA1850971A2B81BFDAB49626AAED
SHA-256:	56A658934ACC55AD665D685AE05913B4710E053A8FD385C0798B96041DA161B2
SHA-512:	619D08317328B351FEEA51C08C57B4704EEA0A92836D6ED3BE850478EA6A9C2A14DFA30C763581608E16983010AB2E12B51E3BEC68F3480EE45A04C0E857FDB7
Malicious:	false
Preview:	0.'6...H........''0.'#...1.0...`.H.e......0..Z..+.....7.....K0..G0...+.....7........N.u.C...y].7...191031061137Z0...+.....7.....0...0....R0.5.1.7.3.7.1.7.7.5.6.C.F.1.9.7.8.D.3.7.8.6.4.5.A.D.A.C.6.D.6.F.3.3.5.3.C.7.C.B...1../0:..+.....7...1,0...F.i.l.e........t.a.p.0.9.0.1...s.y.s...0>..+.....7...100....O.S.A.t.t.r........2.:.6...0.,.2.:.6...1...0M..+.....7...1?0=0...+.....7...0...........0!0...+..........7.ul.7.E..mo3S..0b..+.....7...1T0R.L.{.C.6.8.9.A.A.B.8.-.8.E.7.8.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}....0....RD.8.5.F.4.E.6.5.F.E.1.0.F.1.3.D.E.D.1.7.8.0.D.D.B.D.0.7.4.E.D.F.C.7.5.F.2.D.2.5...1..)0<..+.....7...1.0,...F.i.l.e........o.e.m.v.i.s.t.a...i.n.f...0>..+.....7...100....O.S.A.t.t.r........2.:.6...0.,.2.:.6...1...0E..+.....7...17050...+.....7.......0!0...+........._Ne...=.....N.._-%0b..+.....7...1T0R.L.{.D.E.3.5.1.A.4.2.-.8.E.5.9.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}.......0..0v..+.....7....h0f...O.S.......XV.i.s.t.a.X.6.4.,.S.e.r.v.e.r.2.0.0.8.X.6.4.,

C:\Program Files\FastestVPN\Resources\driver\windows\amd64\tap0901.sys (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp
File Type:	PE32+ executable (native) x86-64, for MS Windows
Category:	dropped
Size (bytes):	39384
Entropy (8bit):	6.220766637489946
Encrypted:	false
SSDEEP:	768:7CxLEO/+ApBG35KBOXZZoZmTf11a+uiExMFYQjEPKgz:NCI46R1a+jExMFFjWR
MD5:	2CCA8DC5DA7F197C8C97A2EEBCBFA908
SHA1:	1A463168F91A6AE254A3E99CE2691F9E7DBC2D46
SHA-256:	AA1EA00EA7D1FD8E404FB5FEFF948CFB86642F803BDF23D8262B8A0C1151B643
SHA-512:	AFBF92EA4A3C21048DC25FDC59779A0F20D6687CE9B2D0291268ED2D82A7020595AF2633EAE8623706162C36B24F6E8E70FA73F9D1088E2AB91BA8EAFB8E948F
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........~..[...[...[....w..Z....w..^...[...m....w.._....w..^.../t..Q.../t..Z.../t..Z...Rich[...........................PE..d....z.].........."......Z.....................@....................................:.....`A....................................................<.......X....p..H....x...!...........R..8............................S...............P...............................text...W>.......@.................. ..h.rdata..\|....P.......D..............@..H.data........`.......P..............@....pdata..H....p.......R..............@..HPAGE.................V.............. ..`INIT.................d.............. ..b.rsrc...X............p..............@..B.reloc...............v..............@..B................................................................................................................................................................................

C:\Program Files\FastestVPN\Resources\driver\windows\amd64\tapinstall.exe (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp
File Type:	PE32+ executable (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	498504
Entropy (8bit):	6.313132779768202
Encrypted:	false
SSDEEP:	3072:iVF7vR03+4YnfLU6wXnSmZb3lKm34AJ9Qvtk1Ai8mTnu5gtZXqg7VcoyUyHi6/Cz:iVXU/3TNfAkTnrZqkyh/agGKwNdUo15
MD5:	F19CFFFF76FF48E98F060A563DD8345B
SHA1:	C77F3FE9FFBA02DE288661FBB66656791196EDBC
SHA-256:	16D1FF6409065D9C0BC50FC2ADE61B3299A141CF2553749D8891BEDBEA43DE70
SHA-512:	0D4A53FA4B0D4FF71AF1FFF5888005570404BF5309942F477B1D754073F6D200ABADE20DAAFFA3FB6DA55F2B23588CA439273BD9268257B83B00F973B7B61841
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......N....cv..cv..cv.Q.r..cv.Q.u..cv.Q.s..cv...s.#cv...r..cv...u..cv.Q.w..cv..cw..cv.~.s..cv.~....cv..c...cv.~.t..cv.Rich.cv.................PE..d....z.]..........".........d.......z.........@..........................................`..................................................S..x............... L...x..H#......D.......T............................................@...............................text....)......................... ..`.rdata...%...@...&..................@..@.data....(...p.......T..............@....pdata.. L.......N...d..............@..@_RDATA..............................@..@.rsrc...............................@..@.reloc..D............n..............@..B................................................................................................................................................................................................

C:\Program Files\FastestVPN\Resources\driver\windows\amd64\uninstall_tap.bat (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp
File Type:	DOS batch file, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	142
Entropy (8bit):	4.838122400792552
Encrypted:	false
SSDEEP:	3:mKDD2G2FuyPuCkjLoOMXrHt9QVVkUoYmdFwLMiREl32AGN8BvAOA:hiPFvPullYkVVkxYmQLNREVNGN8B6
MD5:	012961E4DD4402DA78BC174AF09B77F9
SHA1:	900CA53983FAA217DD134664A9E694138E9A6FDF
SHA-256:	E7D73C9323599320AFA243DB5313F1A55ADFC34EDE66A4A656CA9172BF3C273D
SHA-512:	332A6BA6D1923A020DDB36E6E6FA80141B737ECC51EE52EE0D147B85DBC95DD3E97DA20083EAB3F5218DD9F4CA37DA986D35989F251F72C2512A42CBB6B462B9
Malicious:	false
Preview:	@echo off..@cd /d %~dp0..echo Removing TAP driver.....tapinstall.exe remove tap0901..echo TAP Driver Uninstall completed successfully!..exit..

C:\Program Files\FastestVPN\Resources\driver\windows\i386\OemVista.inf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp
File Type:	Windows setup INFormation
Category:	dropped
Size (bytes):	7533
Entropy (8bit):	5.046821594517318
Encrypted:	false
SSDEEP:	192:wr8tW9yCTi3K4vlP2bjR+iAUC7bdP+io3DcNSj6jvKFkinuEQTXvzLd4Z:LWlGTxzo3DcNSj6jvKFkinuEQTXvzaZ
MD5:	3A541F2BF9842CDE6F0C95E83DE14FFA
SHA1:	12C074F03AA19968893F2BE48FDEF42A293B7EE4
SHA-256:	598EAD8481136AB0C8C99E67CA30841DB3C32417B45D6FEEDE04802DB0C4C320
SHA-512:	F060851D26E978AFA6AC632E74C221FB837FDEEE7752762BEE210D7BE144195A27514E108EF8C19A642BC03486E94721BD1B9D4AC69DB26BD892DCAA7894D3D2
Malicious:	false
Preview:	; ***************************************************************************..; Copyright (C) 2002-2014 OpenVPN Technologies, Inc. ..; This program is free software; you can redistribute it and/or modify ..; it under the terms of the GNU General Public License version 2 ..; as published by the Free Software Foundation. ..; *************************************************************************....; SYNTAX CHECKER..; cd \WINDDK\3790\tools\chkinf..; chkinf c:\src\openvpn\tap-win32\i386\oemvista.inf..; OUTPUT -> file:///c:/WINDDK/3790/tools/chkinf/htm/c%23+src+openvpn+tap-win32+i386+__OemWin2k.htm....; INSTALL/REMOVE DRIVER..; tapinstall install OemVista.inf tapoas..; tapinstall update OemVista.inf tapoas..; tapinstall remove tapoas....;*******************************************************..; Note to Developers:..;..; If you are bundling the TAP-Windows driver with your app,..; you should try

C:\Program Files\FastestVPN\Resources\driver\windows\i386\install_tap.bat (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp
File Type:	DOS batch file, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	228
Entropy (8bit):	4.832057381123706
Encrypted:	false
SSDEEP:	6:hiPFvPuaYkVVkZ0BNLllYYLV3GZ0Q/RLQ8NGN8BP:E9HuaYcyZcNLllYbZh/a8NGNc
MD5:	939DFFC36D36E4C85EE6703C812987E5
SHA1:	3BA5F451B1F5C269B4F51E847DA79A3C619CB9C9
SHA-256:	843C2DFB5FE8DFE7C5266F8F79D1E0AC0BA3E40D5C883D4AF879B6F273B7499E
SHA-512:	8958432897981533C2822AC7355D56FC490EB89157423FAA5DF13A5EC00E75A9E791A3ECF478561C3B13988C553FD739FD2047C37EF91972DBF61AB55D475314
Malicious:	false
Preview:	@echo off..@cd /d %~dp0..echo Removing old TAP driver.....tapinstall.exe remove tap0901 ..echo Installing TAP driver.....tapinstall.exe install OemVista.inf tap0901 ..echo TAP Driver Re-Installation completed successfully!..exit

C:\Program Files\FastestVPN\Resources\driver\windows\i386\is-6HO0C.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp
File Type:	DOS batch file, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	228
Entropy (8bit):	4.832057381123706
Encrypted:	false
SSDEEP:	6:hiPFvPuaYkVVkZ0BNLllYYLV3GZ0Q/RLQ8NGN8BP:E9HuaYcyZcNLllYbZh/a8NGNc
MD5:	939DFFC36D36E4C85EE6703C812987E5
SHA1:	3BA5F451B1F5C269B4F51E847DA79A3C619CB9C9
SHA-256:	843C2DFB5FE8DFE7C5266F8F79D1E0AC0BA3E40D5C883D4AF879B6F273B7499E
SHA-512:	8958432897981533C2822AC7355D56FC490EB89157423FAA5DF13A5EC00E75A9E791A3ECF478561C3B13988C553FD739FD2047C37EF91972DBF61AB55D475314
Malicious:	false
Preview:	@echo off..@cd /d %~dp0..echo Removing old TAP driver.....tapinstall.exe remove tap0901 ..echo Installing TAP driver.....tapinstall.exe install OemVista.inf tap0901 ..echo TAP Driver Re-Installation completed successfully!..exit

C:\Program Files\FastestVPN\Resources\driver\windows\i386\is-EQ5BP.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp
File Type:	DOS batch file, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	142
Entropy (8bit):	4.838122400792552
Encrypted:	false
SSDEEP:	3:mKDD2G2FuyPuCkjLoOMXrHt9QVVkUoYmdFwLMiREl32AGN8BvAOA:hiPFvPullYkVVkxYmQLNREVNGN8B6
MD5:	012961E4DD4402DA78BC174AF09B77F9
SHA1:	900CA53983FAA217DD134664A9E694138E9A6FDF
SHA-256:	E7D73C9323599320AFA243DB5313F1A55ADFC34EDE66A4A656CA9172BF3C273D
SHA-512:	332A6BA6D1923A020DDB36E6E6FA80141B737ECC51EE52EE0D147B85DBC95DD3E97DA20083EAB3F5218DD9F4CA37DA986D35989F251F72C2512A42CBB6B462B9
Malicious:	false
Preview:	@echo off..@cd /d %~dp0..echo Removing TAP driver.....tapinstall.exe remove tap0901..echo TAP Driver Uninstall completed successfully!..exit..

C:\Program Files\FastestVPN\Resources\driver\windows\i386\is-O423O.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp
File Type:	data
Category:	dropped
Size (bytes):	10010
Entropy (8bit):	7.143392930093258
Encrypted:	false
SSDEEP:	192:bdOUGdndfdZubhd95wRLeOup+ZscF8Bd1LELx8a9sgfxIZH3:p7oFZYQA9+ZsHLE98Dgf2h3
MD5:	BEE546D1A9EE2F74F4C9B0A347DBAB7C
SHA1:	BB655AEDDFACE5C498DC8EC5A3E68685FDFE6D50
SHA-256:	DBC0D9D157718C90227D527A9BFC87C9135426A7A1A7C0ECD3F43825AAA2EE0E
SHA-512:	B68F5F6572BB881B116746AB1BF90AE1E16449E0797D482B1D5A551241ED37A30EF105AECA7B1CEB62CB38962B285D29159B9E68DC1BC3B457B2A14531A80F44
Malicious:	false
Preview:	0.'....H........'.0.'....1.0...`.H.e......0..:..+.....7.....+0..'0...+.....7.....\.6.D..E..Wm(.p...191031061137Z0...+.....7.....0...0....R1.2.C.0.7.4.F.0.3.A.A.1.9.9.6.8.8.9.3.F.2.B.E.4.8.F.D.E.F.4.2.A.2.9.3.B.7.E.E.4...1..)0<..+.....7...1.0,...F.i.l.e........o.e.m.v.i.s.t.a...i.n.f...0>..+.....7...100....O.S.A.t.t.r........2.:.6...0.,.2.:.6...1...0E..+.....7...17050...+.....7.......0!0...+..........t.:..h.?+...);~.0b..+.....7...1T0R.L.{.D.E.3.5.1.A.4.2.-.8.E.5.9.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}....0....RA.F.B.A.B.0.D.E.D.C.D.F.C.2.1.F.3.6.4.E.D.0.2.4.6.9.0.4.8.1.A.F.D.C.8.D.3.6.E.1...1../0:..+.....7...1,0*...F.i.l.e........t.a.p.0.9.0.1...s.y.s...0>..+.....7...100....O.S.A.t.t.r........2.:.6...0.,.2.:.6...1...0M..+.....7...1?0=0...+.....7...0...........0!0...+................6N.$i....6.0b..+.....7...1T0R.L.{.C.6.8.9.A.A.B.8.-.8.E.7.8.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}.......0..0V..+.....7....H0F...O.S.......8V.i.s.t.a.X.8.6.,.S.e.r.v.e.r.2.0.0.8.X.8.6.,

C:\Program Files\FastestVPN\Resources\driver\windows\i386\is-PBM2F.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp
File Type:	PE32 executable (native) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	34264
Entropy (8bit):	6.451114076364161
Encrypted:	false
SSDEEP:	384:nToflu9IisjjMJvOA4hKtbAwut9l/AxkDur/MvBhLwI7PKA+bkxQJ7XakZSZ4dS5:nToBjjOOA4dR/uQvBbuALxQbagPKgzW
MD5:	EF55CAAABD0E13C304587D941C343F77
SHA1:	F0E323EF510E00FC925A7FB37C625D077FECA8A3
SHA-256:	A4E2E4194E15BC93A53FFAB121CCE22CC76EDBC18DFB83132A95F92C9220509F
SHA-512:	D2C61CCB73C90D26A4D39EBADE87A6F7F23CAA34B29AE14FFA08CA48A32086C6553CA12D38362B6179E82776F3D76F4B05FDD2238B5E7BE4FEEC98A4D8D52573
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........C..."..."..."...J..."...J..."...J..."..."..."...J..."...I..."...I."...I..."..Rich."..................PE..L....z.].................N...................P....@.......................................@A....................................P.......X............d...!.......... R..8...........................XR..@............P...............................text....7.......8.................. ..h.rdata..,....P.......<..............@..H.data........`.......B..............@...PAGE....[....p.......D.............. ..`INIT....T............P.............. ..b.rsrc...X............Z..............@..B.reloc...............`..............@..B................................................................................................................................................................................................................................................

C:\Program Files\FastestVPN\Resources\driver\windows\i386\is-QN43A.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	387400
Entropy (8bit):	6.458236487570103
Encrypted:	false
SSDEEP:	6144:UTksWxn+v8a7/e3uFm4uy6b1aptMtx1IAOrPdmB4SS4Vw3VTBZiA916NkW:Akska7m3uFm4uy6b10MtxnOrPdmBe3XE
MD5:	46F33BBA03FF35C0A777B5875E832559
SHA1:	C4B5487307DB1B715EDA5C233DBD346EF44ABF02
SHA-256:	72D329B11A240403A74990F7F05CDDA684F53FBFC1E45EE3E565E38000C6FDA1
SHA-512:	7130F9DEE420D2A377E3CDAE0C47D1F8446E2DA4E021274A15F4FD00583F79C0DBF05819216ABBAAE5493BF1CB1E4FA08EFA673CCDA1BC3A623BAEC828DFC413
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........b...1...1...1..0...1..0{..1..0.1C.0..1C.0.1C.0.1..0...1...1b..1..0...1..p1...1...1...1..0...1Rich...1........PE..L....z.].................<..........`m.......P....@.................................~.....@.....................................x.......................H#.......$......T...........................(...@............P..h............................text....;.......<.................. ..`.rdata..J....P.......@..............@..@.data...l...........................@....rsrc...............................@..@.reloc...$.......&..................@..B........................................................................................................................................................................................................................................................................................................

C:\Program Files\FastestVPN\Resources\driver\windows\i386\is-VSNQ2.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp
File Type:	Windows setup INFormation
Category:	dropped
Size (bytes):	7533
Entropy (8bit):	5.046821594517318
Encrypted:	false
SSDEEP:	192:wr8tW9yCTi3K4vlP2bjR+iAUC7bdP+io3DcNSj6jvKFkinuEQTXvzLd4Z:LWlGTxzo3DcNSj6jvKFkinuEQTXvzaZ
MD5:	3A541F2BF9842CDE6F0C95E83DE14FFA
SHA1:	12C074F03AA19968893F2BE48FDEF42A293B7EE4
SHA-256:	598EAD8481136AB0C8C99E67CA30841DB3C32417B45D6FEEDE04802DB0C4C320
SHA-512:	F060851D26E978AFA6AC632E74C221FB837FDEEE7752762BEE210D7BE144195A27514E108EF8C19A642BC03486E94721BD1B9D4AC69DB26BD892DCAA7894D3D2
Malicious:	false
Preview:	; ***************************************************************************..; Copyright (C) 2002-2014 OpenVPN Technologies, Inc. ..; This program is free software; you can redistribute it and/or modify ..; it under the terms of the GNU General Public License version 2 ..; as published by the Free Software Foundation. ..; *************************************************************************....; SYNTAX CHECKER..; cd \WINDDK\3790\tools\chkinf..; chkinf c:\src\openvpn\tap-win32\i386\oemvista.inf..; OUTPUT -> file:///c:/WINDDK/3790/tools/chkinf/htm/c%23+src+openvpn+tap-win32+i386+__OemWin2k.htm....; INSTALL/REMOVE DRIVER..; tapinstall install OemVista.inf tapoas..; tapinstall update OemVista.inf tapoas..; tapinstall remove tapoas....;*******************************************************..; Note to Developers:..;..; If you are bundling the TAP-Windows driver with your app,..; you should try

C:\Program Files\FastestVPN\Resources\driver\windows\i386\tap0901.cat (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp
File Type:	data
Category:	dropped
Size (bytes):	10010
Entropy (8bit):	7.143392930093258
Encrypted:	false
SSDEEP:	192:bdOUGdndfdZubhd95wRLeOup+ZscF8Bd1LELx8a9sgfxIZH3:p7oFZYQA9+ZsHLE98Dgf2h3
MD5:	BEE546D1A9EE2F74F4C9B0A347DBAB7C
SHA1:	BB655AEDDFACE5C498DC8EC5A3E68685FDFE6D50
SHA-256:	DBC0D9D157718C90227D527A9BFC87C9135426A7A1A7C0ECD3F43825AAA2EE0E
SHA-512:	B68F5F6572BB881B116746AB1BF90AE1E16449E0797D482B1D5A551241ED37A30EF105AECA7B1CEB62CB38962B285D29159B9E68DC1BC3B457B2A14531A80F44
Malicious:	false
Preview:	0.'....H........'.0.'....1.0...`.H.e......0..:..+.....7.....+0..'0...+.....7.....\.6.D..E..Wm(.p...191031061137Z0...+.....7.....0...0....R1.2.C.0.7.4.F.0.3.A.A.1.9.9.6.8.8.9.3.F.2.B.E.4.8.F.D.E.F.4.2.A.2.9.3.B.7.E.E.4...1..)0<..+.....7...1.0,...F.i.l.e........o.e.m.v.i.s.t.a...i.n.f...0>..+.....7...100....O.S.A.t.t.r........2.:.6...0.,.2.:.6...1...0E..+.....7...17050...+.....7.......0!0...+..........t.:..h.?+...);~.0b..+.....7...1T0R.L.{.D.E.3.5.1.A.4.2.-.8.E.5.9.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}....0....RA.F.B.A.B.0.D.E.D.C.D.F.C.2.1.F.3.6.4.E.D.0.2.4.6.9.0.4.8.1.A.F.D.C.8.D.3.6.E.1...1../0:..+.....7...1,0*...F.i.l.e........t.a.p.0.9.0.1...s.y.s...0>..+.....7...100....O.S.A.t.t.r........2.:.6...0.,.2.:.6...1...0M..+.....7...1?0=0...+.....7...0...........0!0...+................6N.$i....6.0b..+.....7...1T0R.L.{.C.6.8.9.A.A.B.8.-.8.E.7.8.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}.......0..0V..+.....7....H0F...O.S.......8V.i.s.t.a.X.8.6.,.S.e.r.v.e.r.2.0.0.8.X.8.6.,

C:\Program Files\FastestVPN\Resources\driver\windows\i386\tap0901.sys (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp
File Type:	PE32 executable (native) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	34264
Entropy (8bit):	6.451114076364161
Encrypted:	false
SSDEEP:	384:nToflu9IisjjMJvOA4hKtbAwut9l/AxkDur/MvBhLwI7PKA+bkxQJ7XakZSZ4dS5:nToBjjOOA4dR/uQvBbuALxQbagPKgzW
MD5:	EF55CAAABD0E13C304587D941C343F77
SHA1:	F0E323EF510E00FC925A7FB37C625D077FECA8A3
SHA-256:	A4E2E4194E15BC93A53FFAB121CCE22CC76EDBC18DFB83132A95F92C9220509F
SHA-512:	D2C61CCB73C90D26A4D39EBADE87A6F7F23CAA34B29AE14FFA08CA48A32086C6553CA12D38362B6179E82776F3D76F4B05FDD2238B5E7BE4FEEC98A4D8D52573
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........C..."..."..."...J..."...J..."...J..."..."..."...J..."...I..."...I."...I..."..Rich."..................PE..L....z.].................N...................P....@.......................................@A....................................P.......X............d...!.......... R..8...........................XR..@............P...............................text....7.......8.................. ..h.rdata..,....P.......<..............@..H.data........`.......B..............@...PAGE....[....p.......D.............. ..`INIT....T............P.............. ..b.rsrc...X............Z..............@..B.reloc...............`..............@..B................................................................................................................................................................................................................................................

C:\Program Files\FastestVPN\Resources\driver\windows\i386\tapinstall.exe (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	387400
Entropy (8bit):	6.458236487570103
Encrypted:	false
SSDEEP:	6144:UTksWxn+v8a7/e3uFm4uy6b1aptMtx1IAOrPdmB4SS4Vw3VTBZiA916NkW:Akska7m3uFm4uy6b10MtxnOrPdmBe3XE
MD5:	46F33BBA03FF35C0A777B5875E832559
SHA1:	C4B5487307DB1B715EDA5C233DBD346EF44ABF02
SHA-256:	72D329B11A240403A74990F7F05CDDA684F53FBFC1E45EE3E565E38000C6FDA1
SHA-512:	7130F9DEE420D2A377E3CDAE0C47D1F8446E2DA4E021274A15F4FD00583F79C0DBF05819216ABBAAE5493BF1CB1E4FA08EFA673CCDA1BC3A623BAEC828DFC413
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........b...1...1...1..0...1..0{..1..0.1C.0..1C.0.1C.0.1..0...1...1b..1..0...1..p1...1...1...1..0...1Rich...1........PE..L....z.].................<..........`m.......P....@.................................~.....@.....................................x.......................H#.......$......T...........................(...@............P..h............................text....;.......<.................. ..`.rdata..J....P.......@..............@..@.data...l...........................@....rsrc...............................@..@.reloc...$.......&..................@..B........................................................................................................................................................................................................................................................................................................

C:\Program Files\FastestVPN\Resources\driver\windows\i386\uninstall_tap.bat (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp
File Type:	DOS batch file, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	142
Entropy (8bit):	4.838122400792552
Encrypted:	false
SSDEEP:	3:mKDD2G2FuyPuCkjLoOMXrHt9QVVkUoYmdFwLMiREl32AGN8BvAOA:hiPFvPullYkVVkxYmQLNREVNGN8B6
MD5:	012961E4DD4402DA78BC174AF09B77F9
SHA1:	900CA53983FAA217DD134664A9E694138E9A6FDF
SHA-256:	E7D73C9323599320AFA243DB5313F1A55ADFC34EDE66A4A656CA9172BF3C273D
SHA-512:	332A6BA6D1923A020DDB36E6E6FA80141B737ECC51EE52EE0D147B85DBC95DD3E97DA20083EAB3F5218DD9F4CA37DA986D35989F251F72C2512A42CBB6B462B9
Malicious:	false
Preview:	@echo off..@cd /d %~dp0..echo Removing TAP driver.....tapinstall.exe remove tap0901..echo TAP Driver Uninstall completed successfully!..exit..

C:\Program Files\FastestVPN\Resources\file_selector_windows_plugin.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	346512
Entropy (8bit):	6.253406880555808
Encrypted:	false
SSDEEP:	6144:sQz5UqJwVKCsnOeuj9PDnBQpUZyNVHhl/FPTCgTx:sQ1UqChsnOeMhBaQy9l/FPW0x
MD5:	9641732F1DB2EAB135130C9128C1427A
SHA1:	88B0857CFE055A1D920E55B3094116162E4EAA00
SHA-256:	B47CD11E4089FE0AE8BAF4E05B4CCF19B1DFE403FD392649E9253C05D58F3CBC
SHA-512:	5C87B26E51771B61FDF87D577781B1FB163527D0F03E74327BC11EA1A24B1B449D4AB23F7393466ED4BAF3809A5151EB30928F462B5FCD55BB8DE4BD733856A8
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......]..B........................f......f......f..J.............................a......a......aZ.....a.....Rich...........PE..d...r.wf.........." ...(.p...........v...............................................=....`.........................................p...\|.......x....`....... ...1...........p..,...PK.......................M..(....J..@............................................text...`o.......p.................. ..`.rdata...V.......X...t..............@..@.data...T8......."..................@....pdata...1... ...2..................@..@.rsrc........`....... ..............@..@.reloc..,....p......."..............@..B........................................................................................................................................................................................................................................

C:\Program Files\FastestVPN\Resources\flutter_custom_cursor_plugin.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	313744
Entropy (8bit):	6.2705364965004815
Encrypted:	false
SSDEEP:	6144:7OqwvZdI0CglL0fN5ra4KBb5cSgQkJjMoplVNLQDrkHW:6qwvigF0fN5OB5dgQkBplVNLQDeW
MD5:	2EEEB7F9DCC44DC28CBFBAF94176CA6F
SHA1:	65055D6EE4E5A322DB3C74B0EF8CDADECDB32737
SHA-256:	966DDE59F9ABD125F763A95273BF923C2543A4B9F43F6F0C5587CCA308BD9FFD
SHA-512:	5919481A1768E9B19CE79ADDDFFC25A6BCDA326232FEB6E61729C2173292F3E2EC7266C646090DCC061A2E9643084583E43947774FDF76842316249B3B2E911F
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......@D..%...%...%...U...%...U..%...U...%......%......%.....H%...U...%...Y...%...%..}%.......%.......%....v..%.......%..Rich.%..................PE..d...t.wf.........." ...(.................................................................`.........................................0].......]..P................,..............................................(.......@............0..x............................text...,........................... ..`.rdata..h;...0...<..................@..@.data....7...p.......T..............@....pdata...,...........r..............@..@.rsrc...............................@..@.reloc..............................@..B................................................................................................................................................................................................................................

C:\Program Files\FastestVPN\Resources\flutter_gpu_texture_renderer_plugin.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	344464
Entropy (8bit):	6.268258211828341
Encrypted:	false
SSDEEP:	6144:eyhvW10qILfhXrbR0fkN0addZrKKOYQ9gsYlFtx/pP8fW5:eyhW0qIF10fkNBvgK5QRYlFtxxP8fW5
MD5:	E6C6C72226677BACF6EC83BEDA63F49D
SHA1:	C0E75C5A5B9D7C8CD07E80A2BA4D809801EFF649
SHA-256:	2018F17E324516FC891E5C868E2045970855A3A1521D73F0F6AE12EBF12CFBBA
SHA-512:	3A52B60711EFB4A34E5FF655E60D51A29C6D4B2CD4561A421A51647D5FCB2C75F1468A8F93C25206EDEBCF259112A4C7DA41F90181FF7E53946E1FFF5FB3F353
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........@..!...!...!...Q...!...Q..l!...Q...!.......!.......!......!...Q...!...]...!...!..C!......!......!...~..!......!..Rich.!..........................PE..d...z.wf.........." ...(.l...........e...............................................j....`.........................................0.......8...<....`....... ...2...&.......p.......M.......................O..(....L..@...............x............................text...tj.......l.................. ..`.rdata...Q.......R...p..............@..@.data....=......."..................@....pdata...2... ...4..................@..@.rsrc........`......................@..@.reloc.......p......................@..B........................................................................................................................................................................................................................

C:\Program Files\FastestVPN\Resources\flutter_windows.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	17983376
Entropy (8bit):	6.549243204630475
Encrypted:	false
SSDEEP:	98304:2M5ISKnKKu/60i9gzTcriqcN9MX4C7GsIAfiz8xS6RWhi62KFfQWmLu2EkKZ3uNx:xO6ggzLI7op6Rt69L2kuNx
MD5:	E3E8D995E4A1D5E84EE11DBD58D21F3B
SHA1:	52E7AFB03DD3F45F7B8839879FEC1ACC7965A62E
SHA-256:	29782AC1F424865FA1007A5F818F35ABB5307B01C099AAA38067513E516A0454
SHA-512:	F4FB26D4DC2D91D36FD8F26B9BE6B74F50DF94DE530AFDD8D2D5E9D6D6300B52FB9C6EFBD94A95D630094CE59D5D1AA1B898F810BE8806B7E9DFC5466D312659
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.............J..J..J..fJ..J...K..J...K..J...Ko.J...K..J...K..J...K..J...K..J..Jh.J..J..Jr..K..Jr..K..JRich..J........................PE..d...]. f.........." ...".d....=......;....................................................`.........................................0[.......b...............p.......L..................T.......................(...`...@....................Y..`....................text... b.......d.................. ..`.rdata....-.......-..h..............@..@.data................v..............@....pdata.......p......................@..@_RDATA..\............2..............@..@.reloc...............4..............@..B................................................................................................................................................................................................................................

C:\Program Files\FastestVPN\Resources\geek.dxf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp
File Type:	data
Category:	dropped
Size (bytes):	929318
Entropy (8bit):	7.900306716974538
Encrypted:	false
SSDEEP:	24576:+20deSdhsNk795wZ08KxwK29H7hfnn3MQYa:+20ddsy95WKxwKQnc2
MD5:	2D1F8BF06610A54B8A61894239012C3B
SHA1:	98BA3AEC7A32B6BCB264B51364A0A8A664E4FE82
SHA-256:	8FAFAB1032577F2EDC583C676A9BBFEECF929B5BE22950183C9A77BC2123798B
SHA-512:	AE9DB2DEA48BFC54274975306FA98921882EA43A590DCF60733B964253C3E9D97BE9CC97F45F18ECCB65802C0EC4599BAFBFF781FE635D6364BD0B657C95655E
Malicious:	false
Preview:	..]r.U..x..F.q...aI..`vkqqNsSLg..b..F.Iq`..o`y.gm.N._a.lJF.D\FpNm.RRYR.b.to.r.mhG.x.._...F.f.WO.nH..l.ldPH.[m..h..r..YX..mq....i.Q....F....H.m..r...N.JY\k.`T..nLx].oqf..........b.hV.m.TWicY.dpV....IE.d.Tjs.^tS..CUW..F....\......r.yrs.C.I.Xcql..c.....qe.K..T.^..q.i.B.NV_...gk..ACuS..n..]..g.O.yX.....u.J^dPj.g.mHP....E]B..h...HtjI.M\.^.cs.H...q...........p.x^..urE...C`..K..h...`i.M.H...^.Pt..S..p...Y.TP...E.M....\...k.S.m.Hu...Q.....juxX.s.gUG..wrAT[.gc..H...V....j.h.kL...Kgd[bMW...EKa.h..jw....D........F..qFC..Q.HFS.Z.L.....h.B.r...`.xqZ..O.bK.I_kEChAWH`.K..b.kqG.k..cw.i..x...d.yC.....R...^[]]\JD.u\v.HM.....p.a.y]ugLa..Dc.f.MSa[^.sV.Z.hWdD..nRr.V..D.h.Zx.D....O.guI]W.f.].qw.y.UPyO..T.Em.eV..p.^L.j.lPh....jMY.g.Vf.K.YHp[grw.kbx..T.V.]SQm..Eg.\...^q...u.gTh..w..wJ...a.bc..b.....gQo..TtjB.TU....eA..QY....V...uf..B.\oh.w.J.D..R.....x..[_.m..wMD.c.Er.D..E_f...Cm.HX].CKb....E..S...H..Dj.d...kNa.^F...s.teH..w......w......Q.i.d.XD..n..S...u....M.OS.....M...rS.E.G.h.R.\U.N.ASoEw.a.B...O`..DO.Ck.

C:\Program Files\FastestVPN\Resources\gymnasium.m4a (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp
File Type:	data
Category:	dropped
Size (bytes):	63258
Entropy (8bit):	4.638400083452387
Encrypted:	false
SSDEEP:	1536:PcJillRMp5RLRYkKJdcmFT38Q9aSePEUX5:PcJiDRMD9YdtePz5
MD5:	127A512367895E269AD9922079C47761
SHA1:	7444878FEF13B7B4FCBE57D2DB2C527A34CA48C5
SHA-256:	E841508B1B3D7615F17E691334ECB6B1A7F7A83BC531BFF272E85F048AA3DDFD
SHA-512:	90E486FA09945BCCBD24542C31F832BEC4AA6EAE7D7A1522526018D0AC38CE855F545E1AB7AEFA1B6F7D78E6F0C8333A607E8A9BF1DCFA74E9E4F3B113AFD15F
Malicious:	false
Preview:	.c.jPxZ...PF...L.f.Ih..t...[.....O...O.o..l...Y.u.....mZ^P...u.v.l...E...W....f.....d.u...M.J.Nyd.i....uH.o.Jid.E..^..x..x.Z..kfmuexCyd.RD._Cm...]G....jwcu.q[.xx..Vj.bsRP.lh...t..j..s...f.ZgNgGc.....Rdk.sHK..q[jD.S.f.i.aZWv..F.O.tp...Zs.n..S..o..be.....d.^Xe..QpnXhy^..eVU..qwe_...[MZ..MTbS.j..n..u..]y.u.t..J.rcm..`e.y...IF..N\..Wt..uOE.dQ..^b..ksh.q..p.U..aLW.EfqS.H.Lm.p.OA..Sa...EY.vUbN.D.V..KqdWL....pE..Enuj.RG.`.R.s....mV.W.i...nc.a.^.m...hg...a...FGX..J...E`....\Z...U...Q....II..xk.]L.mX]........W.F.X.k.f..^M[.....y.Oj.h.eOk_Dj..QRT..SK`.T..G^..n.t..\N..CR.l...G..p..r..V..NoUZVJH.ld..Y.h..jVT.n..S..poIbY.X`.F.mp.BoZ.rW..Wo..b.TI.].RmK.pY..^..F..gRc..q....v..WGn.......C]g...Qh..\Mq..._.....kXB..HV.I]...D.ZIDW[...K.A..H.Pt..O....xJtu......J....^o..J.....WWY..L.VE........b.....[..oA_.n.ac...MKn..W.Q.maX........s..s..c[...Ij....Mu.ux...tPT.\.[..F..gpAH..mA...U..N...mE..y.\..q.C.gG..o..Kms.LL.P\.....cPDD.g.Y.rJZ.aF.iTA....].S.NL.r...l..]...n.`.]`..G^QQuPhO.DL.k.S_y.hD._..sour.i.wfg..`yI

C:\Program Files\FastestVPN\Resources\is-1155O.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	99976
Entropy (8bit):	6.499161413646961
Encrypted:	false
SSDEEP:	1536:yWHL+4KsAzAfadZw+1Hcx8uIYNU5U9H0Q8ecbjt1BHK/CeS:yWr/Z+jPYNV9H0Q8ecbjt1BHK/pS
MD5:	85054BAF6D0A7D31A18183ACC4CBA133
SHA1:	24830C002FFAB31102DFB674B52AFFD74E90E708
SHA-256:	EC86F182F55A338E26F598638F18422E474C6D6C651E1D9955D0303254BF6DDD
SHA-512:	B6B7D9115ED1D734D7C0EB09E7C7C96EEC29E2C59B8943586976F2182E46B660B99C1947ACF2C1DEB75595771A78B7405FDDBB989A2F06CF88E4AD3D8824055A
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......*..qn.."n.."n.."...#l.."g.."e.."n.."B.."<..#c.."<..#~.."<..#q.."<..#o.."<.g"o.."<..#o.."Richn.."................PE..d.....`.........." .........`......p................................................>....`A.........................................B..4....J...............p..X....X..............h,..T............................,..8............................................text............................... ..`.rdata...@.......B..................@..@.data...@....`.......@..............@....pdata..X....p.......D..............@..@_RDATA...............P..............@..@.rsrc................R..............@..@.reloc...............V..............@..B........................................................................................................................................................................................................................

C:\Program Files\FastestVPN\Resources\is-4H11H.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp
File Type:	data
Category:	dropped
Size (bytes):	63258
Entropy (8bit):	4.638400083452387
Encrypted:	false
SSDEEP:	1536:PcJillRMp5RLRYkKJdcmFT38Q9aSePEUX5:PcJiDRMD9YdtePz5
MD5:	127A512367895E269AD9922079C47761
SHA1:	7444878FEF13B7B4FCBE57D2DB2C527A34CA48C5
SHA-256:	E841508B1B3D7615F17E691334ECB6B1A7F7A83BC531BFF272E85F048AA3DDFD
SHA-512:	90E486FA09945BCCBD24542C31F832BEC4AA6EAE7D7A1522526018D0AC38CE855F545E1AB7AEFA1B6F7D78E6F0C8333A607E8A9BF1DCFA74E9E4F3B113AFD15F
Malicious:	false
Preview:	.c.jPxZ...PF...L.f.Ih..t...[.....O...O.o..l...Y.u.....mZ^P...u.v.l...E...W....f.....d.u...M.J.Nyd.i....uH.o.Jid.E..^..x..x.Z..kfmuexCyd.RD._Cm...]G....jwcu.q[.xx..Vj.bsRP.lh...t..j..s...f.ZgNgGc.....Rdk.sHK..q[jD.S.f.i.aZWv..F.O.tp...Zs.n..S..o..be.....d.^Xe..QpnXhy^..eVU..qwe_...[MZ..MTbS.j..n..u..]y.u.t..J.rcm..`e.y...IF..N\..Wt..uOE.dQ..^b..ksh.q..p.U..aLW.EfqS.H.Lm.p.OA..Sa...EY.vUbN.D.V..KqdWL....pE..Enuj.RG.`.R.s....mV.W.i...nc.a.^.m...hg...a...FGX..J...E`....\Z...U...Q....II..xk.]L.mX]........W.F.X.k.f..^M[.....y.Oj.h.eOk_Dj..QRT..SK`.T..G^..n.t..\N..CR.l...G..p..r..V..NoUZVJH.ld..Y.h..jVT.n..S..poIbY.X`.F.mp.BoZ.rW..Wo..b.TI.].RmK.pY..^..F..gRc..q....v..WGn.......C]g...Qh..\Mq..._.....kXB..HV.I]...D.ZIDW[...K.A..H.Pt..O....xJtu......J....^o..J.....WWY..L.VE........b.....[..oA_.n.ac...MKn..W.Q.maX........s..s..c[...Ij....Mu.ux...tPT.\.[..F..gpAH..mA...U..N...mE..y.\..q.C.gG..o..Kms.LL.P\.....cPDD.g.Y.rJZ.aF.iTA....].S.NL.r...l..]...n.`.]`..G^QQuPhO.DL.k.S_y.hD._..sour.i.wfg..`yI

C:\Program Files\FastestVPN\Resources\is-4JUC4.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp
File Type:	PE32+ executable (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	865416
Entropy (8bit):	6.558002511161394
Encrypted:	false
SSDEEP:	24576:dxRZrLEvOx+pFpQlzLyPkET7c5zaSjLUVaoNkUNBKsEpX:dtUmxmpQFLyPkEixWi
MD5:	A151697A9F14639BFA2CB3E470CEA355
SHA1:	FA45D614ABFF2ED9A707E3DFC02F404CFC18A89F
SHA-256:	4794C710A3E624B1A0D956CFE21EC0433FD85BD2D8EB96ACE3F2B5E5302E225C
SHA-512:	888CFD3919482BB56A15E23A73C868C277CA925EED122327E3399C23D0D647F07B9CD67CCAE28AFD1048A41710DA50126B38E75D7455F56AA95BBECA42D228BF
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$........*.w.K.$.K.$.K.$.3.$.K.$.>.%.K.$.$l$.K.$.>.%.K.$.>.%.K.$.>.%.K.$w>.%.K.$w>.%.K.$. .%.K.$. .%.K.$.K.$.I.$w>.%.K.$w>.%.K.$w>n$.K.$w>.%.K.$Rich.K.$................PE..d.....b.........."...........................@....................................q.....`.........................................Pd..P....d..........8....P...^..................................................`...8............................................text.............................. ..`.rdata..^...........................@..@.data...............................@....pdata...^...P...`..................@..@.rsrc...8...........................@..@.reloc..............................@..B................................................................................................................................................................................................................

C:\Program Files\FastestVPN\Resources\is-4R4LE.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	323472
Entropy (8bit):	6.24323878406639
Encrypted:	false
SSDEEP:	6144:aK/qrBUA8kikYQQ2sXvNnot1bdNtb1lHSdrkjoE:a8qC5kikpQX1ny1bdv1lHSdYjoE
MD5:	BFEC2012B6589D4496EA0283E90A5269
SHA1:	813E3FAD5CFE4A30E20F05080D106811C5544FA3
SHA-256:	F9406ECAA9C86F2946F8B9D997F0210F1F5EE974BE6548D1DB039014D1B45552
SHA-512:	396F28EB15ED793DB453CD3B3E9118F4386FE24A75E3F3914E881CCA3ADA8918B98751BDAC51C4A5E897CCA1E700B2A545686463A6B0DD6719EA172682CFB928
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......`&..$Gt.$Gt.$Gt..7w.!Gt..7q.Gt..7p.4Gt...w..Gt...p.Gt...q.iGt..7u."Gt..;u.'Gt.$Gu.\Gt.7.q.#Gt.7.t.%Gt.7..%Gt.7.v.%Gt.Rich$Gt.........PE..d...^.wf.........." ...(.................................................... .......7....`.........................................@x..\|....x..d...............P...............................................(.......@............@..x............................text...@).......*.................. ..`.rdata...F...@...H..................@..@.data....6....... ...v..............@....pdata..P........0..................@..@.rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................................

C:\Program Files\FastestVPN\Resources\is-5M6KM.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	256912
Entropy (8bit):	6.232383775712062
Encrypted:	false
SSDEEP:	6144:WEq38uejOBA0ItZ1PNWPQqLlXXXXVXDBsXdZC/R0EjW0VnXNvdroJ:/q0jOBARWPRLlXXXXVXSXdZk0EjW0VnM
MD5:	850A43E323656B86AE665D8B4FD71369
SHA1:	099D6E80C394CCC5233E1CBD6B29769DA9E0E2AA
SHA-256:	539423D2E436E198DF15B5577D816DC306BA4C03B1362F7731E675B51F4A5F42
SHA-512:	1F2778040E906EA2939A8B0A682E267599AA8422F81EA83BB6C980A304B569AD750EF3E81E1490EDD5B1D74E734A2CB82F428F47096C55436037E03E516D2378
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......w...3...3...3......6..........u..9....u..#....u..`......"......;......1... r..$...3...... r..:... r&.2...3.N.2... r..2...Rich3...........PE..d.....wf.........."....(.Z.....................@.............................0......#.....`.................................................Tq..T....... ........%........... .......#.......................%..(...`"..@............p.. ............................text....Y.......Z.................. ..`.rdata.......p.......^..............@..@.data....0...........v..............@....pdata...%.......&..................@..@.rsrc... ...........................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................

C:\Program Files\FastestVPN\Resources\is-5RDD6.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp
File Type:	PE32+ executable (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	94856
Entropy (8bit):	5.499392443352034
Encrypted:	false
SSDEEP:	1536:RmYSYxGfIZnRnD6M7EFOUakPhtUn6KXF4O7Wm1xK/CpcW:QYFZnRDGdvPXU6K1RWmPK/4h
MD5:	834EE5DA601A6C78C43C64F6C282682F
SHA1:	03920B402B787CA53CD79A66B0B611C899B91F3E
SHA-256:	754B61DA108CC9379585E18DDCE90A8092C1B17DA5D922A6E8D6CE84A90B0F87
SHA-512:	C4A6A49D1EE316FB9EA399487EA17DD813C0A611F473F4FD054D07F6D5C6BB786D40FA478254A499DB3E1D5F0AFDA3B72651EF097945D0C3AA9F0D83D9C0ED06
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........V........-.....;......<.......+....%......S....%......2....~......,.....)...Rich..........PE..d...<..W..........".................Tv..............................................I.....@.......... ..................................................h.......l....D.......p..........................................................X............................text............................... ..`.data...............................@....pdata..l...........................@..@.rsrc...h...........................@..@.reloc..z....p.......B..............@..B................................................................................................................................................................................................................................................................................................

C:\Program Files\FastestVPN\Resources\is-71J6V.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	178552
Entropy (8bit):	6.1636094237053305
Encrypted:	false
SSDEEP:	3072:2h5CDZ37FRuI7hDEjQ777RZ7B7T7N55Fjh/YAWFOEBhzFJEB55jKTrK/T:J3bRn9ZNnB5NfKTW/T
MD5:	3D0E093C2EA9BE7460BFBAD86E6FBB58
SHA1:	C36EB5601DF523DE321146CF1853F899921AB519
SHA-256:	810DD30ED0002E2D71937EA818F77E60B0D385D32CC61D92A466FCB6FDCE5526
SHA-512:	CF4A35C0FAA30FE2B96F2A04E91AFCF9CD08ADF021031C1CEFEF8E2F4028381FD1DEABA7B744AB2245B60A623715CDE8B7C8C9D7AE52728701D773F4B26367BB
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...........-......#.....L...................`.....l......................................@... .........................H.......................................t...................................................................................text....K.......L..................`.p`.data........`.......P..............@.0..rdata..,....p.......R..............@.`@.bss..................................`..edata..H............f..............@.0@.idata...............v..............@.0..CRT....,............\|..............@.0..tls.... ............~..............@.0..reloc..t...........................@.0B........................................................................................................................................................................................................................................................................

C:\Program Files\FastestVPN\Resources\is-71JPL.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp
File Type:	PE32+ executable (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	93832
Entropy (8bit):	5.485112927422894
Encrypted:	false
SSDEEP:	1536:fP2K0pa0WfEYp9Y/XQhpgnbP212YCJpDhiF4O7WGkK/CH8:fePOYe4bu1epDh8RWGkK/b
MD5:	8E7EE7C3876683902475753519681407
SHA1:	75FACB7F9C59B284F97956E799E57FB0F606C49D
SHA-256:	6D5041A8EF796C66BA151D8FCFAFDD96BCAA99B57D2777897FD25A87A5E41E13
SHA-512:	523EBF3A4DF9F6D299E72079DEF0A0DA9127601796D9AA613B70AD2F66EE2166F4F8F75083F47E67FFFD892A09FA437F3B12BD1B27065200E90F8617E3E83727
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........X...9...9...9...AF..9...AW..9...A@..9...9..f9...AP.9...AY..9.......9...AG..9...AB..9..Rich.9..........................PE..d.....pK.........."......~...........s.......................................p............@.......... ......................................X}..........p.......T....@.......`......0................................................................................text....\|.......~.................. ..`.data...x...........................@....pdata..T...........................@..@.rsrc...p...........................@..@.reloc..p....`.......>..............@..B................................................................................................................................................................................................................................................................................................

C:\Program Files\FastestVPN\Resources\is-7L7U1.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	918536
Entropy (8bit):	6.038516348303836
Encrypted:	false
SSDEEP:	12288:Kts+IUZyyi1sznLRjH0qawdB1iT7jwq7Kjn+o/J:KtLIUZPyaVH0qawP1iDwjn+oh
MD5:	6F1B7C24C5FF662F4364B323F42C101A
SHA1:	B74949B7A809F8139BD89BD5B96E230108A6615D
SHA-256:	034248CEFD5BC35A927682E44B79C354A0AEE25E800CF99D86EC591FD8722B5A
SHA-512:	B13B4A46FB14C687925DE21982C4DE66C201E9FE16D7C03B2C65900CEF47C5E6DB338545E868EE6216C2A92453557BEA6C0D084B5D76A731CAA00BA821FA40E0
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....$.Y...../...................H................@.................................n.....@... .........................N.......(................................a...................................................#..`............................text...............................`.P`.data....%.......&..................@.`..rdata..D...........................@.`@.bss.....G............................`..edata..N...........................@.0@.idata..(...........................@.0..CRT....4...........................@.0..tls.... ............0..............@.0..reloc...a.......b...2..............@.0B/4...........P......................@..B/19..........`......................@..B/31.....]............8..............@..B/45.......... .......T..............@..B/57..........@.......p..............@.0B/70..........P.......x..............@..B/81..........`.......~..

C:\Program Files\FastestVPN\Resources\is-8UK12.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	346512
Entropy (8bit):	6.253406880555808
Encrypted:	false
SSDEEP:	6144:sQz5UqJwVKCsnOeuj9PDnBQpUZyNVHhl/FPTCgTx:sQ1UqChsnOeMhBaQy9l/FPW0x
MD5:	9641732F1DB2EAB135130C9128C1427A
SHA1:	88B0857CFE055A1D920E55B3094116162E4EAA00
SHA-256:	B47CD11E4089FE0AE8BAF4E05B4CCF19B1DFE403FD392649E9253C05D58F3CBC
SHA-512:	5C87B26E51771B61FDF87D577781B1FB163527D0F03E74327BC11EA1A24B1B449D4AB23F7393466ED4BAF3809A5151EB30928F462B5FCD55BB8DE4BD733856A8
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......]..B........................f......f......f..J.............................a......a......aZ.....a.....Rich...........PE..d...r.wf.........." ...(.p...........v...............................................=....`.........................................p...\|.......x....`....... ...1...........p..,...PK.......................M..(....J..@............................................text...`o.......p.................. ..`.rdata...V.......X...t..............@..@.data...T8......."..................@....pdata...1... ...2..................@..@.rsrc........`....... ..............@..@.reloc..,....p......."..............@..B........................................................................................................................................................................................................................................

C:\Program Files\FastestVPN\Resources\is-9BMN3.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	244360
Entropy (8bit):	6.534833630270433
Encrypted:	false
SSDEEP:	6144:lE2PcqwWvsYJlWewlEyDFINgMjY/fVYPCtmA+KiA/R:lE+1JYVEgFugMjXP/A0A/R
MD5:	92CAE75041DFA888EE8284E7C6BB658E
SHA1:	2632FD77EAEDC09977192CFAA19EAEE66F538041
SHA-256:	ACEB2DBBA3948EF0D2908CAE3B2E1586AC82B700C1DE7E6420FA241EFBBB0ECB
SHA-512:	F01AC04FBD3EA1FD4D39D7654DF7D97EB15D60BC9EDFDF36C92176CF8A66FC148E4ECA480F52B7283AF1B9966983F4275A4E221E2D73056A7F3F4290C4D85C17
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...R."K...........#...8............`..............k................................Ub........ ......................P.. ....p...$...................................................................................................................text...t...........................`.P`.data...0%.......&..................@.`..rdata..x^.......`..................@.`@.bss.........@........................@..edata.. ....P.......*..............@.0@.idata...$...p...&...H..............@.0..reloc...............n..............@.0B........................................................................................................................................................................................................................................................................................................................................................

C:\Program Files\FastestVPN\Resources\is-9HBCL.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	3490952
Entropy (8bit):	6.105770368598401
Encrypted:	false
SSDEEP:	49152:+VwASO4GIU6injGtlqBGqgOtUyrQ8SFJnofeT5W7aTNP6nZsi61o1CPwDv3uFfJe:xB+btBQQ7UQnZsY1CPwDv3uFfJe
MD5:	474D774A60BCBDBB326C248D1B86C785
SHA1:	C8611E2BEA720BB3B8768BB7F347DE04EAB8B00D
SHA-256:	4FB11C716E57A352D0C40B83F00B73A23B16F4418247AFB0E8CA114C20ED7414
SHA-512:	D25EFAE915E303AB98F86A3131E5C128BFFB0FEE7317C2F28D7A9C9836186C46FDB64008BE98EBF1B7C97F809AD4A170929583B5B899427C405C90503D3D39E0
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......q.Q.5.?.5.?.5.?.<..'.?.g.>.7.?.g.:.>.?.g.;.=.?.g.<.1.?.!.>.8.?.5.>.?.5.?.+.?...;.N.?...?.4.?.....4.?...=.4.?.Rich5.?.........................PE..d...g..b.........." .....p%...................................................5.......5...`...........................................0..h....4.T.....5.\|.....3.......5...... 5..P..T.-.8.............................-.8.............4..............................text....o%......p%................. ..`.rdata........%......t%.............@..@.data....~....2..0...t2.............@....pdata........3.......2.............@..@.idata..T'....4..(...h4.............@..@.00cfg..Q.....5.......4.............@..@.rsrc...\|.....5.......4.............@..@.reloc...z... 5..\|....4.............@..B................................................................................................................................................

C:\Program Files\FastestVPN\Resources\is-BERNA.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	543632
Entropy (8bit):	6.3781262731970685
Encrypted:	false
SSDEEP:	12288:zqzF5VH24Jy+0PeZOYbxobw+QY0heC9lVNLETyoK:zqh32SRoc+QY0n9lVNLETbK
MD5:	94267176E212B8EBFF06728CC6C3F432
SHA1:	F65313083C2B3177F405B7AB884BA0A9BE3251D9
SHA-256:	08D08CBFA4D5531CEEE16BFCB2255EDA79C5B7F7C0894C4E6F49F673457AB362
SHA-512:	014459C9D3DBE7C09E0D6DB085CE9F715248BA6D784845339B2D6896A8BA7B680C93E707D4990350E30C8853A95FD0DC6F8E9244643787DB65AB8A2F95C26967
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........W..6..6..6..XF..6..XF...6..XF..6......6......6.......6..XF..6..}J..6..6...6.....6.....6...O.6.....6..Rich.6..........PE..d...~.wf.........." ...(.....4......L.....................................................`.........................................p...........d....p....... ...B...0..........................................(...p...@............0...............................text............................... ..`.rdata.......0......................@..@.data....J.......2..................@....pdata...B... ...D..................@..@.rsrc........p......................@..@.reloc............... ..............@..B........................................................................................................................................................................................................................................

C:\Program Files\FastestVPN\Resources\is-BTQQJ.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	113800
Entropy (8bit):	6.497871168162335
Encrypted:	false
SSDEEP:	3072:NADrSog8rBPCmGxRmZZlfzaag8fPrZyEOE9toSK/G:qDl9PQTmZ53rZyEOE92L/G
MD5:	C966B6A5F0143199FF16F8E491E2B44D
SHA1:	A47ECE66964E5432551E782EC53EBFEA42845256
SHA-256:	EA7E53C74D1E66FB0363A16DCCB2B893183937BF4A69770EA44D6BCD6C1A15D6
SHA-512:	54292A35794B0E147BDCDE724D7101FEDD499F5799175545C5E2BB4362D6387B713EBF511EBF25B4D7E41086073E167524C401936623BB3AE8E337E3D5ADE5CF
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........hw...........q......\|......\|......\|......\|.....P\|.....b............P\|.....P\|.....P\|.....P\|.....Rich............PE..d......b.........." ................................................................."....`..........................................p.......}.......................................Y...............................Z..8............................................text............................... ..`.rdata..z...........................@..@.data...(............t..............@....pdata...............v..............@..@.rsrc...............................@..@.reloc..............................@..B................................................................................................................................................................................................................................................

C:\Program Files\FastestVPN\Resources\is-EJ1T1.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	17983376
Entropy (8bit):	6.549243204630475
Encrypted:	false
SSDEEP:	98304:2M5ISKnKKu/60i9gzTcriqcN9MX4C7GsIAfiz8xS6RWhi62KFfQWmLu2EkKZ3uNx:xO6ggzLI7op6Rt69L2kuNx
MD5:	E3E8D995E4A1D5E84EE11DBD58D21F3B
SHA1:	52E7AFB03DD3F45F7B8839879FEC1ACC7965A62E
SHA-256:	29782AC1F424865FA1007A5F818F35ABB5307B01C099AAA38067513E516A0454
SHA-512:	F4FB26D4DC2D91D36FD8F26B9BE6B74F50DF94DE530AFDD8D2D5E9D6D6300B52FB9C6EFBD94A95D630094CE59D5D1AA1B898F810BE8806B7E9DFC5466D312659
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.............J..J..J..fJ..J...K..J...K..J...Ko.J...K..J...K..J...K..J...K..J..Jh.J..J..Jr..K..Jr..K..JRich..J........................PE..d...]. f.........." ...".d....=......;....................................................`.........................................0[.......b...............p.......L..................T.......................(...`...@....................Y..`....................text... b.......d.................. ..`.rdata....-.......-..h..............@..@.data................v..............@....pdata.......p......................@..@_RDATA..\............2..............@..@.reloc...............4..............@..B................................................................................................................................................................................................................................

C:\Program Files\FastestVPN\Resources\is-FO4BS.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	776328
Entropy (8bit):	6.92032788063544
Encrypted:	false
SSDEEP:	12288:uQmCy3NeRjkpQmj3oaMtQqjoygfXq3kon9IlbgaOxQdVJJ6j5EBKX8hUk/K:vmCy3VQs9MtLjTgfa3kon9FaOdEukC
MD5:	6ECA26F16FEB505B1BD0A0A25DA4AEDB
SHA1:	297A6E0D660FAF9E924B2BE827D9D9DC81E4EB85
SHA-256:	CD9005B83CAB43E566F287D1BB1A3DE33F2D67AD5013DC5213232A5DC5309BDB
SHA-512:	78F749E1D591D9AC2C1BB3A47FA7D4099A18303357F990E97D6E531FA50FE2466C8A203504F599C74EE92DFA179CC4AFBC561C60AFD01FA103A3276E79760A46
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........ R.HA<.HA<.HA<.A9..KA<.HA=..A<.'7..@<.'7...A<.'7..\|A<.'7...A<.'7..IA<.'7..IA<.'7..IA<.RichHA<.........PE..L.....K.........."!................. ....... .....x................................m.....@..........................I......D...(............................... L..h...8...........................pE..@............................................text............................... ..`.data...\|Z... ...N..................@....rsrc................X..............@..@.reloc.. L.......N...\..............@..B........................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files\FastestVPN\Resources\is-J49VG.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2276496
Entropy (8bit):	6.2839627604807955
Encrypted:	false
SSDEEP:	49152:sqrGLY4rzqgpJdli4OLz1/SK1ULLnLWdaqTv6akDCbpCX464lnbW148y1PuDT5Wg:sqr0Y4rugpJdli4OLz1/SK1ULLLWdaq8
MD5:	A928351F9555A07B7A8DCEA6B209D367
SHA1:	66379948FB082D9EB390B77C4E00EFAD25062C9C
SHA-256:	8993C69DAA63314019E3D33190140ACAC23704D20AB3BDF946B41969DD23B0A7
SHA-512:	099DAD1E89474F449EF9EA35CC93C2C8A643AF9108FD38FFB7B748FE93F0A25553B135AC6C6E33EDB8B1AD55687CDF182C6FA3E2D5018110D0500C3E2CA35EEA
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....$.Y.p...<.....!.............0................(c.........................@........"...@... .........................A....P..........@.............".....................................p.......................R..h............................text...............................`.p`.data...\|d.......f..................@.`..rdata..T............d..............@.`@.bss.........`........................`..edata..A............B..............@.0@.idata.......P......................@.0..CRT....,....`......................@.0..tls.... ....p......................@.0..rsrc...@...........................@.0..reloc.............................@.0B/4...........@......................@..B/19......i...P...j..................@..B/31..................,..............@..B/45..................@..............@..B/57..................R..............@.0B/70.....2............Z..

C:\Program Files\FastestVPN\Resources\is-J9ANF.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	397712
Entropy (8bit):	6.40156340476818
Encrypted:	false
SSDEEP:	12288:ThaEhq4cY0f8IlE6BZR2nUx9lYOUgLZUrd:T4EhqR5lE6xSUx9lYOUg6rd
MD5:	42C063882FD7CEDD3CC62356450D8987
SHA1:	A09DB77F70A6F7D7C59418FC08250A8E13E8A60D
SHA-256:	37D1EBFC8F423BF02DEC598C6421E4124C8C5666C27782180D84003039E88DFF
SHA-512:	77AC9C670F91059B2CAA12DA9B5417CD71D525F900B7DDA51FFCF499AA2882734B342F6803814C6FDE1B527C9742ED9CF67AB1EE8D141CB437B57C979D89B456
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......Q{.?...l...l...l.j.m...l.j.m...l.j.m...l..m...l..m...l..mY..l.j.m...l.f.m...l...m...l...l...l...m...l...m...l..zl...l...l...l...m...lRich...l........PE..d...j.wf.........." ...(.....L......l........................................0......E.....`..........................................*......x+..........h[.......3........... ..`...............................(...p...@............................................text...\|........................... ..`.rdata...o.......p..................@..@.data....?...@...(...2..............@....pdata...3.......4...Z..............@..@.rsrc...h[.......\..................@..@.reloc..`.... ......................@..B........................................................................................................................................................................................................................

C:\Program Files\FastestVPN\Resources\is-JCL7T.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp
File Type:	data
Category:	dropped
Size (bytes):	929318
Entropy (8bit):	7.900306716974538
Encrypted:	false
SSDEEP:	24576:+20deSdhsNk795wZ08KxwK29H7hfnn3MQYa:+20ddsy95WKxwKQnc2
MD5:	2D1F8BF06610A54B8A61894239012C3B
SHA1:	98BA3AEC7A32B6BCB264B51364A0A8A664E4FE82
SHA-256:	8FAFAB1032577F2EDC583C676A9BBFEECF929B5BE22950183C9A77BC2123798B
SHA-512:	AE9DB2DEA48BFC54274975306FA98921882EA43A590DCF60733B964253C3E9D97BE9CC97F45F18ECCB65802C0EC4599BAFBFF781FE635D6364BD0B657C95655E
Malicious:	false
Preview:	..]r.U..x..F.q...aI..`vkqqNsSLg..b..F.Iq`..o`y.gm.N._a.lJF.D\FpNm.RRYR.b.to.r.mhG.x.._...F.f.WO.nH..l.ldPH.[m..h..r..YX..mq....i.Q....F....H.m..r...N.JY\k.`T..nLx].oqf..........b.hV.m.TWicY.dpV....IE.d.Tjs.^tS..CUW..F....\......r.yrs.C.I.Xcql..c.....qe.K..T.^..q.i.B.NV_...gk..ACuS..n..]..g.O.yX.....u.J^dPj.g.mHP....E]B..h...HtjI.M\.^.cs.H...q...........p.x^..urE...C`..K..h...`i.M.H...^.Pt..S..p...Y.TP...E.M....\...k.S.m.Hu...Q.....juxX.s.gUG..wrAT[.gc..H...V....j.h.kL...Kgd[bMW...EKa.h..jw....D........F..qFC..Q.HFS.Z.L.....h.B.r...`.xqZ..O.bK.I_kEChAWH`.K..b.kqG.k..cw.i..x...d.yC.....R...^[]]\JD.u\v.HM.....p.a.y]ugLa..Dc.f.MSa[^.sV.Z.hWdD..nRr.V..D.h.Zx.D....O.guI]W.f.].qw.y.UPyO..T.Em.eV..p.^L.j.lPh....jMY.g.Vf.K.YHp[grw.kbx..T.V.]SQm..Eg.\...^q...u.gTh..w..wJ...a.bc..b.....gQo..TtjB.TU....eA..QY....V...uf..B.\oh.w.J.D..R.....x..[_.m..wMD.c.Er.D..E_f...Cm.HX].CKb....E..S...H..Dj.d...kNa.^F...s.teH..w......w......Q.i.d.XD..n..S...u....M.OS.....M...rS.E.G.h.R.\U.N.ASoEw.a.B...O`..DO.Ck.

C:\Program Files\FastestVPN\Resources\is-JF6RJ.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	321936
Entropy (8bit):	6.249416182192696
Encrypted:	false
SSDEEP:	6144:49C2dRHqGR0N9BdVLATWWFQEDyhNSDEAIjUoMfqC9ulMdUBIKL:Z2dRHqGRyhAT9FxoSIAIx/C9ulMe2KL
MD5:	5C1752EF16C7E3B28D9662E3C08FB08F
SHA1:	4B3F3BE508D4C6CD8374FBB812EE30E99F8128C0
SHA-256:	1BF45DF354D53D400EAF644E205DADDB0C07B408EB0C03D8CCFF765BD6659FB3
SHA-512:	296F8AA642527C3A2364B9FA0E1C9F3EE3B7AD6F82D51685F71601F4E4A0E5DA5327FF1E1884F6264E7961417D54028B4E9BBE1B836968FF0F9D6685EBEE0327
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 62%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........Z.H.;...;...;..6K...;..6K..q;.......;.......;.......;..6K...;..6K...;...G...;...;...;.......;.......;....p..;.......;..Rich.;..........................PE..d...O.wf.........." ...(............0....................................... ......h1....`..........................................t..t...Du..x................-..............................................(.......@............@...............................text...,(......................... ..`.rdata..rC...@...D..................@..@.data...x7....... ...r..............@....pdata...-..........................@..@.rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................

C:\Program Files\FastestVPN\Resources\is-K889R.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	585512
Entropy (8bit):	6.002108518534667
Encrypted:	false
SSDEEP:	12288:kavF2w273DAx5at3y6/c1M94lh7NX06qkX/0IT7/5:kAF2w2jE5k3y6/cyinNXy4B7h
MD5:	2C700BBCDA59BFE2CD7EBF9BAA5B2626
SHA1:	72EFAA0E8652FB4ADC21E4484E7F63AA968F39D2
SHA-256:	C9C59AB5B3369B97C85129F160491BD743B68DE1AD41EE6EEBA69009407B54E7
SHA-512:	0911C7FED9653D9D50BAD7219E45778367DE4B105B5079A8011415F65465B80782A98A503CEBFB309997BCFB2A8620402579456565A24C69A20CBCBD0130DA20
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....$.Y...........!..............................`n.........................p......L.....@... .........................m).......3...0..@....................@...)........................... .......................................................text...T...........................`.P`.data....-..........................@.`..rdata..............................@.`@.bss....d.............................`..edata..m)..........t..............@.0@.idata...3.......4..................@.0..CRT....,...........................@.0..tls.... .... ......................@.0..rsrc...@....0......................@.0..reloc...)...@.....................@.0B/4...........p......................@..B/19......l.......n..................@..B/31...../............v..............@..B/45.....\|...........................@..B/57..........0......................@.0B/70.....2....@..........

C:\Program Files\FastestVPN\Resources\is-KHPQG.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp
File Type:	PE32+ executable (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	42120
Entropy (8bit):	6.157445136592099
Encrypted:	false
SSDEEP:	768:tFRn6+bvfApVjLj1mFU6rrFqyO9K/Yfryu:tFFepV3j1mm6/pO9K/COu
MD5:	F6AFD5499FCC5D464085AD889BAE09B7
SHA1:	287C540655FCED0C09DDA2D9C4EADD3F3E210B17
SHA-256:	6EDA54D746C092A45395399319DFC878E5674C84FAB8147821524A0042C03F47
SHA-512:	BFD5ED90D0F16A2F0BCC22B0E847D5781A7B11D6912A51CDC8FCAAD80BF191D821418F7544BF52BF6E1AAA47D06A5442601543E9C25B2352D4E23AFC0C4668F9
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......kT../5../5../5..&M<.#5..}@..-5..}@..=5..}@..%5..}@..,5..;^..$5../5..p5...@..,5...@P..5...@...5..Rich/5..........PE..d.....b.........."......0...H.......4.........@....................................e.....`.................................................4g..........@............v..........8...P]...............................]..8............@...............................text..../.......0.................. ..`.rdata...3...@...4...4..............@..@.data...H............h..............@....pdata...............j..............@..@.rsrc...@............n..............@..@.reloc..8............t..............@..B................................................................................................................................................................................................................................................................

C:\Program Files\FastestVPN\Resources\is-MI83V.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	700040
Entropy (8bit):	5.552155208041958
Encrypted:	false
SSDEEP:	12288:UB4x/cH7gueaxFi00ZoPqETRzRnYhUpfakLaugPoDhTMY98c8mvVfU2lvzpi/O:avziRZoXuugCtD8JmvNU2lvzpiG
MD5:	6EE5C92E2918B27974086A6F24D79043
SHA1:	40595B75A513BBF1BE16780784E13EFDAD2E40C7
SHA-256:	86F3A19221C710CFF12607FEB00D8CD0AF932873430AD1B59C990593010EC3CF
SHA-512:	F07BBE5D367D6F7474E08507F3827BDCAC5503673F2027CA139303FA573F4EEB7D82A9D88EE0F3291F53629C0644B39E2C81380B45F8E2A286FFCC326AE0E4B7
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.............]...]...]..M]...]..\...]...\...]..\...]..\...]..\...]H..\...]...]o..]H..\...]H..\...]H.!]...]H..\...]Rich...]........PE..d...g..b.........." .....:...L......<.....................................................`..........................................+...N..@E..........s........L..............h.......8...........................@...8............0..@............................text....8.......:.................. ..`.rdata...)...P......>..............@..@.data...QM.......D...h..............@....pdata...T.......V..................@..@.idata..W...0...X..................@..@.00cfg..Q............Z..............@..@.rsrc...s............\..............@..@.reloc..]............d..............@..B................................................................................................................................................................

C:\Program Files\FastestVPN\Resources\is-O5204.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	344464
Entropy (8bit):	6.268258211828341
Encrypted:	false
SSDEEP:	6144:eyhvW10qILfhXrbR0fkN0addZrKKOYQ9gsYlFtx/pP8fW5:eyhW0qIF10fkNBvgK5QRYlFtxxP8fW5
MD5:	E6C6C72226677BACF6EC83BEDA63F49D
SHA1:	C0E75C5A5B9D7C8CD07E80A2BA4D809801EFF649
SHA-256:	2018F17E324516FC891E5C868E2045970855A3A1521D73F0F6AE12EBF12CFBBA
SHA-512:	3A52B60711EFB4A34E5FF655E60D51A29C6D4B2CD4561A421A51647D5FCB2C75F1468A8F93C25206EDEBCF259112A4C7DA41F90181FF7E53946E1FFF5FB3F353
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........@..!...!...!...Q...!...Q..l!...Q...!.......!.......!......!...Q...!...]...!...!..C!......!......!...~..!......!..Rich.!..........................PE..d...z.wf.........." ...(.l...........e...............................................j....`.........................................0.......8...<....`....... ...2...&.......p.......M.......................O..(....L..@...............x............................text...tj.......l.................. ..`.rdata...Q.......R...p..............@..@.data....=......."..................@....pdata...2... ...4..................@..@.rsrc........`......................@..@.reloc.......p......................@..B........................................................................................................................................................................................................................

C:\Program Files\FastestVPN\Resources\is-OJSLF.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp
File Type:	PE32 executable (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	27784
Entropy (8bit):	6.488306745612165
Encrypted:	false
SSDEEP:	384:YVfdXePAee0fxvSDv2atBymU+DpbGEgivBpnpwK3CrFqa2S0FP27NBYearrDVY:afdXfOvObbU+Nb5RgrFq7rK/YfrDS
MD5:	41C55E2A9D5D9B23C08E3DC067780DC7
SHA1:	1FB62C7FCF24F604676896121C1CCAFB628C1BE1
SHA-256:	D76995DCE5A5A3B0D77ABB438C14504F9825A6BC98676F1BA8D0CC18CEBB0545
SHA-512:	396E8878BAFCFC0DF994B9AF23176D343230B6F6EE82A71E14EFA56347EF0C63B4D277C029EF9FB3EF69D6F1B8AE73ECF92D8DCEDC9312E0C8BFA86EC0B611D2
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....7X.................6...........T... ...`....@.. ....................................@..................................T..K....`...............>............................................................... ............... ..H............text....4... ...6.................. ..`.rsrc........`.......8..............@..@.reloc...............<..............@..B.................T......H........1..."..........\|0..p...........................................6.(.....(.......0..S............(....o.....s.......o....s.......o......o.........&..o............9.....o............#..6........../E.......0..E............(....o.....s.......o....s.......o.........&........9.....o..............#../..........!7.......0..M.......~....s......o.....;.....o......#......$@(....o.........&........9.....o................,7..........4?.......0..M.......~....s......o.....;.....

C:\Program Files\FastestVPN\Resources\is-PM9AD.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	277
Entropy (8bit):	5.0491979415178765
Encrypted:	false
SSDEEP:	6:ShdEdI5KGdXrSwCoXV+hn5A59eT5U+hLQsPti5FtEEs6EsctB6WEsF2WEsF+v:6dEKwGxOsw7BB6S2zv
MD5:	C8768E552ABCA40175C704E4AF1F030C
SHA1:	7B8A3BC3310EE72006FD2C5A4D5F4FC60171C81B
SHA-256:	50259EEA13E0A9CB0AC48181F8F4345E6558EE8536CC71D0F6E2F63AE9D89D33
SHA-512:	09FD06DB34894F1EC79B607217DC70E204793E04C58B846DC495DC915F38C1311AC1EE0D3C5CCDE636D8A3D6CE5631EF7291D3617FB3F900FD072CEA5831B573
Malicious:	false
Preview:	OpenVPN STATISTICS..Updated,2023-09-03 07:45:36..TUN/TAP read bytes,1979..TUN/TAP write bytes,9103..TCP/UDP read bytes,15521..TCP/UDP write bytes,5150..Auth read bytes,9103..pre-compress bytes,0..post-compress bytes,0..pre-decompress bytes,204..post-decompress bytes,213..END..

C:\Program Files\FastestVPN\Resources\is-Q7RHP.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	545680
Entropy (8bit):	6.371479071684404
Encrypted:	false
SSDEEP:	12288:8xqABhfuM6KsuJPR9K+EvLHhDcsgsEO5CllKDh/eF4:8xqDM9+lHNcsgACllKDh/eF4
MD5:	2D885495E81A8B8D1D5305FE20566484
SHA1:	F1D2083D399DD48927CBD83E23F90AD3CE3E0632
SHA-256:	EB2E18881DDD80A3E54527264B3E7C5046F15854A196B76CCAD28E8258F3F1B2
SHA-512:	E2BB9F8E377B381CC13538B39E8B3FB749341FCEF84E7B26749BF35141C6C52A48636BB00C6FA7C585EEC4C01B03CD0EC38C8F3E85E0CA2C2CDA26D026DEF326
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......Do!O..O...O...O..~L...O..~J...O..~K...O..L...O..K...O..J.K.O..~N...O..rN...O...N.y.O...J...O...O...O.......O...M...O.Rich..O.........................PE..d...\|.wf.........." ...(.&...&......................................................$D....`.............................................\|.......P....p....... ..TB...8..........P...p........................ ..(...0...@............@...............................text...P$.......&.................. ..`.rdata.......@.....................@..@.data...tA.........................@....pdata..TB... ...D..................@..@.rsrc........p.......&..............@..@.reloc..P............(..............@..B........................................................................................................................................................................................................................

C:\Program Files\FastestVPN\Resources\is-QG142.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	539536
Entropy (8bit):	6.374120901700144
Encrypted:	false
SSDEEP:	12288:F2qV/eGvVJVbhqs7MRkPXpaCLz9gS+f/9VNtP8zC:F2q9rVJeMp1Lz9gj/9VNtP8zC
MD5:	7024D49DF9315B5718F40FCD29A8656F
SHA1:	EF243D1EC09F2FB714459D596F40A87B5B51C054
SHA-256:	51877E41297AE94FE33D01D980717AE18938A3E81A32C57ADC77D754EF7E66BE
SHA-512:	D9B7661B923B45020641F80A4695079A86F92848A022C8374C9339258A3F63D628000628CF75163B7C707A8506BB4D4928A1EA75E09FA6416EB9A2150EB5B705
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........k....m...m...m..zn...m..zh._.m..zi...m.?.n...m.?.i...m.?.h...m..zl...m.=vl...m...l.}.m..h...m..m...m.....m..o...m.Rich..m.........................PE..d...`.wf.........." ...(.....&......<........................................p.......N....`.........................................P...p.......P....P..........<B... .......`..\...P...........................(.......@............ ...............................text............................... ..`.rdata..,.... ......................@..@.data....B.......*..................@....pdata..<B.......D..................@..@.rsrc........P......................@..@.reloc..\....`......................@..B........................................................................................................................................................................................................................

C:\Program Files\FastestVPN\Resources\is-QLSLT.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	89736
Entropy (8bit):	5.522767465825831
Encrypted:	false
SSDEEP:	768:3urhT5+KybRpnE8K74kca7NerB8iXpYmRRXvdi82BSOe9oKSJ2SLD0BEZWkAzrF9:w+KY04RMmSCYmBiF4O7WTn8K/CI
MD5:	2CC3AC572A2170108BABD019F0BFE779
SHA1:	AF962245CE32D5801A380FF7F6B8C87AC7772AB2
SHA-256:	755315DFCC9C72CBE4EB33AF34E9AAC0BD1324C6942F4B56AD9FE0135E1A9299
SHA-512:	891D545DDF35BF8C650FE8EB48A5E5F6F7C50036E42BE893417AF2EF886EB37C5BEEE9DD838A8F020728E4BAE803F2753CC8F6DD7958DD31B5B39DAED7EF464B
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........L..."..."..."....."......"......"...#.S."....."..`\..."......"......".Rich..".................PE..L...#.pK.................l..........Td.......................................P......0a....@...... ..........................lm..........p............0.......@...... ...............................0...@............................................text... j.......l.................. ..`.data...4............p..............@....rsrc...p............v..............@..@.reloc.......@.......&..............@..B........................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files\FastestVPN\Resources\is-QN5KA.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	323472
Entropy (8bit):	6.260791393809843
Encrypted:	false
SSDEEP:	6144:xadPqy3/nKyWFZS3PCmxiVvUTiJ+1I2hWHlHTkPXdxs4:wqyAA3PCmwV8i41I2gHlHTkvdW4
MD5:	128D06B8C5739F35A7C76A76BF1E6149
SHA1:	901F9698BF4C4A10E8E902E6DBDDF1782E1067D0
SHA-256:	BF585DBC4E4DCE47F9EFDEEAD15F67A69644CE6F1177CEEC518882DC85ECC096
SHA-512:	ECE9254486347751D6F68AE86AFB36508FED81B00C4588F555DB584A0E9DE5F4710A24E6BB5B2B19A25BEE20AA4BF90068F9EB2E37B48271614B6C97199E419C
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........x.........................Y...........>w......>w......>w..............<...........u....p.......p.......p......p......Rich............................PE..d...Y.wf.........." ...(.............5....................................... ............`..........................................t......0u..<...............L/..................P...........................(.......@............@..P............................text...0,.......................... ..`.rdata...B...@...D...2..............@..@.data...X6....... ...v..............@....pdata..L/.......0..................@..@.rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................

C:\Program Files\FastestVPN\Resources\is-QOP0D.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp
File Type:	PE32+ executable (GUI) x86-64 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	8184456
Entropy (8bit):	6.15917051663501
Encrypted:	false
SSDEEP:	98304:AD3K0YyOAYcd0ZLpNu6JmM1W8YcTpOG7ZE78O:ALzUwsFYc9OG7ZE78O
MD5:	5850A25689FA1B36CD6B76E2E7F6BDB3
SHA1:	299CEBD4CD448239BF5094DCC0632100287C0B85
SHA-256:	803870B4FCC1A8C0675EE1D5AA5DEB4132514974CDF0F8F7BA40035377FFDCFA
SHA-512:	F64A196D0FE937112604D7B0CFE2099928987ECEAA650728C88ECE9BAEF288AF2E4BCDD52D3199D8787290F5071287DAFA5DC6FD44775E52CA1E04237411888F
Malicious:	true
Yara Hits:	Rule: JoeSecurity_UACBypassusingCMSTP, Description: Yara detected UAC Bypass using CMSTP, Source: C:\Program Files\FastestVPN\Resources\is-QOP0D.tmp, Author: Joe Security Rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM, Description: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003), Source: C:\Program Files\FastestVPN\Resources\is-QOP0D.tmp, Author: ditekSHen
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d.........].......".......'..........=........@.......................................}...`... ...............................................c.\|.... d.t.............\|...... c.....................................................`SY.@............................text.....'.......'................. ..`.rdata..PC1...(..D1...'.............@..@.data... ....PY......0Y.............@....idata..\|.....c.......\.............@....reloc....... c.......\.............@..B.symtab.......d.......]................B.rsrc...t.... d.......].............@..@........................................................................................................................................................................................................................................................................................................................................

C:\Program Files\FastestVPN\Resources\is-R9V8V.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	359
Entropy (8bit):	5.09733291062762
Encrypted:	false
SSDEEP:	6:i4Z2TyUdkl9WUyUdkwc1+XMoHkyUdk3LASg0TqeXMFXA98XfFZ/FvjCzISMOmEm:jZELklIULktkXxELk35q0MhA98vFZ/FV
MD5:	777B3CBF81DDD8B238BDEDDDEA17AFED
SHA1:	C72F46715DCBC9BDA1E2BEEAC8AF2A64E7B48D08
SHA-256:	DACE14B4A5268728E67A9E78D8F0877F4C87F6B87DDD40DFF28A11E9E42945CF
SHA-512:	5C6D302F93381EBF65ADD3DAA0EB4813270C5D9A042AD9B8A48A575ADC4E751D3834292BB61AEF6A5458036AE6E3C83C8EDFAE5CF828D81317ACAE6675B8E619
Malicious:	false
Preview:	If (-NOT ([Security.Principal.WindowsPrincipal][Security.Principal.WindowsIdentity]::GetCurrent()).IsInRole([Security.Principal.WindowsBuiltInRole] "Administrator"))..{ ..$arguments = "& '" + $myinvocation.mycommand.definition + "'"..Start-Process powershell -Verb runAs -ArgumentList $arguments..Break..}.. Set-NetConnectionProfile -NetworkCategory Private

C:\Program Files\FastestVPN\Resources\is-SADIQ.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp
File Type:	PE32+ executable (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	68744
Entropy (8bit):	6.03232541602541
Encrypted:	false
SSDEEP:	1536:OhNHth2MbtFwpJgYCV7JToLDkhqQovzeTJdCK/C1:OhHTbtsRCskcQovzeTJdCK/a
MD5:	41E94A80206A87D947CE6CF5823494BE
SHA1:	558214579EE8F2732C36F779E545BA1340191E49
SHA-256:	E4275E6430AE1EC21A5CD0F2FC382998DEBC1E433A66129527C1B69792F09F95
SHA-512:	54B0DD18BA43C48B3FC21E4366D7D1DC65147A84AFA3DC29D94C4CF80B49FA67150B8303F576683F712E648CAFF516BFEA3A6F93435D6B33DCAB2C43BC762E35
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........z..h...h...h.......h......h......h......h......h......h.......h...h..ih.......h.......h...h...h.......h..Rich.h..........PE..d.....b.........."......r...\|.......v.........@.............................@............`.................................................x...T.... .......................0..p...................................@...8............................................text....p.......r.................. ..`.rdata...W.......X...v..............@..@.data...............................@....pdata..............................@..@.rsrc........ ......................@..@.reloc..p....0......................@..B................................................................................................................................................................................................................................................

C:\Program Files\FastestVPN\Resources\is-T7NGU.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp
File Type:	PE32+ executable (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	93832
Entropy (8bit):	5.48517352660103
Encrypted:	false
SSDEEP:	1536:kP2K0pa0WfEYp9Y/XQhpgnbP212YCJpDhiF4O7WGHK/CT:kePOYe4bu1epDh8RWGHK/M
MD5:	A2ADF4897942B99FE0738F8C37FD15C0
SHA1:	4192A2221F5C48A16427BF1898C0443CA27A29BB
SHA-256:	B339B9A93A93B52F3EA0A5F2161E4B16BDA0CA7396D53ECA14C7D7F3E963A3A3
SHA-512:	DF383B4B70C980C613F3C3EC4E99980DA6DB15F123D617197B644314233D1E2ADEC9F9162D6DBB7B874D885119082E01840102F0976F3CC767A78B5E467EF4A8
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........X...9...9...9...AF..9...AW..9...A@..9...9..f9...AP.9...AY..9.......9...AG..9...AB..9..Rich.9..........................PE..d.....pK.........."......~...........s.......................................p......r.....@.......... ......................................X}..........p.......T....@.......`......0................................................................................text....\|.......~.................. ..`.data...x...........................@....pdata..T...........................@..@.rsrc...p...........................@..@.reloc..p....`.......>..............@..B................................................................................................................................................................................................................................................................................................

C:\Program Files\FastestVPN\Resources\is-TSTOA.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	589712
Entropy (8bit):	6.371606969587959
Encrypted:	false
SSDEEP:	12288:Qnu0YqCbnvh0xDqjFR0NdzhdkPJZIR0vnrXkcc9VNLqYWTF:Qu0YqInZCD7mZI0vnrPc9VNLqYWB
MD5:	EAB165F7A1856FC4FC191416A26F20F3
SHA1:	3E3BAAA9A8AE20680D4B347A3A65E4A388DC0F4D
SHA-256:	A2C87DFE4D43C7CC8AC44F2AC43BD45EC4F3F6BA87A2C73AE8B55F26286600E9
SHA-512:	897E0F107BEB1FCC6402183C535F2550E954B379451415E8B40403D0575EFA6E1D1373F9F0B9A0649AB09515259490C7BFB9E9926F76735EE513F68460FB5143
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........:q..T"..T"..T"..W#..T"..Q#W.T"7MW#..T"7MP#..T"7MQ#..T"..P#..T"..U#..T"5.U#..T"..U"T.T".JQ#..T".JT#..T".J."..T".JV#..T"Rich..T"................PE..d.....wf.........." ...(.....P.......8.......................................@............`..........................................\..x...8]....... ..........tF...........0......@...........................(.......@............................................text............................... ..`.rdata..2...........................@..@.data....C.......,...^..............@....pdata..tF.......H..................@..@.rsrc........ ......................@..@.reloc.......0......................@..B................................................................................................................................................................................................................................

C:\Program Files\FastestVPN\Resources\is-UCO86.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	313744
Entropy (8bit):	6.2705364965004815
Encrypted:	false
SSDEEP:	6144:7OqwvZdI0CglL0fN5ra4KBb5cSgQkJjMoplVNLQDrkHW:6qwvigF0fN5OB5dgQkBplVNLQDeW
MD5:	2EEEB7F9DCC44DC28CBFBAF94176CA6F
SHA1:	65055D6EE4E5A322DB3C74B0EF8CDADECDB32737
SHA-256:	966DDE59F9ABD125F763A95273BF923C2543A4B9F43F6F0C5587CCA308BD9FFD
SHA-512:	5919481A1768E9B19CE79ADDDFFC25A6BCDA326232FEB6E61729C2173292F3E2EC7266C646090DCC061A2E9643084583E43947774FDF76842316249B3B2E911F
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......@D..%...%...%...U...%...U..%...U...%......%......%.....H%...U...%...Y...%...%..}%.......%.......%....v..%.......%..Rich.%..................PE..d...t.wf.........." ...(.................................................................`.........................................0].......]..P................,..............................................(.......@............0..x............................text...,........................... ..`.rdata..h;...0...<..................@..@.data....7...p.......T..............@....pdata...,...........r..............@..@.rsrc...............................@..@.reloc..............................@..B................................................................................................................................................................................................................................

C:\Program Files\FastestVPN\Resources\libcrypto-1_1-x64.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	3490952
Entropy (8bit):	6.105770368598401
Encrypted:	false
SSDEEP:	49152:+VwASO4GIU6injGtlqBGqgOtUyrQ8SFJnofeT5W7aTNP6nZsi61o1CPwDv3uFfJe:xB+btBQQ7UQnZsY1CPwDv3uFfJe
MD5:	474D774A60BCBDBB326C248D1B86C785
SHA1:	C8611E2BEA720BB3B8768BB7F347DE04EAB8B00D
SHA-256:	4FB11C716E57A352D0C40B83F00B73A23B16F4418247AFB0E8CA114C20ED7414
SHA-512:	D25EFAE915E303AB98F86A3131E5C128BFFB0FEE7317C2F28D7A9C9836186C46FDB64008BE98EBF1B7C97F809AD4A170929583B5B899427C405C90503D3D39E0
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......q.Q.5.?.5.?.5.?.<..'.?.g.>.7.?.g.:.>.?.g.;.=.?.g.<.1.?.!.>.8.?.5.>.?.5.?.+.?...;.N.?...?.4.?.....4.?...=.4.?.Rich5.?.........................PE..d...g..b.........." .....p%...................................................5.......5...`...........................................0..h....4.T.....5.\|.....3.......5...... 5..P..T.-.8.............................-.8.............4..............................text....o%......p%................. ..`.rdata........%......t%.............@..@.data....~....2..0...t2.............@....pdata........3.......2.............@..@.idata..T'....4..(...h4.............@..@.00cfg..Q.....5.......4.............@..@.rsrc...\|.....5.......4.............@..@.reloc...z... 5..\|....4.............@..B................................................................................................................................................

C:\Program Files\FastestVPN\Resources\libeay32.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2276496
Entropy (8bit):	6.2839627604807955
Encrypted:	false
SSDEEP:	49152:sqrGLY4rzqgpJdli4OLz1/SK1ULLnLWdaqTv6akDCbpCX464lnbW148y1PuDT5Wg:sqr0Y4rugpJdli4OLz1/SK1ULLLWdaq8
MD5:	A928351F9555A07B7A8DCEA6B209D367
SHA1:	66379948FB082D9EB390B77C4E00EFAD25062C9C
SHA-256:	8993C69DAA63314019E3D33190140ACAC23704D20AB3BDF946B41969DD23B0A7
SHA-512:	099DAD1E89474F449EF9EA35CC93C2C8A643AF9108FD38FFB7B748FE93F0A25553B135AC6C6E33EDB8B1AD55687CDF182C6FA3E2D5018110D0500C3E2CA35EEA
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....$.Y.p...<.....!.............0................(c.........................@........"...@... .........................A....P..........@.............".....................................p.......................R..h............................text...............................`.p`.data...\|d.......f..................@.`..rdata..T............d..............@.`@.bss.........`........................`..edata..A............B..............@.0@.idata.......P......................@.0..CRT....,....`......................@.0..tls.... ....p......................@.0..rsrc...@...........................@.0..reloc.............................@.0B/4...........@......................@..B/19......i...P...j..................@..B/31..................,..............@..B/45..................@..............@..B/57..................R..............@.0B/70.....2............Z..

C:\Program Files\FastestVPN\Resources\liblzo2-2.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	178552
Entropy (8bit):	6.1636094237053305
Encrypted:	false
SSDEEP:	3072:2h5CDZ37FRuI7hDEjQ777RZ7B7T7N55Fjh/YAWFOEBhzFJEB55jKTrK/T:J3bRn9ZNnB5NfKTW/T
MD5:	3D0E093C2EA9BE7460BFBAD86E6FBB58
SHA1:	C36EB5601DF523DE321146CF1853F899921AB519
SHA-256:	810DD30ED0002E2D71937EA818F77E60B0D385D32CC61D92A466FCB6FDCE5526
SHA-512:	CF4A35C0FAA30FE2B96F2A04E91AFCF9CD08ADF021031C1CEFEF8E2F4028381FD1DEABA7B744AB2245B60A623715CDE8B7C8C9D7AE52728701D773F4B26367BB
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...........-......#.....L...................`.....l......................................@... .........................H.......................................t...................................................................................text....K.......L..................`.p`.data........`.......P..............@.0..rdata..,....p.......R..............@.`@.bss..................................`..edata..H............f..............@.0@.idata...............v..............@.0..CRT....,............\|..............@.0..tls.... ............~..............@.0..reloc..t...........................@.0B........................................................................................................................................................................................................................................................................

C:\Program Files\FastestVPN\Resources\libpkcs11-helper-1.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	113800
Entropy (8bit):	6.497871168162335
Encrypted:	false
SSDEEP:	3072:NADrSog8rBPCmGxRmZZlfzaag8fPrZyEOE9toSK/G:qDl9PQTmZ53rZyEOE92L/G
MD5:	C966B6A5F0143199FF16F8E491E2B44D
SHA1:	A47ECE66964E5432551E782EC53EBFEA42845256
SHA-256:	EA7E53C74D1E66FB0363A16DCCB2B893183937BF4A69770EA44D6BCD6C1A15D6
SHA-512:	54292A35794B0E147BDCDE724D7101FEDD499F5799175545C5E2BB4362D6387B713EBF511EBF25B4D7E41086073E167524C401936623BB3AE8E337E3D5ADE5CF
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........hw...........q......\|......\|......\|......\|.....P\|.....b............P\|.....P\|.....P\|.....P\|.....Rich............PE..d......b.........." ................................................................."....`..........................................p.......}.......................................Y...............................Z..8............................................text............................... ..`.rdata..z...........................@..@.data...(............t..............@....pdata...............v..............@..@.rsrc...............................@..@.reloc..............................@..B................................................................................................................................................................................................................................................

C:\Program Files\FastestVPN\Resources\libssl-1_1-x64.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	700040
Entropy (8bit):	5.552155208041958
Encrypted:	false
SSDEEP:	12288:UB4x/cH7gueaxFi00ZoPqETRzRnYhUpfakLaugPoDhTMY98c8mvVfU2lvzpi/O:avziRZoXuugCtD8JmvNU2lvzpiG
MD5:	6EE5C92E2918B27974086A6F24D79043
SHA1:	40595B75A513BBF1BE16780784E13EFDAD2E40C7
SHA-256:	86F3A19221C710CFF12607FEB00D8CD0AF932873430AD1B59C990593010EC3CF
SHA-512:	F07BBE5D367D6F7474E08507F3827BDCAC5503673F2027CA139303FA573F4EEB7D82A9D88EE0F3291F53629C0644B39E2C81380B45F8E2A286FFCC326AE0E4B7
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.............]...]...]..M]...]..\...]...\...]..\...]..\...]..\...]H..\...]...]o..]H..\...]H..\...]H.!]...]H..\...]Rich...]........PE..d...g..b.........." .....:...L......<.....................................................`..........................................+...N..@E..........s........L..............h.......8...........................@...8............0..@............................text....8.......:.................. ..`.rdata...)...P......>..............@..@.data...QM.......D...h..............@....pdata...T.......V..................@..@.idata..W...0...X..................@..@.00cfg..Q............Z..............@..@.rsrc...s............\..............@..@.reloc..]............d..............@..B................................................................................................................................................................

C:\Program Files\FastestVPN\Resources\libssl32.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	244360
Entropy (8bit):	6.534833630270433
Encrypted:	false
SSDEEP:	6144:lE2PcqwWvsYJlWewlEyDFINgMjY/fVYPCtmA+KiA/R:lE+1JYVEgFugMjXP/A0A/R
MD5:	92CAE75041DFA888EE8284E7C6BB658E
SHA1:	2632FD77EAEDC09977192CFAA19EAEE66F538041
SHA-256:	ACEB2DBBA3948EF0D2908CAE3B2E1586AC82B700C1DE7E6420FA241EFBBB0ECB
SHA-512:	F01AC04FBD3EA1FD4D39D7654DF7D97EB15D60BC9EDFDF36C92176CF8A66FC148E4ECA480F52B7283AF1B9966983F4275A4E221E2D73056A7F3F4290C4D85C17
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...R."K...........#...8............`..............k................................Ub........ ......................P.. ....p...$...................................................................................................................text...t...........................`.P`.data...0%.......&..................@.`..rdata..x^.......`..................@.`@.bss.........@........................@..edata.. ....P.......*..............@.0@.idata...$...p...&...H..............@.0..reloc...............n..............@.0B........................................................................................................................................................................................................................................................................................................................................................

C:\Program Files\FastestVPN\Resources\msvcr100.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	776328
Entropy (8bit):	6.92032788063544
Encrypted:	false
SSDEEP:	12288:uQmCy3NeRjkpQmj3oaMtQqjoygfXq3kon9IlbgaOxQdVJJ6j5EBKX8hUk/K:vmCy3VQs9MtLjTgfa3kon9FaOdEukC
MD5:	6ECA26F16FEB505B1BD0A0A25DA4AEDB
SHA1:	297A6E0D660FAF9E924B2BE827D9D9DC81E4EB85
SHA-256:	CD9005B83CAB43E566F287D1BB1A3DE33F2D67AD5013DC5213232A5DC5309BDB
SHA-512:	78F749E1D591D9AC2C1BB3A47FA7D4099A18303357F990E97D6E531FA50FE2466C8A203504F599C74EE92DFA179CC4AFBC561C60AFD01FA103A3276E79760A46
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........ R.HA<.HA<.HA<.A9..KA<.HA=..A<.'7..@<.'7...A<.'7..\|A<.'7...A<.'7..IA<.'7..IA<.'7..IA<.RichHA<.........PE..L.....K.........."!................. ....... .....x................................m.....@..........................I......D...(............................... L..h...8...........................pE..@............................................text............................... ..`.data...\|Z... ...N..................@....rsrc................X..............@..@.reloc.. L.......N...\..............@..B........................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files\FastestVPN\Resources\openssl.exe (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	918536
Entropy (8bit):	6.038516348303836
Encrypted:	false
SSDEEP:	12288:Kts+IUZyyi1sznLRjH0qawdB1iT7jwq7Kjn+o/J:KtLIUZPyaVH0qawP1iDwjn+oh
MD5:	6F1B7C24C5FF662F4364B323F42C101A
SHA1:	B74949B7A809F8139BD89BD5B96E230108A6615D
SHA-256:	034248CEFD5BC35A927682E44B79C354A0AEE25E800CF99D86EC591FD8722B5A
SHA-512:	B13B4A46FB14C687925DE21982C4DE66C201E9FE16D7C03B2C65900CEF47C5E6DB338545E868EE6216C2A92453557BEA6C0D084B5D76A731CAA00BA821FA40E0
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....$.Y...../...................H................@.................................n.....@... .........................N.......(................................a...................................................#..`............................text...............................`.P`.data....%.......&..................@.`..rdata..D...........................@.`@.bss.....G............................`..edata..N...........................@.0@.idata..(...........................@.0..CRT....4...........................@.0..tls.... ............0..............@.0..reloc...a.......b...2..............@.0B/4...........P......................@..B/19..........`......................@..B/31.....]............8..............@..B/45.......... .......T..............@..B/57..........@.......p..............@.0B/70..........P.......x..............@..B/81..........`.......~..

C:\Program Files\FastestVPN\Resources\openvpn.exe (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp
File Type:	PE32+ executable (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	865416
Entropy (8bit):	6.558002511161394
Encrypted:	false
SSDEEP:	24576:dxRZrLEvOx+pFpQlzLyPkET7c5zaSjLUVaoNkUNBKsEpX:dtUmxmpQFLyPkEixWi
MD5:	A151697A9F14639BFA2CB3E470CEA355
SHA1:	FA45D614ABFF2ED9A707E3DFC02F404CFC18A89F
SHA-256:	4794C710A3E624B1A0D956CFE21EC0433FD85BD2D8EB96ACE3F2B5E5302E225C
SHA-512:	888CFD3919482BB56A15E23A73C868C277CA925EED122327E3399C23D0D647F07B9CD67CCAE28AFD1048A41710DA50126B38E75D7455F56AA95BBECA42D228BF
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$........*.w.K.$.K.$.K.$.3.$.K.$.>.%.K.$.$l$.K.$.>.%.K.$.>.%.K.$.>.%.K.$w>.%.K.$w>.%.K.$. .%.K.$. .%.K.$.K.$.I.$w>.%.K.$w>.%.K.$w>n$.K.$w>.%.K.$Rich.K.$................PE..d.....b.........."...........................@....................................q.....`.........................................Pd..P....d..........8....P...^..................................................`...8............................................text.............................. ..`.rdata..^...........................@..@.data...............................@....pdata...^...P...`..................@..@.rsrc...8...........................@..@.reloc..............................@..B................................................................................................................................................................................................................

C:\Program Files\FastestVPN\Resources\openvpnserv.exe (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp
File Type:	PE32+ executable (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	68744
Entropy (8bit):	6.03232541602541
Encrypted:	false
SSDEEP:	1536:OhNHth2MbtFwpJgYCV7JToLDkhqQovzeTJdCK/C1:OhHTbtsRCskcQovzeTJdCK/a
MD5:	41E94A80206A87D947CE6CF5823494BE
SHA1:	558214579EE8F2732C36F779E545BA1340191E49
SHA-256:	E4275E6430AE1EC21A5CD0F2FC382998DEBC1E433A66129527C1B69792F09F95
SHA-512:	54B0DD18BA43C48B3FC21E4366D7D1DC65147A84AFA3DC29D94C4CF80B49FA67150B8303F576683F712E648CAFF516BFEA3A6F93435D6B33DCAB2C43BC762E35
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........z..h...h...h.......h......h......h......h......h......h.......h...h..ih.......h.......h...h...h.......h..Rich.h..........PE..d.....b.........."......r...\|.......v.........@.............................@............`.................................................x...T.... .......................0..p...................................@...8............................................text....p.......r.................. ..`.rdata...W.......X...v..............@..@.data...............................@....pdata..............................@..@.rsrc........ ......................@..@.reloc..p....0......................@..B................................................................................................................................................................................................................................................

C:\Program Files\FastestVPN\Resources\openvpnserv2.exe (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp
File Type:	PE32 executable (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	27784
Entropy (8bit):	6.488306745612165
Encrypted:	false
SSDEEP:	384:YVfdXePAee0fxvSDv2atBymU+DpbGEgivBpnpwK3CrFqa2S0FP27NBYearrDVY:afdXfOvObbU+Nb5RgrFq7rK/YfrDS
MD5:	41C55E2A9D5D9B23C08E3DC067780DC7
SHA1:	1FB62C7FCF24F604676896121C1CCAFB628C1BE1
SHA-256:	D76995DCE5A5A3B0D77ABB438C14504F9825A6BC98676F1BA8D0CC18CEBB0545
SHA-512:	396E8878BAFCFC0DF994B9AF23176D343230B6F6EE82A71E14EFA56347EF0C63B4D277C029EF9FB3EF69D6F1B8AE73ECF92D8DCEDC9312E0C8BFA86EC0B611D2
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....7X.................6...........T... ...`....@.. ....................................@..................................T..K....`...............>............................................................... ............... ..H............text....4... ...6.................. ..`.rsrc........`.......8..............@..@.reloc...............<..............@..B.................T......H........1..."..........\|0..p...........................................6.(.....(.......0..S............(....o.....s.......o....s.......o......o.........&..o............9.....o............#..6........../E.......0..E............(....o.....s.......o....s.......o.........&........9.....o..............#../..........!7.......0..M.......~....s......o.....;.....o......#......$@(....o.........&........9.....o................,7..........4?.......0..M.......~....s......o.....;.....

C:\Program Files\FastestVPN\Resources\screen_retriever_plugin.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	545680
Entropy (8bit):	6.371479071684404
Encrypted:	false
SSDEEP:	12288:8xqABhfuM6KsuJPR9K+EvLHhDcsgsEO5CllKDh/eF4:8xqDM9+lHNcsgACllKDh/eF4
MD5:	2D885495E81A8B8D1D5305FE20566484
SHA1:	F1D2083D399DD48927CBD83E23F90AD3CE3E0632
SHA-256:	EB2E18881DDD80A3E54527264B3E7C5046F15854A196B76CCAD28E8258F3F1B2
SHA-512:	E2BB9F8E377B381CC13538B39E8B3FB749341FCEF84E7B26749BF35141C6C52A48636BB00C6FA7C585EEC4C01B03CD0EC38C8F3E85E0CA2C2CDA26D026DEF326
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......Do!O..O...O...O..~L...O..~J...O..~K...O..L...O..K...O..J.K.O..~N...O..rN...O...N.y.O...J...O...O...O.......O...M...O.Rich..O.........................PE..d...\|.wf.........." ...(.&...&......................................................$D....`.............................................\|.......P....p....... ..TB...8..........P...p........................ ..(...0...@............@...............................text...P$.......&.................. ..`.rdata.......@.....................@..@.data...tA.........................@....pdata..TB... ...D..................@..@.rsrc........p.......&..............@..@.reloc..P............(..............@..B........................................................................................................................................................................................................................

C:\Program Files\FastestVPN\Resources\sp\driver\windows7\amd64\fastestvpndriver.sys (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp
File Type:	PE32+ executable (native) x86-64, for MS Windows
Category:	dropped
Size (bytes):	77064
Entropy (8bit):	6.309512423177142
Encrypted:	false
SSDEEP:	1536:c3PLyOk59e89l4oTvomRuJeE3dwifb2CLXlYvcM:ML45g0lKPLwifb2CLXcx
MD5:	760475CD23CE23410F37558452B28545
SHA1:	68ED3626CE9ABE090B960EEB909C4324205DDEF0
SHA-256:	113A6934823339B6873D8CE80F629F37BFA912C4B8201428222025754BFEFA7F
SHA-512:	AB9AEF1013B579784C062D2ED30DAB86DAE541862B7C02FF19943D0987A5C7FC8B12A2C8ABCDB521123DB2E8BC1B806834C80E6C43C33164A004D37A59AE725A
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......2.#Rv.M.v.M.v.M.v.L...M.....q.M.....r.M.....s.M.......M.....w.M.....w.M.Richv.M.........................PE..d....m.\.........."..........0......d0.......................................`...............................................................0..P....@....... ...............P......P...................................................H............................text...n........................... ..h.rdata..D...........................@..H.data...............................@....pdata....... ......................@..HINIT....d....0...................... ....rsrc........@......................@..B.reloc.......P......................@..B................................................................................................................................................................................................................................

C:\Program Files\FastestVPN\Resources\sp\driver\windows7\amd64\is-K5R6R.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp
File Type:	PE32+ executable (native) x86-64, for MS Windows
Category:	dropped
Size (bytes):	77064
Entropy (8bit):	6.309512423177142
Encrypted:	false
SSDEEP:	1536:c3PLyOk59e89l4oTvomRuJeE3dwifb2CLXlYvcM:ML45g0lKPLwifb2CLXcx
MD5:	760475CD23CE23410F37558452B28545
SHA1:	68ED3626CE9ABE090B960EEB909C4324205DDEF0
SHA-256:	113A6934823339B6873D8CE80F629F37BFA912C4B8201428222025754BFEFA7F
SHA-512:	AB9AEF1013B579784C062D2ED30DAB86DAE541862B7C02FF19943D0987A5C7FC8B12A2C8ABCDB521123DB2E8BC1B806834C80E6C43C33164A004D37A59AE725A
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......2.#Rv.M.v.M.v.M.v.L...M.....q.M.....r.M.....s.M.......M.....w.M.....w.M.Richv.M.........................PE..d....m.\.........."..........0......d0.......................................`...............................................................0..P....@....... ...............P......P...................................................H............................text...n........................... ..h.rdata..D...........................@..H.data...............................@....pdata....... ......................@..HINIT....d....0...................... ....rsrc........@......................@..B.reloc.......P......................@..B................................................................................................................................................................................................................................

C:\Program Files\FastestVPN\Resources\sp\driver\windows7\i386\fastestvpndriver.sys (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp
File Type:	PE32 executable (native) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	72304
Entropy (8bit):	6.723888135179154
Encrypted:	false
SSDEEP:	1536:IPxegyYti+IPp+RmwN/jlzQH8rzn3oZrx+vJcRUf:jgLQPp+EwN5K8rcZrmq
MD5:	5EE29684A6D1E66FD1590742620448EE
SHA1:	71DB43CA9730411BADD39AB2631A1346EF740AAA
SHA-256:	3506C17F79A4F38482DE5B5835484C7127B9903A9412FB6B668BE441D83D8B30
SHA-512:	5F0E00DAC143ED9995B5FECD023EA950FC7A37691E5A4DEF24DAB0DCBDE058787CD4997BE8B2BBE948E5CCA96E80112F55BA8DE7BDD39D264709813B67FDDC0D
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........U..f;..f;..f;..f:..f;......f;......f;......f;......f;......f;.Rich.f;.........................PE..L....m.\.....................,......>.......................................................................................P...d.......................p:..........................................0...@............................................text............................... ..h.rdata..`...........................@..H.data...............................@...INIT................................ ....rsrc...............................@..B.reloc..^...........................@..B................................................................................................................................................................................................................................................................................................

C:\Program Files\FastestVPN\Resources\sp\driver\windows7\i386\is-HEM9F.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp
File Type:	PE32 executable (native) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	72304
Entropy (8bit):	6.723888135179154
Encrypted:	false
SSDEEP:	1536:IPxegyYti+IPp+RmwN/jlzQH8rzn3oZrx+vJcRUf:jgLQPp+EwN5K8rcZrmq
MD5:	5EE29684A6D1E66FD1590742620448EE
SHA1:	71DB43CA9730411BADD39AB2631A1346EF740AAA
SHA-256:	3506C17F79A4F38482DE5B5835484C7127B9903A9412FB6B668BE441D83D8B30
SHA-512:	5F0E00DAC143ED9995B5FECD023EA950FC7A37691E5A4DEF24DAB0DCBDE058787CD4997BE8B2BBE948E5CCA96E80112F55BA8DE7BDD39D264709813B67FDDC0D
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........U..f;..f;..f;..f:..f;......f;......f;......f;......f;......f;.Rich.f;.........................PE..L....m.\.....................,......>.......................................................................................P...d.......................p:..........................................0...@............................................text............................... ..h.rdata..`...........................@..H.data...............................@...INIT................................ ....rsrc...............................@..B.reloc..^...........................@..B................................................................................................................................................................................................................................................................................................

C:\Program Files\FastestVPN\Resources\sp\driver\windows8\amd64\fastestvpndriver.sys (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp
File Type:	PE32+ executable (native) x86-64, for MS Windows
Category:	dropped
Size (bytes):	104424
Entropy (8bit):	6.366713641084616
Encrypted:	false
SSDEEP:	1536:Y79hJ78bsmPOC5lhtb5FGNk4wZO+cWK4orE3HazVvon6BK2s6th:YpL78XPOCN1GeOUKdebIKfS
MD5:	95FD4F27F82A9E4D6E2A53AF7A9096E6
SHA1:	5F772C89901841AF1814C858359AC5FEB9BE3C24
SHA-256:	98CD2F27906E4FD7FA7FBE0EC747BADEF710BCA736A1AC5EE883756F2185818C
SHA-512:	6B2E2BA90B33F6658C903203317299057C83545D46549D468CDAA1D6F7BCE887310411B9BF6EEA9D19C214A2041BB5E14FD9395CC4E2FE9FC31AB03B88A75019
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......>.d.z...z...z.....~...z.........}.....}...Y@..s....A..{....A..{...Richz...........................PE..d... [.\.........."..........L.................@....................................C.....`.................................................8p..P.......H....`.......R...E..........`#..8............................(..p............ ..`............................text...d........................... ..h.rdata....... ......................@..H.data...@....@.......$..............@....pdata.......`.......,..............@..HINIT.........p.......:.............. ....rsrc...H............J..............@..B.reloc...............P..............@..B................................................................................................................................................................................................................................

C:\Program Files\FastestVPN\Resources\sp\driver\windows8\amd64\is-0G2RR.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp
File Type:	PE32+ executable (native) x86-64, for MS Windows
Category:	dropped
Size (bytes):	104424
Entropy (8bit):	6.366713641084616
Encrypted:	false
SSDEEP:	1536:Y79hJ78bsmPOC5lhtb5FGNk4wZO+cWK4orE3HazVvon6BK2s6th:YpL78XPOCN1GeOUKdebIKfS
MD5:	95FD4F27F82A9E4D6E2A53AF7A9096E6
SHA1:	5F772C89901841AF1814C858359AC5FEB9BE3C24
SHA-256:	98CD2F27906E4FD7FA7FBE0EC747BADEF710BCA736A1AC5EE883756F2185818C
SHA-512:	6B2E2BA90B33F6658C903203317299057C83545D46549D468CDAA1D6F7BCE887310411B9BF6EEA9D19C214A2041BB5E14FD9395CC4E2FE9FC31AB03B88A75019
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......>.d.z...z...z.....~...z.........}.....}...Y@..s....A..{....A..{...Richz...........................PE..d... [.\.........."..........L.................@....................................C.....`.................................................8p..P.......H....`.......R...E..........`#..8............................(..p............ ..`............................text...d........................... ..h.rdata....... ......................@..H.data...@....@.......$..............@....pdata.......`.......,..............@..HINIT.........p.......:.............. ....rsrc...H............J..............@..B.reloc...............P..............@..B................................................................................................................................................................................................................................

C:\Program Files\FastestVPN\Resources\sp\driver\windows8\i386\fastestvpndriver.sys (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp
File Type:	PE32+ executable (native) x86-64, for MS Windows
Category:	dropped
Size (bytes):	104424
Entropy (8bit):	6.366713641084616
Encrypted:	false
SSDEEP:	1536:Y79hJ78bsmPOC5lhtb5FGNk4wZO+cWK4orE3HazVvon6BK2s6th:YpL78XPOCN1GeOUKdebIKfS
MD5:	95FD4F27F82A9E4D6E2A53AF7A9096E6
SHA1:	5F772C89901841AF1814C858359AC5FEB9BE3C24
SHA-256:	98CD2F27906E4FD7FA7FBE0EC747BADEF710BCA736A1AC5EE883756F2185818C
SHA-512:	6B2E2BA90B33F6658C903203317299057C83545D46549D468CDAA1D6F7BCE887310411B9BF6EEA9D19C214A2041BB5E14FD9395CC4E2FE9FC31AB03B88A75019
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......>.d.z...z...z.....~...z.........}.....}...Y@..s....A..{....A..{...Richz...........................PE..d... [.\.........."..........L.................@....................................C.....`.................................................8p..P.......H....`.......R...E..........`#..8............................(..p............ ..`............................text...d........................... ..h.rdata....... ......................@..H.data...@....@.......$..............@....pdata.......`.......,..............@..HINIT.........p.......:.............. ....rsrc...H............J..............@..B.reloc...............P..............@..B................................................................................................................................................................................................................................

C:\Program Files\FastestVPN\Resources\sp\driver\windows8\i386\is-PE3HT.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp
File Type:	PE32+ executable (native) x86-64, for MS Windows
Category:	dropped
Size (bytes):	104424
Entropy (8bit):	6.366713641084616
Encrypted:	false
SSDEEP:	1536:Y79hJ78bsmPOC5lhtb5FGNk4wZO+cWK4orE3HazVvon6BK2s6th:YpL78XPOCN1GeOUKdebIKfS
MD5:	95FD4F27F82A9E4D6E2A53AF7A9096E6
SHA1:	5F772C89901841AF1814C858359AC5FEB9BE3C24
SHA-256:	98CD2F27906E4FD7FA7FBE0EC747BADEF710BCA736A1AC5EE883756F2185818C
SHA-512:	6B2E2BA90B33F6658C903203317299057C83545D46549D468CDAA1D6F7BCE887310411B9BF6EEA9D19C214A2041BB5E14FD9395CC4E2FE9FC31AB03B88A75019
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......>.d.z...z...z.....~...z.........}.....}...Y@..s....A..{....A..{...Richz...........................PE..d... [.\.........."..........L.................@....................................C.....`.................................................8p..P.......H....`.......R...E..........`#..8............................(..p............ ..`............................text...d........................... ..h.rdata....... ......................@..H.data...@....@.......$..............@....pdata.......`.......,..............@..HINIT.........p.......:.............. ....rsrc...H............J..............@..B.reloc...............P..............@..B................................................................................................................................................................................................................................

C:\Program Files\FastestVPN\Resources\sp\install_sp.bat (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp
File Type:	DOS batch file, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	527
Entropy (8bit):	5.160291198458603
Encrypted:	false
SSDEEP:	12:E9T9FHWvxBLzOY7WCKGWXOTIHcrV2/+1Of3T96TuGWYxBoeANyW:E9T9FHWJBLz9SC8zwV2sOD997YBFnW
MD5:	39B9357BA2B8B640ACFAE47275B80C56
SHA1:	0A80D68131736FB29C71D66CEBED9D59258F86DB
SHA-256:	76E9F6F16C00F33BE1717AE60A1FAFA0F90609508F7D613556B145E4C89D103A
SHA-512:	D3144461AC37E13100BE3444586163CCB8A6B767DCD0B7A26353172FD86C06D7AC31CD209C1E472B9DCAF0D5E3CCD80AF78A15B48BE72E4AFBBCB6747338DDCB
Malicious:	false
Preview:	@echo off..@cd /d %~dp0..start sc stop fastestvpndriver..del %systemroot%\system32\drivers\fastestvpndriver.sys....reg Query "HKLM\Hardware\Description\System\CentralProcessor\0" \| find /i "x86" > NUL && set ARCH=i386 \|\| set ARCH=amd64..reg QUERY "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion" \| find /i "Windows 7" > NUL && set OS=windows7 \|\| set OS=windows8....xcopy /y driver\%OS%\%ARCH%\fastestvpndriver.sys %systemroot%\system32\drivers..release\nfregdrv.exe -u fastestvpndriver..release\nfregdrv.exe fastestvpndriver

C:\Program Files\FastestVPN\Resources\sp\is-D3BH1.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp
File Type:	DOS batch file, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	527
Entropy (8bit):	5.160291198458603
Encrypted:	false
SSDEEP:	12:E9T9FHWvxBLzOY7WCKGWXOTIHcrV2/+1Of3T96TuGWYxBoeANyW:E9T9FHWJBLz9SC8zwV2sOD997YBFnW
MD5:	39B9357BA2B8B640ACFAE47275B80C56
SHA1:	0A80D68131736FB29C71D66CEBED9D59258F86DB
SHA-256:	76E9F6F16C00F33BE1717AE60A1FAFA0F90609508F7D613556B145E4C89D103A
SHA-512:	D3144461AC37E13100BE3444586163CCB8A6B767DCD0B7A26353172FD86C06D7AC31CD209C1E472B9DCAF0D5E3CCD80AF78A15B48BE72E4AFBBCB6747338DDCB
Malicious:	false
Preview:	@echo off..@cd /d %~dp0..start sc stop fastestvpndriver..del %systemroot%\system32\drivers\fastestvpndriver.sys....reg Query "HKLM\Hardware\Description\System\CentralProcessor\0" \| find /i "x86" > NUL && set ARCH=i386 \|\| set ARCH=amd64..reg QUERY "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion" \| find /i "Windows 7" > NUL && set OS=windows7 \|\| set OS=windows8....xcopy /y driver\%OS%\%ARCH%\fastestvpndriver.sys %systemroot%\system32\drivers..release\nfregdrv.exe -u fastestvpndriver..release\nfregdrv.exe fastestvpndriver

C:\Program Files\FastestVPN\Resources\sp\is-T3PGP.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp
File Type:	DOS batch file, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	153
Entropy (8bit):	4.487708026306449
Encrypted:	false
SSDEEP:	3:mKDD2G2FuyW+jBFWRO5Na3ymIaKn/kuD/RAKaXyXshWoXnPTHaW:hiPFvL9FHza3fxBuZaXhZbaW
MD5:	2D0CB38D144B0F1A34BD6F715D697658
SHA1:	65B935BEEE274E0BB6C069CB8FC1022E187ECAE2
SHA-256:	DFEE16836EBD2D8E76D0EE660F9B22154A3513591061FF9EF9E540094DDEA8F6
SHA-512:	472D2F8D2C58BC96C100674995A580F0EA3A60F42971A850582CEDB4B9108D42F7CE8D87410203C50EAD3F16B9CA92F3DDB1B4D543F2418FEF6259E754359987
Malicious:	false
Preview:	@echo off..@cd /d %~dp0..start sc stop fastestvpndriver..del %systemroot%\system32\drivers\fastestvpndriver.sys..release\nfregdrv.exe -u fastestvpndriver

C:\Program Files\FastestVPN\Resources\sp\release\is-1ASBC.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	61064
Entropy (8bit):	6.255909242219927
Encrypted:	false
SSDEEP:	768:2/Th9sBDRdQNV0nsDMmkL/DDI6ssEtnrFqnK/Yfrc:lRMVvRkLFWtr6K/Cg
MD5:	9333F583E2D32A47276DCEC7C2391FD2
SHA1:	8757F8136354B7F98407CEBFE8BDA6043972D88E
SHA-256:	AF36609DF5F1F9375354E68E2B8EA57059E44DEC3D089CD9EA509F0816D71294
SHA-512:	922578EFA998B4B92192F3A6839059C01406997F3DBEF0DE70C7BA3F6D73CBDEA04470CD6C214778AAB59EB7602AC354750AE5D97C66286F1215BC415B273222
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......zRl.>3..>3..>3.......3....l.$3....o.v3...<_.<3....y.;3..>3..q3....p.?3....z.?3..Rich>3..................PE..L....K.Q.................p...@......@.............@.................................{.......................................\...P...................................@...................................@............................................text....c.......p.................. ..`.rdata........... ..................@..@.data...\|...........................@....rsrc...............................@..@........................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files\FastestVPN\Resources\sp\release\is-QPO3E.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	159368
Entropy (8bit):	6.430638214966169
Encrypted:	false
SSDEEP:	3072:MnVAyi4UNa5oIMLPX3CD+Y+tQJtbwhOt4SSyd7DK/+1:Msa+hPSDutIyhfq7+/k
MD5:	E7C064693750D51F5AC901A0CF0A987A
SHA1:	0FFE9BAE9054D779F60CE8E0E72D386401C0AF7D
SHA-256:	6138C9EC5082350F9223E87991A779457662FAD1AE937ADFD7229DA509810A14
SHA-512:	12E2CF49B1DA8BD4CEC556F1C816678B7E04D08ED71D94F5734DA6B73AE73E79EC09593CFCF2A27AF73C32645435CF52B127EFB8BACB94C9638249E1365A3CBB
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......Jx.....................)......)..d...).."...............y...)......)......)......)......Rich............PE..L......]...........!........................................................`......8c.............................. ...........P.... ..`............@.......0......0..................................@............................................text...0\|.......................... ..`.rdata...J.......P..................@..@.data...,6....... ..................@....rsrc...`.... ......................@..@.reloc...(...0...0..................@..B........................................................................................................................................................................................................................................................................................................................

C:\Program Files\FastestVPN\Resources\sp\release\nfapi.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	159368
Entropy (8bit):	6.430638214966169
Encrypted:	false
SSDEEP:	3072:MnVAyi4UNa5oIMLPX3CD+Y+tQJtbwhOt4SSyd7DK/+1:Msa+hPSDutIyhfq7+/k
MD5:	E7C064693750D51F5AC901A0CF0A987A
SHA1:	0FFE9BAE9054D779F60CE8E0E72D386401C0AF7D
SHA-256:	6138C9EC5082350F9223E87991A779457662FAD1AE937ADFD7229DA509810A14
SHA-512:	12E2CF49B1DA8BD4CEC556F1C816678B7E04D08ED71D94F5734DA6B73AE73E79EC09593CFCF2A27AF73C32645435CF52B127EFB8BACB94C9638249E1365A3CBB
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......Jx.....................)......)..d...).."...............y...)......)......)......)......Rich............PE..L......]...........!........................................................`......8c.............................. ...........P.... ..`............@.......0......0..................................@............................................text...0\|.......................... ..`.rdata...J.......P..................@..@.data...,6....... ..................@....rsrc...`.... ......................@..@.reloc...(...0...0..................@..B........................................................................................................................................................................................................................................................................................................................

C:\Program Files\FastestVPN\Resources\sp\release\nfregdrv.exe (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	61064
Entropy (8bit):	6.255909242219927
Encrypted:	false
SSDEEP:	768:2/Th9sBDRdQNV0nsDMmkL/DDI6ssEtnrFqnK/Yfrc:lRMVvRkLFWtr6K/Cg
MD5:	9333F583E2D32A47276DCEC7C2391FD2
SHA1:	8757F8136354B7F98407CEBFE8BDA6043972D88E
SHA-256:	AF36609DF5F1F9375354E68E2B8EA57059E44DEC3D089CD9EA509F0816D71294
SHA-512:	922578EFA998B4B92192F3A6839059C01406997F3DBEF0DE70C7BA3F6D73CBDEA04470CD6C214778AAB59EB7602AC354750AE5D97C66286F1215BC415B273222
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......zRl.>3..>3..>3.......3....l.$3....o.v3...<_.<3....y.;3..>3..q3....p.?3....z.?3..Rich>3..................PE..L....K.Q.................p...@......@.............@.................................{.......................................\...P...................................@...................................@............................................text....c.......p.................. ..`.rdata........... ..................@..@.data...\|...........................@....rsrc...............................@..@........................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files\FastestVPN\Resources\sp\uninstall_sp.bat (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp
File Type:	DOS batch file, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	153
Entropy (8bit):	4.487708026306449
Encrypted:	false
SSDEEP:	3:mKDD2G2FuyW+jBFWRO5Na3ymIaKn/kuD/RAKaXyXshWoXnPTHaW:hiPFvL9FHza3fxBuZaXhZbaW
MD5:	2D0CB38D144B0F1A34BD6F715D697658
SHA1:	65B935BEEE274E0BB6C069CB8FC1022E187ECAE2
SHA-256:	DFEE16836EBD2D8E76D0EE660F9B22154A3513591061FF9EF9E540094DDEA8F6
SHA-512:	472D2F8D2C58BC96C100674995A580F0EA3A60F42971A850582CEDB4B9108D42F7CE8D87410203C50EAD3F16B9CA92F3DDB1B4D543F2418FEF6259E754359987
Malicious:	false
Preview:	@echo off..@cd /d %~dp0..start sc stop fastestvpndriver..del %systemroot%\system32\drivers\fastestvpndriver.sys..release\nfregdrv.exe -u fastestvpndriver

C:\Program Files\FastestVPN\Resources\ssleay32.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	585512
Entropy (8bit):	6.002108518534667
Encrypted:	false
SSDEEP:	12288:kavF2w273DAx5at3y6/c1M94lh7NX06qkX/0IT7/5:kAF2w2jE5k3y6/cyinNXy4B7h
MD5:	2C700BBCDA59BFE2CD7EBF9BAA5B2626
SHA1:	72EFAA0E8652FB4ADC21E4484E7F63AA968F39D2
SHA-256:	C9C59AB5B3369B97C85129F160491BD743B68DE1AD41EE6EEBA69009407B54E7
SHA-512:	0911C7FED9653D9D50BAD7219E45778367DE4B105B5079A8011415F65465B80782A98A503CEBFB309997BCFB2A8620402579456565A24C69A20CBCBD0130DA20
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....$.Y...........!..............................`n.........................p......L.....@... .........................m).......3...0..@....................@...)........................... .......................................................text...T...........................`.P`.data....-..........................@.`..rdata..............................@.`@.bss....d.............................`..edata..m)..........t..............@.0@.idata...3.......4..................@.0..CRT....,...........................@.0..tls.... .... ......................@.0..rsrc...@....0......................@.0..reloc...)...@.....................@.0B/4...........p......................@..B/19......l.......n..................@..B/31...../............v..............@..B/45.....\|...........................@..B/57..........0......................@.0B/70.....2....@..........

C:\Program Files\FastestVPN\Resources\status.dat (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	277
Entropy (8bit):	5.0491979415178765
Encrypted:	false
SSDEEP:	6:ShdEdI5KGdXrSwCoXV+hn5A59eT5U+hLQsPti5FtEEs6EsctB6WEsF2WEsF+v:6dEKwGxOsw7BB6S2zv
MD5:	C8768E552ABCA40175C704E4AF1F030C
SHA1:	7B8A3BC3310EE72006FD2C5A4D5F4FC60171C81B
SHA-256:	50259EEA13E0A9CB0AC48181F8F4345E6558EE8536CC71D0F6E2F63AE9D89D33
SHA-512:	09FD06DB34894F1EC79B607217DC70E204793E04C58B846DC495DC915F38C1311AC1EE0D3C5CCDE636D8A3D6CE5631EF7291D3617FB3F900FD072CEA5831B573
Malicious:	false
Preview:	OpenVPN STATISTICS..Updated,2023-09-03 07:45:36..TUN/TAP read bytes,1979..TUN/TAP write bytes,9103..TCP/UDP read bytes,15521..TCP/UDP write bytes,5150..Auth read bytes,9103..pre-compress bytes,0..post-compress bytes,0..pre-decompress bytes,204..post-decompress bytes,213..END..

C:\Program Files\FastestVPN\Resources\tapctl.exe (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp
File Type:	PE32+ executable (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	42120
Entropy (8bit):	6.157445136592099
Encrypted:	false
SSDEEP:	768:tFRn6+bvfApVjLj1mFU6rrFqyO9K/Yfryu:tFFepV3j1mm6/pO9K/COu
MD5:	F6AFD5499FCC5D464085AD889BAE09B7
SHA1:	287C540655FCED0C09DDA2D9C4EADD3F3E210B17
SHA-256:	6EDA54D746C092A45395399319DFC878E5674C84FAB8147821524A0042C03F47
SHA-512:	BFD5ED90D0F16A2F0BCC22B0E847D5781A7B11D6912A51CDC8FCAAD80BF191D821418F7544BF52BF6E1AAA47D06A5442601543E9C25B2352D4E23AFC0C4668F9
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......kT../5../5../5..&M<.#5..}@..-5..}@..=5..}@..%5..}@..,5..;^..$5../5..p5...@..,5...@P..5...@...5..Rich/5..........PE..d.....b.........."......0...H.......4.........@....................................e.....`.................................................4g..........@............v..........8...P]...............................]..8............@...............................text..../.......0.................. ..`.rdata...3...@...4...4..............@..@.data...H............h..............@....pdata...............j..............@..@.rsrc...@............n..............@..@.reloc..8............t..............@..B................................................................................................................................................................................................................................................................

C:\Program Files\FastestVPN\Resources\tapinstall.exe (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp
File Type:	PE32+ executable (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	94856
Entropy (8bit):	5.499392443352034
Encrypted:	false
SSDEEP:	1536:RmYSYxGfIZnRnD6M7EFOUakPhtUn6KXF4O7Wm1xK/CpcW:QYFZnRDGdvPXU6K1RWmPK/4h
MD5:	834EE5DA601A6C78C43C64F6C282682F
SHA1:	03920B402B787CA53CD79A66B0B611C899B91F3E
SHA-256:	754B61DA108CC9379585E18DDCE90A8092C1B17DA5D922A6E8D6CE84A90B0F87
SHA-512:	C4A6A49D1EE316FB9EA399487EA17DD813C0A611F473F4FD054D07F6D5C6BB786D40FA478254A499DB3E1D5F0AFDA3B72651EF097945D0C3AA9F0D83D9C0ED06
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........V........-.....;......<.......+....%......S....%......2....~......,.....)...Rich..........PE..d...<..W..........".................Tv..............................................I.....@.......... ..................................................h.......l....D.......p..........................................................X............................text............................... ..`.data...............................@....pdata..l...........................@..@.rsrc...h...........................@..@.reloc..z....p.......B..............@..B................................................................................................................................................................................................................................................................................................

C:\Program Files\FastestVPN\Resources\tapinstallWin32.exe (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	89736
Entropy (8bit):	5.522767465825831
Encrypted:	false
SSDEEP:	768:3urhT5+KybRpnE8K74kca7NerB8iXpYmRRXvdi82BSOe9oKSJ2SLD0BEZWkAzrF9:w+KY04RMmSCYmBiF4O7WTn8K/CI
MD5:	2CC3AC572A2170108BABD019F0BFE779
SHA1:	AF962245CE32D5801A380FF7F6B8C87AC7772AB2
SHA-256:	755315DFCC9C72CBE4EB33AF34E9AAC0BD1324C6942F4B56AD9FE0135E1A9299
SHA-512:	891D545DDF35BF8C650FE8EB48A5E5F6F7C50036E42BE893417AF2EF886EB37C5BEEE9DD838A8F020728E4BAE803F2753CC8F6DD7958DD31B5B39DAED7EF464B
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........L..."..."..."....."......"......"...#.S."....."..`\..."......"......".Rich..".................PE..L...#.pK.................l..........Td.......................................P......0a....@...... ..........................lm..........p............0.......@...... ...............................0...@............................................text... j.......l.................. ..`.data...4............p..............@....rsrc...p............v..............@..@.reloc.......@.......&..............@..B........................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files\FastestVPN\Resources\tapinstallWin64.exe (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp
File Type:	PE32+ executable (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	93832
Entropy (8bit):	5.485112927422894
Encrypted:	false
SSDEEP:	1536:fP2K0pa0WfEYp9Y/XQhpgnbP212YCJpDhiF4O7WGkK/CH8:fePOYe4bu1epDh8RWGkK/b
MD5:	8E7EE7C3876683902475753519681407
SHA1:	75FACB7F9C59B284F97956E799E57FB0F606C49D
SHA-256:	6D5041A8EF796C66BA151D8FCFAFDD96BCAA99B57D2777897FD25A87A5E41E13
SHA-512:	523EBF3A4DF9F6D299E72079DEF0A0DA9127601796D9AA613B70AD2F66EE2166F4F8F75083F47E67FFFD892A09FA437F3B12BD1B27065200E90F8617E3E83727
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........X...9...9...9...AF..9...AW..9...A@..9...9..f9...AP.9...AY..9.......9...AG..9...AB..9..Rich.9..........................PE..d.....pK.........."......~...........s.......................................p............@.......... ......................................X}..........p.......T....@.......`......0................................................................................text....\|.......~.................. ..`.data...x...........................@....pdata..T...........................@..@.rsrc...p...........................@..@.reloc..p....`.......>..............@..B................................................................................................................................................................................................................................................................................................

C:\Program Files\FastestVPN\Resources\texture_rgba_renderer_plugin.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	323472
Entropy (8bit):	6.260791393809843
Encrypted:	false
SSDEEP:	6144:xadPqy3/nKyWFZS3PCmxiVvUTiJ+1I2hWHlHTkPXdxs4:wqyAA3PCmwV8i41I2gHlHTkvdW4
MD5:	128D06B8C5739F35A7C76A76BF1E6149
SHA1:	901F9698BF4C4A10E8E902E6DBDDF1782E1067D0
SHA-256:	BF585DBC4E4DCE47F9EFDEEAD15F67A69644CE6F1177CEEC518882DC85ECC096
SHA-512:	ECE9254486347751D6F68AE86AFB36508FED81B00C4588F555DB584A0E9DE5F4710A24E6BB5B2B19A25BEE20AA4BF90068F9EB2E37B48271614B6C97199E419C
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........x.........................Y...........>w......>w......>w..............<...........u....p.......p.......p......p......Rich............................PE..d...Y.wf.........." ...(.............5....................................... ............`..........................................t......0u..<...............L/..................P...........................(.......@............@..P............................text...0,.......................... ..`.rdata...B...@...D...2..............@..@.data...X6....... ...v..............@....pdata..L/.......0..................@..@.rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................

C:\Program Files\FastestVPN\Resources\uni_links_desktop_plugin.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	543632
Entropy (8bit):	6.3781262731970685
Encrypted:	false
SSDEEP:	12288:zqzF5VH24Jy+0PeZOYbxobw+QY0heC9lVNLETyoK:zqh32SRoc+QY0n9lVNLETbK
MD5:	94267176E212B8EBFF06728CC6C3F432
SHA1:	F65313083C2B3177F405B7AB884BA0A9BE3251D9
SHA-256:	08D08CBFA4D5531CEEE16BFCB2255EDA79C5B7F7C0894C4E6F49F673457AB362
SHA-512:	014459C9D3DBE7C09E0D6DB085CE9F715248BA6D784845339B2D6896A8BA7B680C93E707D4990350E30C8853A95FD0DC6F8E9244643787DB65AB8A2F95C26967
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........W..6..6..6..XF..6..XF...6..XF..6......6......6.......6..XF..6..}J..6..6...6.....6.....6...O.6.....6..Rich.6..........PE..d...~.wf.........." ...(.....4......L.....................................................`.........................................p...........d....p....... ...B...0..........................................(...p...@............0...............................text............................... ..`.rdata.......0......................@..@.data....J.......2..................@....pdata...B... ...D..................@..@.rsrc........p......................@..@.reloc............... ..............@..B........................................................................................................................................................................................................................................

C:\Program Files\FastestVPN\Resources\url_launcher_windows_plugin.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	323472
Entropy (8bit):	6.24323878406639
Encrypted:	false
SSDEEP:	6144:aK/qrBUA8kikYQQ2sXvNnot1bdNtb1lHSdrkjoE:a8qC5kikpQX1ny1bdv1lHSdYjoE
MD5:	BFEC2012B6589D4496EA0283E90A5269
SHA1:	813E3FAD5CFE4A30E20F05080D106811C5544FA3
SHA-256:	F9406ECAA9C86F2946F8B9D997F0210F1F5EE974BE6548D1DB039014D1B45552
SHA-512:	396F28EB15ED793DB453CD3B3E9118F4386FE24A75E3F3914E881CCA3ADA8918B98751BDAC51C4A5E897CCA1E700B2A545686463A6B0DD6719EA172682CFB928
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......`&..$Gt.$Gt.$Gt..7w.!Gt..7q.Gt..7p.4Gt...w..Gt...p.Gt...q.iGt..7u."Gt..;u.'Gt.$Gu.\Gt.7.q.#Gt.7.t.%Gt.7..%Gt.7.v.%Gt.Rich$Gt.........PE..d...^.wf.........." ...(.................................................... .......7....`.........................................@x..\|....x..d...............P...............................................(.......@............@..x............................text...@).......*.................. ..`.rdata...F...@...H..................@..@.data....6....... ...v..............@....pdata..P........0..................@..@.rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................................

C:\Program Files\FastestVPN\Resources\vcruntime140.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	99976
Entropy (8bit):	6.499161413646961
Encrypted:	false
SSDEEP:	1536:yWHL+4KsAzAfadZw+1Hcx8uIYNU5U9H0Q8ecbjt1BHK/CeS:yWr/Z+jPYNV9H0Q8ecbjt1BHK/pS
MD5:	85054BAF6D0A7D31A18183ACC4CBA133
SHA1:	24830C002FFAB31102DFB674B52AFFD74E90E708
SHA-256:	EC86F182F55A338E26F598638F18422E474C6D6C651E1D9955D0303254BF6DDD
SHA-512:	B6B7D9115ED1D734D7C0EB09E7C7C96EEC29E2C59B8943586976F2182E46B660B99C1947ACF2C1DEB75595771A78B7405FDDBB989A2F06CF88E4AD3D8824055A
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......*..qn.."n.."n.."...#l.."g.."e.."n.."B.."<..#c.."<..#~.."<..#q.."<..#o.."<.g"o.."<..#o.."Richn.."................PE..d.....`.........." .........`......p................................................>....`A.........................................B..4....J...............p..X....X..............h,..T............................,..8............................................text............................... ..`.rdata...@.......B..................@..@.data...@....`.......@..............@....pdata..X....p.......D..............@..@_RDATA...............P..............@..@.rsrc................R..............@..@.reloc...............V..............@..B........................................................................................................................................................................................................................

C:\Program Files\FastestVPN\Resources\window_manager_plugin.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	589712
Entropy (8bit):	6.371606969587959
Encrypted:	false
SSDEEP:	12288:Qnu0YqCbnvh0xDqjFR0NdzhdkPJZIR0vnrXkcc9VNLqYWTF:Qu0YqInZCD7mZI0vnrPc9VNLqYWB
MD5:	EAB165F7A1856FC4FC191416A26F20F3
SHA1:	3E3BAAA9A8AE20680D4B347A3A65E4A388DC0F4D
SHA-256:	A2C87DFE4D43C7CC8AC44F2AC43BD45EC4F3F6BA87A2C73AE8B55F26286600E9
SHA-512:	897E0F107BEB1FCC6402183C535F2550E954B379451415E8B40403D0575EFA6E1D1373F9F0B9A0649AB09515259490C7BFB9E9926F76735EE513F68460FB5143
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........:q..T"..T"..T"..W#..T"..Q#W.T"7MW#..T"7MP#..T"7MQ#..T"..P#..T"..U#..T"5.U#..T"..U"T.T".JQ#..T".JT#..T".J."..T".JV#..T"Rich..T"................PE..d.....wf.........." ...(.....P.......8.......................................@............`..........................................\..x...8]....... ..........tF...........0......@...........................(.......@............................................text............................... ..`.rdata..2...........................@..@.data....C.......,...^..............@....pdata..tF.......H..................@..@.rsrc........ ......................@..@.reloc.......0......................@..B................................................................................................................................................................................................................................

C:\Program Files\FastestVPN\Resources\window_size_plugin.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	539536
Entropy (8bit):	6.374120901700144
Encrypted:	false
SSDEEP:	12288:F2qV/eGvVJVbhqs7MRkPXpaCLz9gS+f/9VNtP8zC:F2q9rVJeMp1Lz9gj/9VNtP8zC
MD5:	7024D49DF9315B5718F40FCD29A8656F
SHA1:	EF243D1EC09F2FB714459D596F40A87B5B51C054
SHA-256:	51877E41297AE94FE33D01D980717AE18938A3E81A32C57ADC77D754EF7E66BE
SHA-512:	D9B7661B923B45020641F80A4695079A86F92848A022C8374C9339258A3F63D628000628CF75163B7C707A8506BB4D4928A1EA75E09FA6416EB9A2150EB5B705
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........k....m...m...m..zn...m..zh._.m..zi...m.?.n...m.?.i...m.?.h...m..zl...m.=vl...m...l.}.m..h...m..m...m.....m..o...m.Rich..m.........................PE..d...`.wf.........." ...(.....&......<........................................p.......N....`.........................................P...p.......P....P..........<B... .......`..\...P...........................(.......@............ ...............................text............................... ..`.rdata..,.... ......................@..@.data....B.......*..................@....pdata..<B.......D..................@..@.rsrc........P......................@..@.reloc..\....`......................@..B........................................................................................................................................................................................................................

C:\Program Files\FastestVPN\Resources\wireguard.exe (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp
File Type:	PE32+ executable (GUI) x86-64 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	8184456
Entropy (8bit):	6.15917051663501
Encrypted:	false
SSDEEP:	98304:AD3K0YyOAYcd0ZLpNu6JmM1W8YcTpOG7ZE78O:ALzUwsFYc9OG7ZE78O
MD5:	5850A25689FA1B36CD6B76E2E7F6BDB3
SHA1:	299CEBD4CD448239BF5094DCC0632100287C0B85
SHA-256:	803870B4FCC1A8C0675EE1D5AA5DEB4132514974CDF0F8F7BA40035377FFDCFA
SHA-512:	F64A196D0FE937112604D7B0CFE2099928987ECEAA650728C88ECE9BAEF288AF2E4BCDD52D3199D8787290F5071287DAFA5DC6FD44775E52CA1E04237411888F
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d.........].......".......'..........=........@.......................................}...`... ...............................................c.\|.... d.t.............\|...... c.....................................................`SY.@............................text.....'.......'................. ..`.rdata..PC1...(..D1...'.............@..@.data... ....PY......0Y.............@....idata..\|.....c.......\.............@....reloc....... c.......\.............@..B.symtab.......d.......]................B.rsrc...t.... d.......].............@..@........................................................................................................................................................................................................................................................................................................................................

C:\Program Files\FastestVPN\SQLitePCLRaw.batteries_v2.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	22184
Entropy (8bit):	6.685941492131545
Encrypted:	false
SSDEEP:	384:1hKpVrz0BH8aZqmgBTKDAATaYIYikfF0FP27NBY3Yuv+8N:1hKpVcB15KO7aBYimOK/Y/+g
MD5:	AAA9DA932D572F5B22CBEE1B4E479ED6
SHA1:	D708727DED1298610C2E3D72C8792F12FC60CFF2
SHA-256:	73B55714DB609A1712FD4FC420CE18441E41BB7E3E94D73B11AE28C68CCB1124
SHA-512:	40A8E2CB18FB2D68F0945B6FBF259FA9331327116A6D21A85AAE6AA12600F7FDD3737B5E84E0AE04C584442016882926D9201E16C25EB937838C8BAC24358779
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...z............." ..0.."...........A... ...`....... ...............................6....`..................................A..O....`..`............,..............@..T............................................ ............... ..H............text...."... ...".................. ..`.rsrc...`....`.......$..............@..@.reloc.............................@..B.................A......H........'.......................@.......................................(......0...............(....o........(....s.......0............(.......(....s....(....6r...p..(.....0.._.......s!.....s....}.....{....r...p.r'..p(....o.........."...s....(....%~....(....,..{....o....s....z..0..#.......(......-...(......3...(....s....z...(....%~....(....,.r=..p.r'..p(....s....z..0..#.......(......-..(....&..3..(....&s....z..0..7..........~....%-.&~..........s....%.....(.........

C:\Program Files\FastestVPN\SQLitePCLRaw.core.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	61608
Entropy (8bit):	6.287396747644481
Encrypted:	false
SSDEEP:	768:SmOGveifSTtyXEQ3nPGLb4PFvSMJCD2j+/IfHq1wJd9P581Icm/DskdFPYi3K/Ye:yLTtyXEQ3+bO6U+QlrPi1QLsgFP73K/h
MD5:	A760AEACBE049C8C0D5DD66DD9EAA7A0
SHA1:	975896722F2D5A365621EE407ACE3E3294CFC1C3
SHA-256:	C3618538771839CBC6A855E41A1664D5B86313070FC75CA1B58EF74D007DBDE4
SHA-512:	64CF42CF493686A4286320819D10A37CC075088509866E867A341651B7762FFD88750417E3AD72E6FA78908DD17C66363752E5AA2955066BA4930889D36AE3CA
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....b..........." ..0.................. ........... ....................... .......L....`.....................................O.......0..............................T............................................ ............... ..H............text........ ...................... ..`.rsrc...0...........................@..@.reloc..............................@..B........................H.......@@..<...........\|.................................................(......(......(...........Z~....,..oB...&.............b~....-.r...ps....z~.....(#...o8....0..........(#......o9.....(....Q6.(.....(%....0..........(#........o:.....(....QR.(.......(....('...:(#......o?...N.(.....(.....()...2(#....o;...2(#....o<.....o......o....2(#....o=...2(#....o>...6(#.....o.......0..........s"......}"....{"...-...+....#...s.......(1...6(#.....o....*6..(....(3..

C:\Program Files\FastestVPN\SQLitePCLRaw.provider.dynamic_cdecl.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	75432
Entropy (8bit):	6.020201057914009
Encrypted:	false
SSDEEP:	1536:mjb2NmqeZsE64aEKbMsZG0EN3ovewf8KnWE7LJ/ZEBiUN7TK/P:mjbUmqWL3M/WkV2ZNHK/P
MD5:	8DC8D595216B1D7703575B77282F7147
SHA1:	5FBA510AB9D9677B5AF28757BFCFC3E6EE3228F5
SHA-256:	7A8833790323071279C55854F35A1A802BF5D5766CABCFA381889460F95D5864
SHA-512:	F1E79E49CF5F10C9BC88D2AAA078FABD772027360A8C9692334AC3BBCDFEEDD93C2C6234F4DE6C6B4AFBD443FD6315633FE8943229EE0CB8CA6A6F29C2AE97EE
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...e.Z..........." ..0.............".... ... ....... .......................`......E.....`.....................................O.... ......................@..........T............................................ ............... ..H............text...(.... ...................... ..`.rsrc........ ......................@..@.reloc.......@......................@..B........................H.......pG...................... .......................................6.......(.....~....F~J......o.......N........s....o...+..0............(........~......o2....0............(........~K.....o.....0..%.........(..........(........~L.......o........0..H.........(..........(........~M....o.............(....(.........{........o....2~$....o....2~#....o....2~H....oz...6~I.....o~...:~J......o....2~%....o....2~&....o....>.(.......o....*...0..N........,........s.....

C:\Program Files\FastestVPN\Service\FastestVPN.Common.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	70824
Entropy (8bit):	6.236705505937758
Encrypted:	false
SSDEEP:	1536:dMDv5NwVvDK0HBDk4rVHe061i/kObvmaLLJBr+tTB7sK/T:SorK0HBDk4rV21HObvm2LJB4BAK/T
MD5:	F7543F2749BAB00FB981A41BE19734F8
SHA1:	8BE0A90C7C011EEF0A775A518F2A29CE4AB035AA
SHA-256:	634CD208B4FE8DB050AC7D782CB953D51E266B62369F0F80B0CF9D10D077A76F
SHA-512:	160FBEB4AE704D00800656274B7680003C64559867ACEFB9274A23A1AEE45A145254E66DF423653CC3776A2FFA2A4F98BA93510109CF9963AED4CEBA2913A106
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.... F..........." ..0.............J.... ... ....... .......................`............`.....................................O.... ......................@......D...8............................................ ............... ..H............text...P.... ...................... ..`.rsrc........ ......................@..@.reloc.......@......................@..B................,.......H.......0<................................................................("...^.("......I...%...}....:.(".....}....b.{....%-.&..s#...o$....0..)........{.........(%...t......\|......(...+...3.....0..)........{.........('...t......\|......(...+...3...((.....{...."..}......{...."..}......{...."..}....2.(....s).....{...."..}......{...."..}......{...."..}......((.....{...."..}......{...."..}......{...."..}......{...."..}......((.....{...."..}......{

C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.InstallLog

Download File

Process:	C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	1685
Entropy (8bit):	4.793020246491965
Encrypted:	false
SSDEEP:	24:LLVFOGbexvLxcESrKFR8v4rUKtr4DsVZd+LJ0I6YIXjf8bLVFOGblLQM9XIxkKxV:0VNcVrYR8grUOIsX5I6vXapIKKbv
MD5:	92C0400BF8CDD574F669E40B8D0C2BAB
SHA1:	3EB5155763A3A204982D4231C7E882DC91F0016F
SHA-256:	FDC8BFD5790E64F7DE5425BBA4C80A2E8F1648EE037D9A2B61070A8565B12A4A
SHA-512:	9698839D57A4E3A34BA24CB4BDD6CACF97695748089448AC259CD939D952DF395C82A83E260CF75F8004FE33561E1365CDA1AF1C2DC70F63E28E6EA7403CED0D
Malicious:	false
Preview:	.Uninstalling assembly 'C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe'...Affected parameters are:.. logtoconsole = .. logfile = C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.InstallLog.. assemblypath = C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe..Removing EventLog source FastestVPNService...Warning: The source FastestVPNService is not registered on the local machine...Service FastestVPNService is being removed from the system.....An exception occurred during the uninstallation of the System.ServiceProcess.ServiceInstaller installer...System.ComponentModel.Win32Exception: The specified service does not exist as an installed service..An exception occurred while uninstalling. This exception will be ignored and the uninstall will continue. However, the application might not be fully uninstalled after the uninstall is complete...Installing assembly 'C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe'...Affected

C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.InstallState

Download File

Process:	C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with very long lines (7463), with no line terminators
Category:	dropped
Size (bytes):	7466
Entropy (8bit):	5.1606801095705865
Encrypted:	false
SSDEEP:	96:R3DrP/zatgCnNjn1x62muDr9aHmzcv/65m7JDcm0BeUanDtEx6vU4ZPn/R++JDrk:NexdYX7OqWovsx1EvsrJ
MD5:	FFB29BD88BD23C639985F1D369DBD1CA
SHA1:	F0AF5F803F59668AD52EA4B212A1CDE00DD5FE14
SHA-256:	1ADB4F9D1D152E018246A0A2762B473D910906340207F57D3F8CE1097E1DE09F
SHA-512:	1C12CF185691EE3D44A8522665F6AD20F41A4EE9C5A758B8DD2ABF7CC8F5F863F5CF5CB919BADFCDEE40394A89DA2C9A9601B93FB01B867932FAD4C03932B94D
Malicious:	false
Preview:	.<?xml version="1.0" encoding="utf-8"?><ArrayOfKeyValueOfanyTypeanyType xmlns:i="http://www.w3.org/2001/XMLSchema-instance" xmlns:x="http://www.w3.org/2001/XMLSchema" z:Id="1" z:Type="System.Collections.Hashtable" z:Assembly="0" xmlns:z="http://schemas.microsoft.com/2003/10/Serialization/" xmlns="http://schemas.microsoft.com/2003/10/Serialization/Arrays"><LoadFactor z:Id="2" z:Type="System.Single" z:Assembly="0" xmlns="">0.72</LoadFactor><Version z:Id="3" z:Type="System.Int32" z:Assembly="0" xmlns="">2</Version><Comparer i:nil="true" xmlns="" /><HashCodeProvider i:nil="true" xmlns="" /><HashSize z:Id="4" z:Type="System.Int32" z:Assembly="0" xmlns="">3</HashSize><Keys z:Id="5" z:Type="System.Object[]" z:Assembly="0" z:Size="2" xmlns=""><anyType z:Id="6" z:Type="System.String" z:Assembly="0" xmlns="http://schemas.microsoft.com/2003/10/Serialization/Arrays">_reserved_nestedSavedStates</anyType><anyType z:Id="7" z:Type="System.String" z:Assembly="0" xmlns="http://schemas.microsoft.com/20

C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	25768
Entropy (8bit):	6.588649497011045
Encrypted:	false
SSDEEP:	384:RYTtf+jLXlZfCd8RzDiFrlwkmGWUlupd0IYisq+i0FP27NBY3Yuv+42r:RYpKjlZfC6Fqg7FYiQ7K/Y/+42r
MD5:	22D4E4267DFE093E5E23C2F3D7741AA4
SHA1:	AB18989C4442EB204528E64B18000E8E02FA2C50
SHA-256:	4E296E9B159F5D64E6E71821C9C06260AC02EBB424823ADA64E97DFD418C3CA1
SHA-512:	7F6D1228F93E454477E3C4250D1D0C78995DE8D9AE07FA585DC8BDCBB4A1046338B66BEFE0BD9BF63F61085657F7080A1C6350403292E484F047F9ED791EF43B
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L..._S............"...0..............M... ...`....@.. ...............................0....`..................................M..O....`..,............:..............L..8............................................ ............... ..H............text....-... ...................... ..`.rsrc...,....`.......0..............@..@.reloc...............8..............@..B.................M......H........(..H#...........L................................................{...."..}....6.(.....(......0..g.........(....... ....0.. .....0. .....". .....&. .....#. .....!. ......(,...(-...(....(/...(0...(1.....0..J.......(....(....-.(....(....&~....r...p(.....(.......1.~......(....(......(....Z(-....(....%-.&o........0.."........r...p..(....(....(....(......&.....................0..#....... F#.....+..(....-....X...X....2....0..1.......(....o......,...-..*..+.

C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe.config (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	1327
Entropy (8bit):	5.042117116126737
Encrypted:	false
SSDEEP:	24:JdArztW1oF7Nv+pvH2/+jSLVhOXrRH2/dVv+BvH2/+jSLVtvH2/39y:3Arzcq7h+Fg+mL27Rgdp+dg+mLPg3w
MD5:	E40244BE7715300DC4BA229C25237728
SHA1:	F9D299542C616D860D495CE59A6FD2B90907B2E5
SHA-256:	AE5027694FF0D363F757F112162AC8D49550826872C9A5B2BA67A75F56109C4D
SHA-512:	CBEA4111D0A2D8BB5FF5AD631728C85A38668C6D470AB8A4D59D5334B9309EF34125E9A9F70EA942113212D5B1FD5EABF9DF860F9112B52D55C95EE32BB8721A
Malicious:	true
Preview:	.<?xml version="1.0" encoding="utf-8"?>..<configuration>.. <startup> .. <supportedRuntime version="v4.0" sku=".NETFramework,Version=v4.8" />.. </startup>.. <runtime>.. <legacyCorruptedStateExceptionsPolicy enabled="true" />.. <assemblyBinding xmlns="urn:schemas-microsoft-com:asm.v1">.. <dependentAssembly>.. <assemblyIdentity name="Microsoft.Owin.Security" publicKeyToken="31bf3856ad364e35" culture="neutral" />.. <bindingRedirect oldVersion="0.0.0.0-4.2.2.0" newVersion="4.2.2.0" />.. </dependentAssembly>.. <dependentAssembly>.. <assemblyIdentity name="Newtonsoft.Json" publicKeyToken="30ad4fe6b2a6aeed" culture="neutral" />.. <bindingRedirect oldVersion="0.0.0.0-13.0.0.0" newVersion="13.0.0.0" />.. </dependentAssembly>.. <dependentAssembly>.. <assemblyIdentity name="Microsoft.Owin" publicKeyToken="31bf3856ad364e35" culture="neutral" />.. <bindingRedirect oldVersion="0.0.0.0-4.2.2.0" newVersion="4.2.2.0

C:\Program Files\FastestVPN\Service\InstallUtil.InstallLog

Download File

Process:	C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	1004
Entropy (8bit):	4.743456157396208
Encrypted:	false
SSDEEP:	24:0wL/mMAGQOhPs43XVwL/mMAG8ipNVewL/mMAGbNXpsgOhn:0LTqnVLh6eLY5c
MD5:	FB8F7A7B8FD8826568D2DEE10D1C9AC1
SHA1:	D59BBFA7ED11D7044716AD555C4618824133A06C
SHA-256:	B3C7D69A8763580BB1B0978B8C87FED4E1C8C9934497451D3D813B46B3F8A3F3
SHA-512:	9DE3C7198F3C42227B9DE16246C189DEF584F51B2A17D210D3ED37346BD7B32989B5CB4F26F548E8FD3C88B166F6FBC1BB3A1DA1A35E83DE417ACC0F4A624485
Malicious:	false
Preview:	.....The uninstall is beginning...See the contents of the log file for the C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe assembly's progress...The file is located at C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.InstallLog.....The uninstall has completed.....Running a transacted installation.....Beginning the Install phase of the installation...See the contents of the log file for the C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe assembly's progress...The file is located at C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.InstallLog.....The Install phase completed successfully, and the Commit phase is beginning...See the contents of the log file for the C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe assembly's progress...The file is located at C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.InstallLog.....The Commit phase completed successfully.....The transacted install has complete

C:\Program Files\FastestVPN\Service\Microsoft.AspNet.SignalR.Core.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	347016
Entropy (8bit):	6.2576059322299855
Encrypted:	false
SSDEEP:	6144:+h0+XUaITFNwVI1ZdMfWsaYi3am2Wt6hn7UQjva9v:+u+XUTTvvndMfv64oQu
MD5:	F4B5415B6C9EC38B073779A034421747
SHA1:	DADEC8724A898C84A9F52A86A5D0ACFA71758341
SHA-256:	2672829713F57630F2FC4DA57926456DDA7832F0E0F474F06462D2340B4DC4E3
SHA-512:	82C58B9061CB8B4603B88AB69CD43461A886029AA7CE1A1ADB614F07EEE90FA979F7CC524272D6A494BADC79254906182DE5A90BF992E48160CA5C3DBE57C334
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...U=............" ..0..............<... ...@....... ....................................`.................................z<..O....@...............(...#...`.......;..T............................................ ............... ..H............text........ ...................... ..`.rsrc........@....... ..............@..@.reloc.......`.......&..............@..B.................<......H.......$....m..............H(...;........................................{0.....{1...V.(2.....}0.....}1......0..;........u......,/(3....{0....{0...o4...,.(5....{1....{1...o6..... .... )UU.Z(3....{0...o7...X )UU.Z(5....{1...o8...X.0...........r...p......%..{0....................-.q.............-.&.+.......o9....%..{1....................-.q.............-.&.+.......o9....(:.....{;.....{<...V.(2.....};.....}<......0..;........u......,/(3....{;....{;...o4...,.(5....{<..

C:\Program Files\FastestVPN\Service\Microsoft.Owin.Cors.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	24976
Entropy (8bit):	6.836703429014385
Encrypted:	false
SSDEEP:	384:STg0otikxUoOHLLEzFzd7h8NTif2+3mJJWg/0W2yHRN7OBu1x85zR9zphght:SwtLUoOrud7hqE2+3mdYuz109zpc
MD5:	5E8C253B1394C1E6E396A939C9FC9068
SHA1:	6AE721F34E256FD90A99617BA19040D45FF6A41F
SHA-256:	4B1A93C57580BD0F304B214EAA3C451272821ACAFC6A0EAE34976606030E0D69
SHA-512:	22CCA8638EF56059A9DE79289D3EB8289F0774579059C6785B08D08229E366BC8E9FA591EAAFBB4F2952FF7627D1CA0AB180C2B82555BA9C4BC8806F837F478D
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...l?J..........." ..0..0..........^N... ...`....... ..............................L.....`..................................N..O....`..(............:...'...........@..p............................................ ............... ..H............text...d.... ...0.................. ..`.rsrc...(....`.......2..............@..@.reloc...............8..............@..B................@N......H........&..,....................@.......................................0..T........(.....-.r...ps....z.-.r...ps....z..}......o....%-.&s....}......o....%-.&s....}.....0..?.........(....}.......}.......}.......}......\|......(...+..\|....(......0..%............(....,...(.....{.....o....o........0..I........o....(....-%.....(....,..o ... ....o!.....(....+..o ... ....o!....(...+v..{......o#...Q.P,..Po$......0..M........o%.....,B.o&....+%.o'.....o ...o(.....().....(*...o+...

C:\Program Files\FastestVPN\Service\Microsoft.Owin.Diagnostics.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	166800
Entropy (8bit):	5.092225196099469
Encrypted:	false
SSDEEP:	3072:JtayaXxHE9B92Pqg6/rKvXkZ5QwupmY6jCPL:yqNDKvUZZkVlL
MD5:	2839920AD2E9C4B08F97715D88586056
SHA1:	88F7544BF59DDD40E3C934C938A20164F3B518F1
SHA-256:	A655B1BC143B918C6F31B52AEA2726C131F474B70BF7E2DDF36FE48B1E6E279D
SHA-512:	E26A141021648398F109B41275154FDFCF139845466C9A37E80A1AD43725D914FD574F59706AD68404555BCB36490CB307E7E0C9158A8B8E94F97CB93E4C0F37
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L................" ..0..Z...........x... ........... ...............................b....`..................................x..O.......8............d...'...........^..p............................................ ............... ..H............text....X... ...Z.................. ..`.rsrc...8............\..............@..@.reloc...............b..............@..B.................x......H........R..............\|S......D^......................................j.-.r...ps$...z.s....(......0..Y........-.r...ps$...z.o%...s&......r...p(...+.r+..p..((.....(...+........%...%...%...>....(...+..-.r...ps$...z......(+.........%...o,...N.sD...%.oC...(....b.sD...%.s-...oC...(....2.sD...(........0..C........(.....-.rC..ps$...z.-.rM..ps$...z..,...o......}......}......}......0..?.........(/...}4......}5......}6......}3.....\|4.....(...+..\|4...(1...j.{....,..{....r]..p.

C:\Program Files\FastestVPN\Service\Microsoft.Owin.Host.HttpListener.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	101776
Entropy (8bit):	6.519631245398067
Encrypted:	false
SSDEEP:	3072:+iE88BMo5Gv8yIu8mRfXU5i8Ubd0L1nDmNxk3NUXwPrSMk7+W+shzS0ICpL:+iE88BMo5Gv8yIu8mRfXU5fUbd01mNxV
MD5:	58D1267BAFC9E0D9531D7C97A08A3A68
SHA1:	1EC6E26D9E71D1CB5C885879CC8F6D3762DC5FD6
SHA-256:	34FB96B4CCA40AC4312E36E3310EACC2C13F2562BAAB7FFE836060965B7AD579
SHA-512:	E6A6EDE57B59CB675D869D1B5BD43C67C864363CE7168538ABB048F911783181546F7CBFEB29EE49EEC21291EEBD442E3BA9819967F8ABE3AD00AC33C94A3620
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....c=..........." ..0..\...........z... ........... ...................................`.................................Kz..O....................f...'..........<C..p............................................ ............... ..H............text....Z... ...\.................. ..`.rsrc................^..............@..@.reloc...............d..............@..B.................z......H..........,............A.......B.......................................0..............o+...-.................0............(...+..-............(...+....0...........(,....s-...}......}/.....}2........(....r...p.$o/......5...(....r+..p.$o/...}1.....(0...,..o1........(....(2...,....{/...o3...t....}0....{1....(4...-..{0...-..{2...rI..p(.....0..D........{1....(4...-..{0...-.(5....{1....o6...o3....l......(........o6....0...........{.......o7...,....(....*...0..........s8..

C:\Program Files\FastestVPN\Service\Microsoft.Owin.Hosting.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	80784
Entropy (8bit):	6.644018601476374
Encrypted:	false
SSDEEP:	1536:hwe4Dxq2afEZznigIM8U/w2ZAfiQ922f5qj1NrVuu26zmb:h54DxLaQAOw2C7922i1JVN6b
MD5:	056A3B1C036A46447EBCA7083DA271A5
SHA1:	8044FD37E124DF9BAFCE4311DB66D6B931120006
SHA-256:	6BEDFFF38EB390D01F0D51340B7B4F8F7B3D1C1C6CEE8888C0A8088EDA19283D
SHA-512:	3399C06120F32219D611D976D778654A2628AC5BA0FA778512FE1101EE461663C5D5819ED5EECF90363F70E69108F5DAA1A3E71E81BB7F9F635AED8908997852
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L................." ..0..............(... ...@....... ..............................M.....`..................................'..O....@..(................'...`..........p............................................ ............... ..H............text........ ...................... ..`.rsrc...(....@......................@..@.reloc.......`......................@..B.................'......H........[..................................................................(........(........(........(......(&.....%-.&(....}......%-.&...'...s(...}......%-.&s....}....j...(....%-.&.{......o)......0..........s........%-.&~.......,(...+-....(......-..(,...-....(......-....o-...}_....o....(,...,.r...p+..o........{_.....(....}`....{`...-.........s/......0.............(......-..*.o0.....o1.....(.....(...+o.....+w.o..........o3........(4...,/.(5...(..........%...%.

C:\Program Files\FastestVPN\Service\Microsoft.Owin.Security.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	65960
Entropy (8bit):	6.704364809732977
Encrypted:	false
SSDEEP:	1536:qC7HwuzTT2IiiiiHnt7qMkPFb5NMBFv8n+nwfqw9ScubQyvz8:LTT2IiN09yPFbwBFyysqhvQyvo
MD5:	3B6AD220174768E52510D449C7A5C817
SHA1:	E76CB664268F45939A0A604E31CAB3DBE957510A
SHA-256:	294A04A1305277ABDF2539649F8A7909DAC57ECF61F223600227BC1CDED6E2DC
SHA-512:	43852FA0F4FD12967DAAF81613FF3C52EAD432F39E579E1C5C834595881A9E6AC156BCE326CEE3EB78D11D81AD33792870D31F81D7737483CF36636DB30DFCF1
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L................" ..0.................. ........... .......................@......=.....`.................................e...O....... ................'... ......`...p............................................ ............... ..H............text........ ...................... ..`.rsrc... ...........................@..@.reloc....... ......................@..B........................H........H...u..............X............................................0..>........-.r...ps....z.o....r...p..o....,..uW.....(....-..("...s....z..-.r...ps....z.-.r...ps....z.o....r...p.o .....(!....s"...(......(......(......{....R..}.....(.....o#.....{...."..}......{...."..}....z.(!.....(......%-.&s$...(......{...."..}......{...."..}......(!....-.r...ps....z..(%...s&...}.....{....o'...-.r...ps(...z....0..g.........,...-.r...ps....z.o)...o..../...o)...o+....

C:\Program Files\FastestVPN\Service\Microsoft.Owin.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	122256
Entropy (8bit):	6.572766216409801
Encrypted:	false
SSDEEP:	3072:nU40ONP+ki9jNhepTRIvy2V7iOHckTTv0c7tSuagvcCy:ShenI6w7wk0Sq3
MD5:	C24CF68C9012B4E261D2FD6B2240BBE8
SHA1:	45844AE139DB45652AAC12E1D6EE138ED709E261
SHA-256:	42ED395C54526DAD6AA275CA2A65F6DE6E94BC8CEC8548CFB9891BA430FF1974
SHA-512:	DDF7872EB70E9546D28A209A562C873BA9E9402AD600C3D44ACD425FC7337C19B581A8C06F8BAD5987B36EF82895AAD0DA48CBC7E0E64886CD0EB7C9884FFA4D
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....0..........." ..0.................. ........... ....................... .......$....`.................................k...O........................'..........0}..p............................................ ............... ..H............text...D.... ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................H........................u.......\|........................................-.r...ps(...z......()....o.....-.r...ps(...z.-.r...ps(...z.......%...(...+&..-.r...ps(...z.-.r...ps(...z.......%...(...+...0..^........-.r...ps(...z.-.r...ps(...z.-.r-..ps(...z.(+...-..rI..p.o,...,.(S...r...ps-...z..s.....(.......0...........-.r...ps(...z.-.r-..ps(...z..(....,$..(....rI..p.o,...,.(S...r...ps-...zs....%.o............%...(...+..o.......o/..........()...o0...t....o.....*...0..s.......

C:\Program Files\FastestVPN\Service\Newtonsoft.Json.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	711952
Entropy (8bit):	5.967185619483575
Encrypted:	false
SSDEEP:	12288:GBja5bBvR8Q0TE2HB0WLmvXbsVG1Gw03RzxNHgKhwFBkjSHXP36RMGy1NqTUO:GBjk38WuBcAbwoA/BkjSHXP36RMG/
MD5:	195FFB7167DB3219B217C4FD439EEDD6
SHA1:	1E76E6099570EDE620B76ED47CF8D03A936D49F8
SHA-256:	E1E27AF7B07EEEDF5CE71A9255F0422816A6FC5849A483C6714E1B472044FA9D
SHA-512:	56EB7F070929B239642DAB729537DDE2C2287BDB852AD9E80B5358C74B14BC2B2DDED910D0E3B6304EA27EB587E5F19DB0A92E1CBAE6A70FB20B4EF05057E4AC
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...p$?..........." ..0.............B.... ........... ....................... ............`....................................O......................../.......... ...T............................................ ............... ..H............text........ ...................... ..`.rsrc...............................@..@.reloc..............................@..B................$.......H.......x...(9............................................................(......(....^.(...........%...}....:.(......}....:.(......}......(....:.(......}......{......(......(....:.(......}......{.....(.............}.....(......{.....X.....}......0...........-.~.....~....X....b...aX...X...X..+....b....aX....X.....2.....cY.....cY....cY..\|....(......._..{........+,..{\|....3...{{......(....,...{{.....{}.......-.....0...........-.r...ps....z.o......-.~.....~....

C:\Program Files\FastestVPN\Service\Owin.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	15528
Entropy (8bit):	6.93175318343703
Encrypted:	false
SSDEEP:	192:KKE4Nl+ACIYiYF80CX+0tvTS8hFP2bnNr/ZyGMLBVYvmvVKNFUK:ZE4OhIYifS0FP27NBY3Yuv+n
MD5:	ADF6FCD8199E4DA7F52FBEBD9D9496D7
SHA1:	17E7E444AB035AE759D3B0E48928B7D23CEC3682
SHA-256:	C1AF49ACF4E6E9B77C025405CB31E6493F4A9A0080AE48381CE3B36EC5E1D76E
SHA-512:	72F42DC40B2B1B9C25F0B4BC6E18BCE4B9F144A39442B05E5DF6FB792EA1F5E0645E5CF6251918AF0D81316437982ADBE6892992E4F4323CF48C84A6B08FD809
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....f.P...........!................N)... ...@....... ....................................@..................................(..W....@...................*...`.......'............................................... ............... ..H............text...T.... ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B................0)......H........ ......................P ......................................-.N...._J...a.w~.{...I..}.B.;=.XT.Jh.;.(f.eU/@r.. .......g...^......{i....h]..A,};......g..4..bb.....(..S).]..Ol.[..r....C.BSJB............v4.0.30319......l.......#~..d.......#Strings............#US.........#GUID...........#Blob...........G.........%3................................................................H.-...p.i.....i.....................8.....W.......p.....p.................i.......;.$...

C:\Program Files\FastestVPN\Service\System.Web.Cors.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	28648
Entropy (8bit):	6.283743404391549
Encrypted:	false
SSDEEP:	384:vPYMDLxA6GikwBUGkXkFmDKAsIh5V7L5XWmzWNsWtyHRN7XZj05seyR9zHA:vgMmZ1dUdGZSDuXZj05sN9zg
MD5:	9FFF1DA4E481028262E27AEFD7C0EFF4
SHA1:	B0128E42E3CE3C295C48461A651AF99D95B5A04D
SHA-256:	3FDB918CC5F1E5F1FA9C155DC68AAFE10A16C73ED934C06B201ED94070EA985D
SHA-512:	6B02B873C4092BFE3C2D8428093696E94C6021DB9D6FA8740E79DF7C6C5208229ED7AE8A62E96597EEEF348956BC6AB79375292B6456162F78D332E3830B75EC
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...P^.b.........." ..0..>...........\... ...`....... ..............................c.....`.................................x\..O....`...............H...'..........@[............................................... ............... ..H............text....<... ...>.................. ..`.rsrc........`.......@..............@..@.reloc...............F..............@..B.................\......H.......(-...+..........8X.......Z........................................(.....s....(.....s....(.....s....(.....s....(......{...."..}......{...."..}......{...."..}......{...."..}......{...."..}......{...."..}......{...."..}......{......0..1..........j...(.........(...._,.r...p(I...s....z..}......{...."..}....*...0..p.......s....%r...po....&%.(....o....&%r/..po....&%.(....o....&%rU..po....&%.(....o....&%r{..po....&%.(.......(....-.r...p+..(.......(.......( .

C:\Program Files\FastestVPN\Service\VPN.AdvancedNetwork.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	35496
Entropy (8bit):	6.3718937380199785
Encrypted:	false
SSDEEP:	768:PS78zRHlzbzaxUxU7y7y7y7S7CxUxU7y3K7yTyTTN77xNTOLSxY777DKoRREEK7/:PS7DOOqf1RuhC5v7YK/CW1
MD5:	D438F337397A4CB3CA4E87F70BC4B4C0
SHA1:	FB6FB592744E34BA9B8B9E2B05F6D9C0C983F353
SHA-256:	80E40E47F7D6EB2C9CB357B1B3951D0B0429087F44BEC066993C26975CDA4A76
SHA-512:	8B9E589D378775331C08CEB908C4FC3BCA2AFBEA776E86163E5C641BF1D5F5E84BBA76B6E5C0102EC388005F8D09EAAA80DFB60185C83BF462543A6903236204
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...>............." ..0..X...........v... ........... ...............................k....`..................................v..O....................`..............v..8............................................ ............... ..H............text....W... ...X.................. ..`.rsrc................Z..............@..@.reloc...............^..............@..B.................v......H........3...B...........................................................0.................(n...........................s)...}................s%...}................s....}................s....}................s....}................s....} ...............s!...}!...............s....}"...............s....}#...............s=...}$...............s9...}%...............s5...}&...............sA...}'...............sE...}(...............s-...})...............s1...}........(....(....(....

C:\Program Files\FastestVPN\Service\VPN.Common.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	60584
Entropy (8bit):	6.426868083769682
Encrypted:	false
SSDEEP:	768:W0YiwXHy9lkD6vudI9C3dt8dNbm+ESg34o556bYIDwpFGpphsA/FIDbaFLdtlxnn:WxJ8kM9CHJ6bY3zkXX8u4iNd7EgIK/X
MD5:	D4BECC422A254D1A75CFC60750572848
SHA1:	2AE1D45045828B8D9A57DD90213F462D72F9A98B
SHA-256:	A8BC4A168A5F9CD7ABBBBFF3F0794F433233A72D557E168AF42BD34FFF3A2F34
SHA-512:	91A1E21F87868A00CF715018577A028413CB638A7965756324AFCF16A6108906DCB355959882C2C555C7276EF1A70627E455B4057695DE8C462E4D0679FEFAC5
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L................." ..0.............r.... ........... ....................... ............`................................. ...O......................................8............................................ ............... ..H............text...x.... ...................... ..`.rsrc...............................@..@.reloc..............................@..B................T.......H.......T0..4.............................................................{...."..}......{...."..}......{...."..}......{...."..}......{...."..}......{...."..}....>.(....o4......>.(....o4......>.(....o2......>.(....o2......>.(....o2......v.(....-..(....,..(....+..+....{...."..}....6..s....}......0............(......,...(k.........0..4.......s......(....}......}......}......}.....\|......(...+.0..Y.........(....o....r...p(....(c....(f....(g.....(......,&.

C:\Program Files\FastestVPN\Service\VPN.OpenVpn.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	31912
Entropy (8bit):	6.377780370750934
Encrypted:	false
SSDEEP:	384:H4sSUSsK/Py54Iu67VMam4AX10KIUt0kYcT/EDYZGSPeyc8cHIlkLi7gIYiNZs0t:HzNK/G4IfVswkYLy5L7pYiNbK/Y/+hM
MD5:	14515F3569114E0060716ABD3AB3265A
SHA1:	9E2DBC71979FFB5E3270C9353EA53448D9E07544
SHA-256:	94DEC461C651A437049E2E5CBA046684E7177C350B836B363880EEEBDD1EBDEA
SHA-512:	7067B02E1493A61BBABA8DDF922A8B5FDC31466F0E28ADAC116865661E739D6939863C44212FB0A22C49D2F3F03D2C28221E54C15FBC6387C43BD47637A349E4
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...r.C..........." ..0..J..........~h... ........... ..............................yA....`.................................h..O....................R..............g..8............................................ ............... ..H............text....H... ...J.................. ..`.rsrc................L..............@..@.reloc...............P..............@..B................^h......H........1...5............................................................{...."..}......{...."..}......{...."..}......{...."..}....&..(........0...........s.......o.....+X..(.........(....o....o....&..(.........,!..r...po....&...(....o....o....&..r...po....&...(....-...........o ......o....o!.....+..............et.......0...........s"...%r...p.o#....%r...pr#..po#....%r+..prA..po#....%r]..p.($...o%...o#....%ro..p.($...o&............o....o'...o#....%r...p.($...o(....

C:\Program Files\FastestVPN\Service\VPN.RAS.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	41128
Entropy (8bit):	6.401085070695131
Encrypted:	false
SSDEEP:	768:lQq+jQ+JutCjyVmF8Wq8sBP3/7lpKaDBuz3bzrzlJBOKipq8pdwYv4qzsYiCtRKS:4VutFQF873t3/77KaDBuz3bzrBJBOKiT
MD5:	AD53B27150F1E38EF23BD155A07E2313
SHA1:	3A9A4383B9286A0E1A3F4102BC56437A5A961E41
SHA-256:	62DBC8A6D43D623E5F267B59A3C78807CB08EFBE37A06A67425C9458D8B985DA
SHA-512:	F8D471175E39425F1E1613C60EDD9D1A98DBACC98E3F18746AA642524AFB7D9F9A299B2BE33629200AB94538BF95C78B6343DE193EE3AD48B1CFC1DD4E37E9D4
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....z:..........." ..0..n..........&.... ........... ....................................`....................................O.......h............v.............@...8............................................ ............... ..H............text...,m... ...n.................. ..`.rsrc...h............p..............@..@.reloc...............t..............@..B........................H........6..PU............................................................{...."..}......{...."..}......~....}......s....}.....(........(.............s...}........0..................,5...(A.....(.........,..~.....(.....s....o.......8..............0....B+......8..... . ...G+.. . ..;....8....~.....(.....s....o.....8....~.....(.....s....o.....+s.o.....~.....(....s....o......(....o ...r...p(!.......,...(.......{.....{....o"....(6...&+...(......s#...(.....+.+....0..F.......

C:\Program Files\FastestVPN\Service\VPN.WireGuard.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	20136
Entropy (8bit):	6.721932799011409
Encrypted:	false
SSDEEP:	384:WaXxdsvBO/dITrZ+VK6G6IYi+PVC0FP27NBY3Yuv+cN:WJZl6GHYiGZK/Y/+cN
MD5:	8E6A799F0DA3FBA278F06D4C7A18E7B5
SHA1:	B9AD516A47362FFAF360C1E8794D2F10C8E7080F
SHA-256:	1029DDF44F3CD774754DDFEAFB97BE18CD31B50DE24F19870F9BDE8163B5DEA5
SHA-512:	4607E418C0BE1F632CBE5CE0A8F1877F45EB873C193B4FF7C52495E891BD05D7F3AA3847D97F36D7B5601FCCAFCF6DE4A822140D9610C9E9BCA900BC06C67DE8
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...W/%..........." ..0.............^;... ...@....... ....................................`..................................;..O....@...............$......`......l:..8............................................ ............... ..H............text...d.... ...................... ..`.rsrc........@......................@..@.reloc.......`......."..............@..B................>;......H........$..............................................................F.(....r...p(......{...."..}......0...........s......r...po....&.r-..p.(....o....(....o....&.rI..p.(....o....r_..p(....o....&.rg..p.(....o....(....o....&.(......,...ru..po....&..r...po....&.r...po....&.r...p.(....o....(....o....&.r...po....&.r...p.(....o....r...p(....o....&.(....o.....o....( ......r...p.(....o!...r...p(....r...p.(....o....r...p(....("...&..r?..prK..p.(.........(#...("...&*..r?..pr...

C:\Program Files\FastestVPN\Service\VPN.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	18088
Entropy (8bit):	6.788270069437216
Encrypted:	false
SSDEEP:	384:CiqjQN+Pw2X6VUYNVYuKAiIYiUOI0FP27NBY3Yuv+Pg:1qjQ8f5uKAvYidpK/Y/+4
MD5:	A891AAC2D9FD1B939E07BE155AFC84FF
SHA1:	7F977350D9CFD10C259356D98C0606779519C6EF
SHA-256:	38D6709A0A003761850933F79132CCDC40B6F26460169BAB092931BBA1500683
SHA-512:	E4227CA484824ED3C912A58B741B4A447ACC50DFFB9945165303D5362BA39217FFAEFC62DF60D292A8B081DAD82CD85593FF64DB93DBC26465355D89AA527724
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...X4y..........." ..0.............n3... ...@....... ...................................`..................................3..O....@..H...................`.......2..8............................................ ............... ..H............text...t.... ...................... ..`.rsrc...H....@......................@..@.reloc.......`......................@..B................N3......H........#................................................................{...."..}......{...."..}......{...."..}......(........%-.&r...ps....z(.......(......0..................,..rM..ps....z.(.........,...(....o.......(.......(.....s....o.........(....(......(....o......(....o........&..(.....r...ps....o..................tu.......0..B..........(....%-.&+.o.......&..(.....(....%-.&.+.(......s....o..........................0..B..........(....%-.&+.o ......*&..(.....

C:\Program Files\FastestVPN\Service\fix-dns-leak-32.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	25768
Entropy (8bit):	6.829205499580206
Encrypted:	false
SSDEEP:	384:+NjMaZomdl7FUC9mhsCVoNycrjIg9J197j26dIYi5YFK0FP27NBY3Yuv+QgP:+HhShzuD/Bpa6KYiyFjK/Y/+PP
MD5:	76DC589253A2FDAAA3CDD02E9F5421DD
SHA1:	A072B9CDDBDC150394643EBFD565A2443AFD9501
SHA-256:	9AC1C9B0343F4D9638FEB4FA25824AFBD2D829EEBF13E54A5FD2197CED2118B5
SHA-512:	50A85E3C61A2506912BC0F4547079DAB2C6B60A882127A4C3087C9AB4065C6568B1E8D4AF246D68BFEE7E7347664883A2FC8E00E2E58EA1DE867FE33D8220861
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......4.a.pi.Hpi.Hpi.H68.Hri.H68.H\|i.H68.Hri.H68.Hti.H...Hqi.H...Hyi.Hpi.HFi.H};.Hsi.H};.Hqi.H};.Hqi.H};.Hqi.HRichpi.H........PE..L....q.Z...........!.................$.......0...............................p.......D....@..........................7......D:.......P...............:...*...`..x...................................p4..@............0...............................text............................... ..`.rdata.......0......."..............@..@.data...\....@.......2..............@....rsrc........P.......4..............@..@.reloc..x....`.......6..............@..B................................................................................................................................................................................................................................................................................................................

C:\Program Files\FastestVPN\Service\iphelperclose.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	116872
Entropy (8bit):	6.726218253535254
Encrypted:	false
SSDEEP:	3072:8tw0r3S8FpUCSBCLiXdb0NphY3kWlon6ZhPn8agN6K/p:8mWi8FpCBCLybQakA/Pn8agNj/p
MD5:	B9F4D43230B7FB66B95AF05DC03B32DE
SHA1:	56F868C56FFF836CA61055499988F965DCA37D26
SHA-256:	A103634B16841E3A68DD4A6BCBDFC3A1651B8C9F1114D99BF01CA31297664E21
SHA-512:	50EB5DE7D0A1B5D7E1AC38209488635EF77733C2C78DC39D0D473904128DBFC67D4E3EC388D2C2D79645AFDF03FD1965386F6E6D21553C9A6DAB07A58549FD1E
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........V.n.7.=.7.=.7.=.S.<.7.=.S.<o7.=.S.<.7.=._.<.7.=._.<.7.=._.<.7.=.S.<.7.=.7.=.7.=._.<.7.=._.<.7.=._3=.7.=._.<.7.=Rich.7.=........................PE..L...q._]...........!................O........0............................................@.............................T.......<.......................................p...............................@............0...............................text............................... ..`.rdata..4g...0...h..................@..@.data...4...........................@....rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................................

C:\Program Files\FastestVPN\Service\is-17D7A.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	20136
Entropy (8bit):	6.721932799011409
Encrypted:	false
SSDEEP:	384:WaXxdsvBO/dITrZ+VK6G6IYi+PVC0FP27NBY3Yuv+cN:WJZl6GHYiGZK/Y/+cN
MD5:	8E6A799F0DA3FBA278F06D4C7A18E7B5
SHA1:	B9AD516A47362FFAF360C1E8794D2F10C8E7080F
SHA-256:	1029DDF44F3CD774754DDFEAFB97BE18CD31B50DE24F19870F9BDE8163B5DEA5
SHA-512:	4607E418C0BE1F632CBE5CE0A8F1877F45EB873C193B4FF7C52495E891BD05D7F3AA3847D97F36D7B5601FCCAFCF6DE4A822140D9610C9E9BCA900BC06C67DE8
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...W/%..........." ..0.............^;... ...@....... ....................................`..................................;..O....@...............$......`......l:..8............................................ ............... ..H............text...d.... ...................... ..`.rsrc........@......................@..@.reloc.......`......."..............@..B................>;......H........$..............................................................F.(....r...p(......{...."..}......0...........s......r...po....&.r-..p.(....o....(....o....&.rI..p.(....o....r_..p(....o....&.rg..p.(....o....(....o....&.(......,...ru..po....&..r...po....&.r...po....&.r...p.(....o....(....o....&.r...po....&.r...p.(....o....r...p(....o....&.(....o.....o....( ......r...p.(....o!...r...p(....r...p.(....o....r...p(....("...&..r?..prK..p.(.........(#...("...&*..r?..pr...

C:\Program Files\FastestVPN\Service\is-17VQ7.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	35496
Entropy (8bit):	6.3718937380199785
Encrypted:	false
SSDEEP:	768:PS78zRHlzbzaxUxU7y7y7y7S7CxUxU7y3K7yTyTTN77xNTOLSxY777DKoRREEK7/:PS7DOOqf1RuhC5v7YK/CW1
MD5:	D438F337397A4CB3CA4E87F70BC4B4C0
SHA1:	FB6FB592744E34BA9B8B9E2B05F6D9C0C983F353
SHA-256:	80E40E47F7D6EB2C9CB357B1B3951D0B0429087F44BEC066993C26975CDA4A76
SHA-512:	8B9E589D378775331C08CEB908C4FC3BCA2AFBEA776E86163E5C641BF1D5F5E84BBA76B6E5C0102EC388005F8D09EAAA80DFB60185C83BF462543A6903236204
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...>............." ..0..X...........v... ........... ...............................k....`..................................v..O....................`..............v..8............................................ ............... ..H............text....W... ...X.................. ..`.rsrc................Z..............@..@.reloc...............^..............@..B.................v......H........3...B...........................................................0.................(n...........................s)...}................s%...}................s....}................s....}................s....}................s....} ...............s!...}!...............s....}"...............s....}#...............s=...}$...............s9...}%...............s5...}&...............sA...}'...............sE...}(...............s-...})...............s1...}........(....(....(....

C:\Program Files\FastestVPN\Service\is-2RVHB.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	116872
Entropy (8bit):	6.726218253535254
Encrypted:	false
SSDEEP:	3072:8tw0r3S8FpUCSBCLiXdb0NphY3kWlon6ZhPn8agN6K/p:8mWi8FpCBCLybQakA/Pn8agNj/p
MD5:	B9F4D43230B7FB66B95AF05DC03B32DE
SHA1:	56F868C56FFF836CA61055499988F965DCA37D26
SHA-256:	A103634B16841E3A68DD4A6BCBDFC3A1651B8C9F1114D99BF01CA31297664E21
SHA-512:	50EB5DE7D0A1B5D7E1AC38209488635EF77733C2C78DC39D0D473904128DBFC67D4E3EC388D2C2D79645AFDF03FD1965386F6E6D21553C9A6DAB07A58549FD1E
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........V.n.7.=.7.=.7.=.S.<.7.=.S.<o7.=.S.<.7.=._.<.7.=._.<.7.=._.<.7.=.S.<.7.=.7.=.7.=._.<.7.=._.<.7.=._3=.7.=._.<.7.=Rich.7.=........................PE..L...q._]...........!................O........0............................................@.............................T.......<.......................................p...............................@............0...............................text............................... ..`.rdata..4g...0...h..................@..@.data...4...........................@....rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................................

C:\Program Files\FastestVPN\Service\is-63I9E.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	65960
Entropy (8bit):	6.704364809732977
Encrypted:	false
SSDEEP:	1536:qC7HwuzTT2IiiiiHnt7qMkPFb5NMBFv8n+nwfqw9ScubQyvz8:LTT2IiN09yPFbwBFyysqhvQyvo
MD5:	3B6AD220174768E52510D449C7A5C817
SHA1:	E76CB664268F45939A0A604E31CAB3DBE957510A
SHA-256:	294A04A1305277ABDF2539649F8A7909DAC57ECF61F223600227BC1CDED6E2DC
SHA-512:	43852FA0F4FD12967DAAF81613FF3C52EAD432F39E579E1C5C834595881A9E6AC156BCE326CEE3EB78D11D81AD33792870D31F81D7737483CF36636DB30DFCF1
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L................" ..0.................. ........... .......................@......=.....`.................................e...O....... ................'... ......`...p............................................ ............... ..H............text........ ...................... ..`.rsrc... ...........................@..@.reloc....... ......................@..B........................H........H...u..............X............................................0..>........-.r...ps....z.o....r...p..o....,..uW.....(....-..("...s....z..-.r...ps....z.-.r...ps....z.o....r...p.o .....(!....s"...(......(......(......{....R..}.....(.....o#.....{...."..}......{...."..}....z.(!.....(......%-.&s$...(......{...."..}......{...."..}......(!....-.r...ps....z..(%...s&...}.....{....o'...-.r...ps(...z....0..g.........,...-.r...ps....z.o)...o..../...o)...o+....

C:\Program Files\FastestVPN\Service\is-6KC91.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	159368
Entropy (8bit):	6.32384599449582
Encrypted:	false
SSDEEP:	3072:OcqXDYZbIkCKezJaoCNVljUmcmAs6Jm4AFt2iPaTatnhrOKK/E:9qbKwcB4njeXBSTcpOT/E
MD5:	7AE17C855F3CC63174E90EA527B6138B
SHA1:	0FE1E1B2252511F33EDA3FFCF1F8FC8586AB040A
SHA-256:	26FF04208EC4D26EF4DDD9B3CF01C4D2A1544550BCD59EFDE6F30170053A1170
SHA-512:	453BA41332A704F491FC9E1EE5FBE9F883EDDB4C26A71D207C93992726E9C5B7FEDC48EEEE2A2087F64B083F9473EE794FB2C8F3B77C9DBCBBC47B67816BD156
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........y..............Y.......................................................................Rich....................PE..L.....[...........!.........................................................`..................................................P.... ..`............@.......0..(...0...............................0...@............................................text....w.......................... ..`.rdata...A.......P..................@..@.data....6....... ..................@....rsrc...`.... ......................@..@.reloc..2(...0...0..................@..B................................................................................................................................................................................................................................................................................................................

C:\Program Files\FastestVPN\Service\is-7I93E.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	347016
Entropy (8bit):	6.2576059322299855
Encrypted:	false
SSDEEP:	6144:+h0+XUaITFNwVI1ZdMfWsaYi3am2Wt6hn7UQjva9v:+u+XUTTvvndMfv64oQu
MD5:	F4B5415B6C9EC38B073779A034421747
SHA1:	DADEC8724A898C84A9F52A86A5D0ACFA71758341
SHA-256:	2672829713F57630F2FC4DA57926456DDA7832F0E0F474F06462D2340B4DC4E3
SHA-512:	82C58B9061CB8B4603B88AB69CD43461A886029AA7CE1A1ADB614F07EEE90FA979F7CC524272D6A494BADC79254906182DE5A90BF992E48160CA5C3DBE57C334
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...U=............" ..0..............<... ...@....... ....................................`.................................z<..O....@...............(...#...`.......;..T............................................ ............... ..H............text........ ...................... ..`.rsrc........@....... ..............@..@.reloc.......`.......&..............@..B.................<......H.......$....m..............H(...;........................................{0.....{1...V.(2.....}0.....}1......0..;........u......,/(3....{0....{0...o4...,.(5....{1....{1...o6..... .... )UU.Z(3....{0...o7...X )UU.Z(5....{1...o8...X.0...........r...p......%..{0....................-.q.............-.&.+.......o9....%..{1....................-.q.............-.&.+.......o9....(:.....{;.....{<...V.(2.....};.....}<......0..;........u......,/(3....{;....{;...o4...,.(5....{<..

C:\Program Files\FastestVPN\Service\is-84F6J.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	1327
Entropy (8bit):	5.042117116126737
Encrypted:	false
SSDEEP:	24:JdArztW1oF7Nv+pvH2/+jSLVhOXrRH2/dVv+BvH2/+jSLVtvH2/39y:3Arzcq7h+Fg+mL27Rgdp+dg+mLPg3w
MD5:	E40244BE7715300DC4BA229C25237728
SHA1:	F9D299542C616D860D495CE59A6FD2B90907B2E5
SHA-256:	AE5027694FF0D363F757F112162AC8D49550826872C9A5B2BA67A75F56109C4D
SHA-512:	CBEA4111D0A2D8BB5FF5AD631728C85A38668C6D470AB8A4D59D5334B9309EF34125E9A9F70EA942113212D5B1FD5EABF9DF860F9112B52D55C95EE32BB8721A
Malicious:	false
Preview:	.<?xml version="1.0" encoding="utf-8"?>..<configuration>.. <startup> .. <supportedRuntime version="v4.0" sku=".NETFramework,Version=v4.8" />.. </startup>.. <runtime>.. <legacyCorruptedStateExceptionsPolicy enabled="true" />.. <assemblyBinding xmlns="urn:schemas-microsoft-com:asm.v1">.. <dependentAssembly>.. <assemblyIdentity name="Microsoft.Owin.Security" publicKeyToken="31bf3856ad364e35" culture="neutral" />.. <bindingRedirect oldVersion="0.0.0.0-4.2.2.0" newVersion="4.2.2.0" />.. </dependentAssembly>.. <dependentAssembly>.. <assemblyIdentity name="Newtonsoft.Json" publicKeyToken="30ad4fe6b2a6aeed" culture="neutral" />.. <bindingRedirect oldVersion="0.0.0.0-13.0.0.0" newVersion="13.0.0.0" />.. </dependentAssembly>.. <dependentAssembly>.. <assemblyIdentity name="Microsoft.Owin" publicKeyToken="31bf3856ad364e35" culture="neutral" />.. <bindingRedirect oldVersion="0.0.0.0-4.2.2.0" newVersion="4.2.2.0

C:\Program Files\FastestVPN\Service\is-902P3.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	24976
Entropy (8bit):	6.836703429014385
Encrypted:	false
SSDEEP:	384:STg0otikxUoOHLLEzFzd7h8NTif2+3mJJWg/0W2yHRN7OBu1x85zR9zphght:SwtLUoOrud7hqE2+3mdYuz109zpc
MD5:	5E8C253B1394C1E6E396A939C9FC9068
SHA1:	6AE721F34E256FD90A99617BA19040D45FF6A41F
SHA-256:	4B1A93C57580BD0F304B214EAA3C451272821ACAFC6A0EAE34976606030E0D69
SHA-512:	22CCA8638EF56059A9DE79289D3EB8289F0774579059C6785B08D08229E366BC8E9FA591EAAFBB4F2952FF7627D1CA0AB180C2B82555BA9C4BC8806F837F478D
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...l?J..........." ..0..0..........^N... ...`....... ..............................L.....`..................................N..O....`..(............:...'...........@..p............................................ ............... ..H............text...d.... ...0.................. ..`.rsrc...(....`.......2..............@..@.reloc...............8..............@..B................@N......H........&..,....................@.......................................0..T........(.....-.r...ps....z.-.r...ps....z..}......o....%-.&s....}......o....%-.&s....}.....0..?.........(....}.......}.......}.......}......\|......(...+..\|....(......0..%............(....,...(.....{.....o....o........0..I........o....(....-%.....(....,..o ... ....o!.....(....+..o ... ....o!....(...+v..{......o#...Q.P,..Po$......0..M........o%.....,B.o&....+%.o'.....o ...o(.....().....(*...o+...

C:\Program Files\FastestVPN\Service\is-9GVKQ.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	31912
Entropy (8bit):	6.377780370750934
Encrypted:	false
SSDEEP:	384:H4sSUSsK/Py54Iu67VMam4AX10KIUt0kYcT/EDYZGSPeyc8cHIlkLi7gIYiNZs0t:HzNK/G4IfVswkYLy5L7pYiNbK/Y/+hM
MD5:	14515F3569114E0060716ABD3AB3265A
SHA1:	9E2DBC71979FFB5E3270C9353EA53448D9E07544
SHA-256:	94DEC461C651A437049E2E5CBA046684E7177C350B836B363880EEEBDD1EBDEA
SHA-512:	7067B02E1493A61BBABA8DDF922A8B5FDC31466F0E28ADAC116865661E739D6939863C44212FB0A22C49D2F3F03D2C28221E54C15FBC6387C43BD47637A349E4
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...r.C..........." ..0..J..........~h... ........... ..............................yA....`.................................h..O....................R..............g..8............................................ ............... ..H............text....H... ...J.................. ..`.rsrc................L..............@..@.reloc...............P..............@..B................^h......H........1...5............................................................{...."..}......{...."..}......{...."..}......{...."..}....&..(........0...........s.......o.....+X..(.........(....o....o....&..(.........,!..r...po....&...(....o....o....&..r...po....&...(....-...........o ......o....o!.....+..............et.......0...........s"...%r...p.o#....%r...pr#..po#....%r+..prA..po#....%r]..p.($...o%...o#....%ro..p.($...o&............o....o'...o#....%r...p.($...o(....

C:\Program Files\FastestVPN\Service\is-AVARB.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	101776
Entropy (8bit):	6.519631245398067
Encrypted:	false
SSDEEP:	3072:+iE88BMo5Gv8yIu8mRfXU5i8Ubd0L1nDmNxk3NUXwPrSMk7+W+shzS0ICpL:+iE88BMo5Gv8yIu8mRfXU5fUbd01mNxV
MD5:	58D1267BAFC9E0D9531D7C97A08A3A68
SHA1:	1EC6E26D9E71D1CB5C885879CC8F6D3762DC5FD6
SHA-256:	34FB96B4CCA40AC4312E36E3310EACC2C13F2562BAAB7FFE836060965B7AD579
SHA-512:	E6A6EDE57B59CB675D869D1B5BD43C67C864363CE7168538ABB048F911783181546F7CBFEB29EE49EEC21291EEBD442E3BA9819967F8ABE3AD00AC33C94A3620
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....c=..........." ..0..\...........z... ........... ...................................`.................................Kz..O....................f...'..........<C..p............................................ ............... ..H............text....Z... ...\.................. ..`.rsrc................^..............@..@.reloc...............d..............@..B.................z......H..........,............A.......B.......................................0..............o+...-.................0............(...+..-............(...+....0...........(,....s-...}......}/.....}2........(....r...p.$o/......5...(....r+..p.$o/...}1.....(0...,..o1........(....(2...,....{/...o3...t....}0....{1....(4...-..{0...-..{2...rI..p(.....0..D........{1....(4...-..{0...-.(5....{1....o6...o3....l......(........o6....0...........{.......o7...,....(....*...0..........s8..

C:\Program Files\FastestVPN\Service\is-BI62G.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	28648
Entropy (8bit):	6.283743404391549
Encrypted:	false
SSDEEP:	384:vPYMDLxA6GikwBUGkXkFmDKAsIh5V7L5XWmzWNsWtyHRN7XZj05seyR9zHA:vgMmZ1dUdGZSDuXZj05sN9zg
MD5:	9FFF1DA4E481028262E27AEFD7C0EFF4
SHA1:	B0128E42E3CE3C295C48461A651AF99D95B5A04D
SHA-256:	3FDB918CC5F1E5F1FA9C155DC68AAFE10A16C73ED934C06B201ED94070EA985D
SHA-512:	6B02B873C4092BFE3C2D8428093696E94C6021DB9D6FA8740E79DF7C6C5208229ED7AE8A62E96597EEEF348956BC6AB79375292B6456162F78D332E3830B75EC
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...P^.b.........." ..0..>...........\... ...`....... ..............................c.....`.................................x\..O....`...............H...'..........@[............................................... ............... ..H............text....<... ...>.................. ..`.rsrc........`.......@..............@..@.reloc...............F..............@..B.................\......H.......(-...+..........8X.......Z........................................(.....s....(.....s....(.....s....(.....s....(......{...."..}......{...."..}......{...."..}......{...."..}......{...."..}......{...."..}......{...."..}......{......0..1..........j...(.........(...._,.r...p(I...s....z..}......{...."..}....*...0..p.......s....%r...po....&%.(....o....&%r/..po....&%.(....o....&%rU..po....&%.(....o....&%r{..po....&%.(.......(....-.r...p+..(.......(.......( .

C:\Program Files\FastestVPN\Service\is-CS1P9.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	18088
Entropy (8bit):	6.788270069437216
Encrypted:	false
SSDEEP:	384:CiqjQN+Pw2X6VUYNVYuKAiIYiUOI0FP27NBY3Yuv+Pg:1qjQ8f5uKAvYidpK/Y/+4
MD5:	A891AAC2D9FD1B939E07BE155AFC84FF
SHA1:	7F977350D9CFD10C259356D98C0606779519C6EF
SHA-256:	38D6709A0A003761850933F79132CCDC40B6F26460169BAB092931BBA1500683
SHA-512:	E4227CA484824ED3C912A58B741B4A447ACC50DFFB9945165303D5362BA39217FFAEFC62DF60D292A8B081DAD82CD85593FF64DB93DBC26465355D89AA527724
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...X4y..........." ..0.............n3... ...@....... ...................................`..................................3..O....@..H...................`.......2..8............................................ ............... ..H............text...t.... ...................... ..`.rsrc...H....@......................@..@.reloc.......`......................@..B................N3......H........#................................................................{...."..}......{...."..}......{...."..}......(........%-.&r...ps....z(.......(......0..................,..rM..ps....z.(.........,...(....o.......(.......(.....s....o.........(....(......(....o......(....o........&..(.....r...ps....o..................tu.......0..B..........(....%-.&+.o.......&..(.....(....%-.&.+.(......s....o..........................0..B..........(....%-.&+.o ......*&..(.....

C:\Program Files\FastestVPN\Service\is-E9VNL.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	80784
Entropy (8bit):	6.644018601476374
Encrypted:	false
SSDEEP:	1536:hwe4Dxq2afEZznigIM8U/w2ZAfiQ922f5qj1NrVuu26zmb:h54DxLaQAOw2C7922i1JVN6b
MD5:	056A3B1C036A46447EBCA7083DA271A5
SHA1:	8044FD37E124DF9BAFCE4311DB66D6B931120006
SHA-256:	6BEDFFF38EB390D01F0D51340B7B4F8F7B3D1C1C6CEE8888C0A8088EDA19283D
SHA-512:	3399C06120F32219D611D976D778654A2628AC5BA0FA778512FE1101EE461663C5D5819ED5EECF90363F70E69108F5DAA1A3E71E81BB7F9F635AED8908997852
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L................." ..0..............(... ...@....... ..............................M.....`..................................'..O....@..(................'...`..........p............................................ ............... ..H............text........ ...................... ..`.rsrc...(....@......................@..@.reloc.......`......................@..B.................'......H........[..................................................................(........(........(........(......(&.....%-.&(....}......%-.&...'...s(...}......%-.&s....}....j...(....%-.&.{......o)......0..........s........%-.&~.......,(...+-....(......-..(,...-....(......-....o-...}_....o....(,...,.r...p+..o........{_.....(....}`....{`...-.........s/......0.............(......-..*.o0.....o1.....(.....(...+o.....+w.o..........o3........(4...,/.(5...(..........%...%.

C:\Program Files\FastestVPN\Service\is-GL2TH.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	122256
Entropy (8bit):	6.572766216409801
Encrypted:	false
SSDEEP:	3072:nU40ONP+ki9jNhepTRIvy2V7iOHckTTv0c7tSuagvcCy:ShenI6w7wk0Sq3
MD5:	C24CF68C9012B4E261D2FD6B2240BBE8
SHA1:	45844AE139DB45652AAC12E1D6EE138ED709E261
SHA-256:	42ED395C54526DAD6AA275CA2A65F6DE6E94BC8CEC8548CFB9891BA430FF1974
SHA-512:	DDF7872EB70E9546D28A209A562C873BA9E9402AD600C3D44ACD425FC7337C19B581A8C06F8BAD5987B36EF82895AAD0DA48CBC7E0E64886CD0EB7C9884FFA4D
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....0..........." ..0.................. ........... ....................... .......$....`.................................k...O........................'..........0}..p............................................ ............... ..H............text...D.... ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................H........................u.......\|........................................-.r...ps(...z......()....o.....-.r...ps(...z.-.r...ps(...z.......%...(...+&..-.r...ps(...z.-.r...ps(...z.......%...(...+...0..^........-.r...ps(...z.-.r...ps(...z.-.r-..ps(...z.(+...-..rI..p.o,...,.(S...r...ps-...z..s.....(.......0...........-.r...ps(...z.-.r-..ps(...z..(....,$..(....rI..p.o,...,.(S...r...ps-...zs....%.o............%...(...+..o.......o/..........()...o0...t....o.....*...0..s.......

C:\Program Files\FastestVPN\Service\is-IBD4C.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	70824
Entropy (8bit):	6.236705505937758
Encrypted:	false
SSDEEP:	1536:dMDv5NwVvDK0HBDk4rVHe061i/kObvmaLLJBr+tTB7sK/T:SorK0HBDk4rV21HObvm2LJB4BAK/T
MD5:	F7543F2749BAB00FB981A41BE19734F8
SHA1:	8BE0A90C7C011EEF0A775A518F2A29CE4AB035AA
SHA-256:	634CD208B4FE8DB050AC7D782CB953D51E266B62369F0F80B0CF9D10D077A76F
SHA-512:	160FBEB4AE704D00800656274B7680003C64559867ACEFB9274A23A1AEE45A145254E66DF423653CC3776A2FFA2A4F98BA93510109CF9963AED4CEBA2913A106
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.... F..........." ..0.............J.... ... ....... .......................`............`.....................................O.... ......................@......D...8............................................ ............... ..H............text...P.... ...................... ..`.rsrc........ ......................@..@.reloc.......@......................@..B................,.......H.......0<................................................................("...^.("......I...%...}....:.(".....}....b.{....%-.&..s#...o$....0..)........{.........(%...t......\|......(...+...3.....0..)........{.........('...t......\|......(...+...3...((.....{...."..}......{...."..}......{...."..}....2.(....s).....{...."..}......{...."..}......{...."..}......((.....{...."..}......{...."..}......{...."..}......{...."..}......((.....{...."..}......{

C:\Program Files\FastestVPN\Service\is-J59NL.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	711952
Entropy (8bit):	5.967185619483575
Encrypted:	false
SSDEEP:	12288:GBja5bBvR8Q0TE2HB0WLmvXbsVG1Gw03RzxNHgKhwFBkjSHXP36RMGy1NqTUO:GBjk38WuBcAbwoA/BkjSHXP36RMG/
MD5:	195FFB7167DB3219B217C4FD439EEDD6
SHA1:	1E76E6099570EDE620B76ED47CF8D03A936D49F8
SHA-256:	E1E27AF7B07EEEDF5CE71A9255F0422816A6FC5849A483C6714E1B472044FA9D
SHA-512:	56EB7F070929B239642DAB729537DDE2C2287BDB852AD9E80B5358C74B14BC2B2DDED910D0E3B6304EA27EB587E5F19DB0A92E1CBAE6A70FB20B4EF05057E4AC
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...p$?..........." ..0.............B.... ........... ....................... ............`....................................O......................../.......... ...T............................................ ............... ..H............text........ ...................... ..`.rsrc...............................@..@.reloc..............................@..B................$.......H.......x...(9............................................................(......(....^.(...........%...}....:.(......}....:.(......}......(....:.(......}......{......(......(....:.(......}......{.....(.............}.....(......{.....X.....}......0...........-.~.....~....X....b...aX...X...X..+....b....aX....X.....2.....cY.....cY....cY..\|....(......._..{........+,..{\|....3...{{......(....,...{{.....{}.......-.....0...........-.r...ps....z.o......-.~.....~....

C:\Program Files\FastestVPN\Service\is-JJ40M.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	41128
Entropy (8bit):	6.401085070695131
Encrypted:	false
SSDEEP:	768:lQq+jQ+JutCjyVmF8Wq8sBP3/7lpKaDBuz3bzrzlJBOKipq8pdwYv4qzsYiCtRKS:4VutFQF873t3/77KaDBuz3bzrBJBOKiT
MD5:	AD53B27150F1E38EF23BD155A07E2313
SHA1:	3A9A4383B9286A0E1A3F4102BC56437A5A961E41
SHA-256:	62DBC8A6D43D623E5F267B59A3C78807CB08EFBE37A06A67425C9458D8B985DA
SHA-512:	F8D471175E39425F1E1613C60EDD9D1A98DBACC98E3F18746AA642524AFB7D9F9A299B2BE33629200AB94538BF95C78B6343DE193EE3AD48B1CFC1DD4E37E9D4
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....z:..........." ..0..n..........&.... ........... ....................................`....................................O.......h............v.............@...8............................................ ............... ..H............text...,m... ...n.................. ..`.rsrc...h............p..............@..@.reloc...............t..............@..B........................H........6..PU............................................................{...."..}......{...."..}......~....}......s....}.....(........(.............s...}........0..................,5...(A.....(.........,..~.....(.....s....o.......8..............0....B+......8..... . ...G+.. . ..;....8....~.....(.....s....o.....8....~.....(.....s....o.....+s.o.....~.....(....s....o......(....o ...r...p(!.......,...(.......{.....{....o"....(6...&+...(......s#...(.....+.+....0..F.......

C:\Program Files\FastestVPN\Service\is-NF2G1.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	60584
Entropy (8bit):	6.426868083769682
Encrypted:	false
SSDEEP:	768:W0YiwXHy9lkD6vudI9C3dt8dNbm+ESg34o556bYIDwpFGpphsA/FIDbaFLdtlxnn:WxJ8kM9CHJ6bY3zkXX8u4iNd7EgIK/X
MD5:	D4BECC422A254D1A75CFC60750572848
SHA1:	2AE1D45045828B8D9A57DD90213F462D72F9A98B
SHA-256:	A8BC4A168A5F9CD7ABBBBFF3F0794F433233A72D557E168AF42BD34FFF3A2F34
SHA-512:	91A1E21F87868A00CF715018577A028413CB638A7965756324AFCF16A6108906DCB355959882C2C555C7276EF1A70627E455B4057695DE8C462E4D0679FEFAC5
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L................." ..0.............r.... ........... ....................... ............`................................. ...O......................................8............................................ ............... ..H............text...x.... ...................... ..`.rsrc...............................@..@.reloc..............................@..B................T.......H.......T0..4.............................................................{...."..}......{...."..}......{...."..}......{...."..}......{...."..}......{...."..}....>.(....o4......>.(....o4......>.(....o2......>.(....o2......>.(....o2......v.(....-..(....,..(....+..+....{...."..}....6..s....}......0............(......,...(k.........0..4.......s......(....}......}......}......}.....\|......(...+.0..Y.........(....o....r...p(....(c....(f....(g.....(......,&.

C:\Program Files\FastestVPN\Service\is-OTL5D.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	301224
Entropy (8bit):	5.822993671222324
Encrypted:	false
SSDEEP:	3072:I856+Aq4WBT5TjbyfQ5d2ap3BES3l+3p7z8p5+cyIqrKMjE3g2AJX5ex4uyj0bOP:v56+Aq4WBTWpSqXhpeEioU2U7/c
MD5:	8E545EE7F96C317AADC4EDA0F0FCF481
SHA1:	242F4D714B142C10368AA82AF91B0A06E0A4E33F
SHA-256:	A67BBFB9EFE5C1CD55D3B8209093BA93370F1EAE4F03A0349696D7B45867EAFC
SHA-512:	77EBC317804B3D0830E76156D93A38980CA113CA80B0A3A2051FDF00D2ABAC96A39AA9BF099AE9CC5AF1E27D14976B5C582096DD6B3AB7F521423FCE6EC11FDE
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........._.Y.1.Y.1.Y.1..l.[.1...>.].1.[.5.[.1.9.\|.X.1...l.D.1.Y.0.p.1...n.V.1...Q.M.1...o.X.1...k.X.1.RichY.1.........PE..L...[..@.................J...................`...............................P......2............ ...........................=..T....@...............n...*..............................................@............................................text....I.......J.................. ..`.data...L....`.......N..............@....rsrc........@.......^..............@..@........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files\FastestVPN\Service\is-PTINH.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	25768
Entropy (8bit):	6.588649497011045
Encrypted:	false
SSDEEP:	384:RYTtf+jLXlZfCd8RzDiFrlwkmGWUlupd0IYisq+i0FP27NBY3Yuv+42r:RYpKjlZfC6Fqg7FYiQ7K/Y/+42r
MD5:	22D4E4267DFE093E5E23C2F3D7741AA4
SHA1:	AB18989C4442EB204528E64B18000E8E02FA2C50
SHA-256:	4E296E9B159F5D64E6E71821C9C06260AC02EBB424823ADA64E97DFD418C3CA1
SHA-512:	7F6D1228F93E454477E3C4250D1D0C78995DE8D9AE07FA585DC8BDCBB4A1046338B66BEFE0BD9BF63F61085657F7080A1C6350403292E484F047F9ED791EF43B
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L..._S............"...0..............M... ...`....@.. ...............................0....`..................................M..O....`..,............:..............L..8............................................ ............... ..H............text....-... ...................... ..`.rsrc...,....`.......0..............@..@.reloc...............8..............@..B.................M......H........(..H#...........L................................................{...."..}....6.(.....(......0..g.........(....... ....0.. .....0. .....". .....&. .....#. .....!. ......(,...(-...(....(/...(0...(1.....0..J.......(....(....-.(....(....&~....r...p(.....(.......1.~......(....(......(....Z(-....(....%-.&o........0.."........r...p..(....(....(....(......&.....................0..#....... F#.....+..(....-....X...X....2....0..1.......(....o......,...-..*..+.

C:\Program Files\FastestVPN\Service\is-QVSDK.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	166800
Entropy (8bit):	5.092225196099469
Encrypted:	false
SSDEEP:	3072:JtayaXxHE9B92Pqg6/rKvXkZ5QwupmY6jCPL:yqNDKvUZZkVlL
MD5:	2839920AD2E9C4B08F97715D88586056
SHA1:	88F7544BF59DDD40E3C934C938A20164F3B518F1
SHA-256:	A655B1BC143B918C6F31B52AEA2726C131F474B70BF7E2DDF36FE48B1E6E279D
SHA-512:	E26A141021648398F109B41275154FDFCF139845466C9A37E80A1AD43725D914FD574F59706AD68404555BCB36490CB307E7E0C9158A8B8E94F97CB93E4C0F37
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L................" ..0..Z...........x... ........... ...............................b....`..................................x..O.......8............d...'...........^..p............................................ ............... ..H............text....X... ...Z.................. ..`.rsrc...8............\..............@..@.reloc...............b..............@..B.................x......H........R..............\|S......D^......................................j.-.r...ps$...z.s....(......0..Y........-.r...ps$...z.o%...s&......r...p(...+.r+..p..((.....(...+........%...%...%...>....(...+..-.r...ps$...z......(+.........%...o,...N.sD...%.oC...(....b.sD...%.s-...oC...(....2.sD...(........0..C........(.....-.rC..ps$...z.-.rM..ps$...z..,...o......}......}......}......0..?.........(/...}4......}5......}6......}3.....\|4.....(...+..\|4...(1...j.{....,..{....r]..p.

C:\Program Files\FastestVPN\Service\is-SQ7U6.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	25768
Entropy (8bit):	6.829205499580206
Encrypted:	false
SSDEEP:	384:+NjMaZomdl7FUC9mhsCVoNycrjIg9J197j26dIYi5YFK0FP27NBY3Yuv+QgP:+HhShzuD/Bpa6KYiyFjK/Y/+PP
MD5:	76DC589253A2FDAAA3CDD02E9F5421DD
SHA1:	A072B9CDDBDC150394643EBFD565A2443AFD9501
SHA-256:	9AC1C9B0343F4D9638FEB4FA25824AFBD2D829EEBF13E54A5FD2197CED2118B5
SHA-512:	50A85E3C61A2506912BC0F4547079DAB2C6B60A882127A4C3087C9AB4065C6568B1E8D4AF246D68BFEE7E7347664883A2FC8E00E2E58EA1DE867FE33D8220861
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......4.a.pi.Hpi.Hpi.H68.Hri.H68.H\|i.H68.Hri.H68.Hti.H...Hqi.H...Hyi.Hpi.HFi.H};.Hsi.H};.Hqi.H};.Hqi.H};.Hqi.HRichpi.H........PE..L....q.Z...........!.................$.......0...............................p.......D....@..........................7......D:.......P...............:...*...`..x...................................p4..@............0...............................text............................... ..`.rdata.......0......."..............@..@.data...\....@.......2..............@....rsrc........P.......4..............@..@.reloc..x....`.......6..............@..B................................................................................................................................................................................................................................................................................................................

C:\Program Files\FastestVPN\Service\is-UI3J1.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	15528
Entropy (8bit):	6.93175318343703
Encrypted:	false
SSDEEP:	192:KKE4Nl+ACIYiYF80CX+0tvTS8hFP2bnNr/ZyGMLBVYvmvVKNFUK:ZE4OhIYifS0FP27NBY3Yuv+n
MD5:	ADF6FCD8199E4DA7F52FBEBD9D9496D7
SHA1:	17E7E444AB035AE759D3B0E48928B7D23CEC3682
SHA-256:	C1AF49ACF4E6E9B77C025405CB31E6493F4A9A0080AE48381CE3B36EC5E1D76E
SHA-512:	72F42DC40B2B1B9C25F0B4BC6E18BCE4B9F144A39442B05E5DF6FB792EA1F5E0645E5CF6251918AF0D81316437982ADBE6892992E4F4323CF48C84A6B08FD809
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....f.P...........!................N)... ...@....... ....................................@..................................(..W....@...................*...`.......'............................................... ............... ..H............text...T.... ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B................0)......H........ ......................P ......................................-.N...._J...a.w~.{...I..}.B.;=.XT.Jh.;.(f.eU/@r.. .......g...^......{i....h]..A,};......g..4..bb.....(..S).]..Ol.[..r....C.BSJB............v4.0.30319......l.......#~..d.......#Strings............#US.........#GUID...........#Blob...........G.........%3................................................................H.-...p.i.....i.....................8.....W.......p.....p.................i.......;.$...

C:\Program Files\FastestVPN\Service\nfapi.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	159368
Entropy (8bit):	6.32384599449582
Encrypted:	false
SSDEEP:	3072:OcqXDYZbIkCKezJaoCNVljUmcmAs6Jm4AFt2iPaTatnhrOKK/E:9qbKwcB4njeXBSTcpOT/E
MD5:	7AE17C855F3CC63174E90EA527B6138B
SHA1:	0FE1E1B2252511F33EDA3FFCF1F8FC8586AB040A
SHA-256:	26FF04208EC4D26EF4DDD9B3CF01C4D2A1544550BCD59EFDE6F30170053A1170
SHA-512:	453BA41332A704F491FC9E1EE5FBE9F883EDDB4C26A71D207C93992726E9C5B7FEDC48EEEE2A2087F64B083F9473EE794FB2C8F3B77C9DBCBBC47B67816BD156
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........y..............Y.......................................................................Rich....................PE..L.....[...........!.........................................................`..................................................P.... ..`............@.......0..(...0...............................0...@............................................text....w.......................... ..`.rdata...A.......P..................@..@.data....6....... ..................@....rsrc...`.... ......................@..@.reloc..2(...0...0..................@..B................................................................................................................................................................................................................................................................................................................

C:\Program Files\FastestVPN\Service\subinacl.exe (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	301224
Entropy (8bit):	5.822993671222324
Encrypted:	false
SSDEEP:	3072:I856+Aq4WBT5TjbyfQ5d2ap3BES3l+3p7z8p5+cyIqrKMjE3g2AJX5ex4uyj0bOP:v56+Aq4WBTWpSqXhpeEioU2U7/c
MD5:	8E545EE7F96C317AADC4EDA0F0FCF481
SHA1:	242F4D714B142C10368AA82AF91B0A06E0A4E33F
SHA-256:	A67BBFB9EFE5C1CD55D3B8209093BA93370F1EAE4F03A0349696D7B45867EAFC
SHA-512:	77EBC317804B3D0830E76156D93A38980CA113CA80B0A3A2051FDF00D2ABAC96A39AA9BF099AE9CC5AF1E27D14976B5C582096DD6B3AB7F521423FCE6EC11FDE
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........._.Y.1.Y.1.Y.1..l.[.1...>.].1.[.5.[.1.9.\|.X.1...l.D.1.Y.0.p.1...n.V.1...Q.M.1...o.X.1...k.X.1.RichY.1.........PE..L...[..@.................J...................`...............................P......2............ ...........................=..T....@...............n...*..............................................@............................................text....I.......J.................. ..`.data...L....`.......N..............@....rsrc........@.......^..............@..@........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files\FastestVPN\SingleInstanceApplication.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	160936
Entropy (8bit):	5.261187861382329
Encrypted:	false
SSDEEP:	3072:kgeojL/a7WvVHjizsw+Uu5MBBA4TigO8K/1:5jDzvVDizsQWMB1iR/1
MD5:	F3F2EB62314A960AD5F60B61A8193CBD
SHA1:	FD77AD6D9F96762CD7EE8D17454D9A7490FD8148
SHA-256:	0F74E741958310B8E65E3B2393828998DB075EBF4C5B29045707948C65CB03CC
SHA-512:	A62D09CF93E604AE0282F05842B607216533800F82ABF75E7D0FF1E9DED5F748B9E34D5E38170F1C837A0957D15FC4C6DF101FF2BE48D90C880807D0FB95D3E6
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...2.Z...........!.........,......n:... ...@....... ....................................@..................................:..S....@..8)...........J..............8............................................... ............... ..H............text...t.... ...................... ..`.rsrc...8)...@.....................@..@.reloc...............H..............@..B................P:......H........#......................P ............................................y.....3....f........UE#.H.NDC..\3,.\|7...1...=.w..n.w.P5.y.......p.._Z@B..h..#,._...p...\|..qXV..6.......i[..2;.'`..=.;...~......0..T.......(..........(....(......r...pr...p(...........s..........,..(......T+...~....(....T..~....,.~....o..........~....,.~....(...........0..e.......s.......o....s......r5..p.o ....r?..p.o ....rQ..pry..po .....s!........~.....("...s#.....r...p($...&....0..A.......

C:\Program Files\FastestVPN\System.Buffers.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	22696
Entropy (8bit):	6.669675167195394
Encrypted:	false
SSDEEP:	384:PICREYcfpyXOT9Z7a6WmYWXWIYiAh70FP27NBY3Yuv+9gfK:PIiE9QXM1xYioMK/Y/+9gi
MD5:	657A48C8DA3DE14059498E383EBEF318
SHA1:	ECCC9AB4E6804EB0581AC5BBD684B7DB5A13F028
SHA-256:	201EC78B195DCE51330985026A8A4EC641F9ACE53429C5C2F5BB3F1CE7BEEC4A
SHA-512:	C4F2410470BBEA5680958490B705C828254992441D27E5FB7837957583FDA8D639EA8D9EF00035DB63ABACF28C5E4560D642C1D19F144255908C44F5C37CE8DE
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....oY.........." ..0..$..........:C... ...`....... ....................................@..................................B..O....`..............................A............................................... ............... ..H............text...@#... ...$.................. ..`.rsrc........`.......&..............@..@.reloc...............,..............@..B.................C......H.......h'..p............?..X...0A......................................j~....%-.&(....s....%..........0..$.........(.....o.......&...,....o....,.....................,!(....,..r...p.(....(......(......(....,.r...p......%...%...(......(.....(....,.r...p......%...%...%...(.......(.....(....,!r...p......%...%...%...%...(........(....2r...p.(..........(......(....R. ...(...+%-.&("...^. ...(#....(...+&~ ....s%..."..s&.....('....*....0........................((

C:\Program Files\FastestVPN\System.Memory.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	143528
Entropy (8bit):	6.164743567434074
Encrypted:	false
SSDEEP:	1536:oxi8ae06y7Q0kSutmvEmFk0pBa/+h8k/6kY2F8xB0dhqABtx5yoG9Qd7n8K/m:Q0vDkSutmhFpYqtDqAhjMQdYK/m
MD5:	24DF113016A58EB1D14691CFE947C2C8
SHA1:	E32B2388C9BCB8BD3EEA1A87626B562A06F5E2F9
SHA-256:	4DE9980CF1D3B45FC14F69EA4DFF6F456389C5E817344D44D6FA7C1A3276AFB5
SHA-512:	10DD82391CF51885533A5F9F859D7E79A9016F6E6A24C0A04C9BE08EA4C5A951D73AF467EC89BAB191DAC4B37D51B0C0AB247A24CD05478AD6101A44E9FC0D48
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...U..\.........." ..0.............b.... ... ....... .......................`......q[....@.....................................O.... ..8...................@..........8............................................ ............... ..H............text...8.... ...................... ..`.rsrc...8.... ......................@..@.reloc.......@......................@..B................C.......H........,..L...........,.................................................((...>..}......}......{......{......{.....{....3..{.....{....()......0...........%.u....,..........(.....z.{....%-.&.+.o....{....(a.....(....zN........o+...s,....(....z.s-.....(....zF(U....(O...s.....(....z.(V...s.....(....z.s/....(....z.s0.....(....zN........o+...s1....(....zrr...p(\....c.M...(O...s2....(....zBr...p(Y...s2....(....z.s3....(....z.(X...s4....(!...z.(_...s4...*.(#...z

C:\Program Files\FastestVPN\System.Numerics.Vectors.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	110760
Entropy (8bit):	5.479763068610726
Encrypted:	false
SSDEEP:	1536:hpKSyD3hoE3PQU9xb1iPKHKWU//6hE2rkQQc76rK/8:qSyLhZ/X9xb1YKqn/unQcOrK/8
MD5:	3FC875FFEFAC2BBA64E6F2A6A7CFF45B
SHA1:	CAB48D6D156261CD9612633D70A61DA670D0D093
SHA-256:	5A12A8D3CA02716C616F56342C920422966ABF79B49C4B1E1C7FF36E97764E1B
SHA-512:	DDA0B6F0587D7915B490FFA2225E72374A2AA671E2019ABDC72EB7598B642906CF09302575C5B5B495B832FF434D45BAD0650C0409358E5D1786F4561FAE3636
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....oY.........." ..0..v..........j.... ........... ....................................@.....................................O..................................t................................................ ............... ..H............text...pu... ...v.................. ..`.rsrc................x..............@..@.reloc..............................@..B................K.......H.......,S..0>..........\.................................................(....&.l(....k&.l(....k..l.l(....k&.l(....k&.l(....k&.l(....kj~....%-.&(....s....%........0..$.........(.....o.......&...,....o....,.....................,!(....,..r...p.(....(......(......(....,.r...p......%...%...(......(.....(....,.r...p......%...%...%...(.......(.....(....,!r...p......%...%...%...%...(........(....2r...p.(....2rG..p.(....2r...p.(....2r...p.(..........(.......

C:\Program Files\FastestVPN\System.Runtime.CompilerServices.Unsafe.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	16768
Entropy (8bit):	6.361391591273708
Encrypted:	false
SSDEEP:	192:LGLxTyHvc4ROgcxAdWXYWJeaPtWsI9A9GaHnhWgN7aJeWw0fnCsqnajt:LgGLROZAdWXYW8aPcyHRN7WEqn1lx
MD5:	DA04A75DDC22118ED24E0B53E474805A
SHA1:	2D68C648A6A6371B6046E6C3AF09128230E0AD32
SHA-256:	66409F670315AFE8610F17A4D3A1EE52D72B6A46C544CEC97544E8385F90AD74
SHA-512:	26AF01CA25E921465F477A0E1499EDC9E0AC26C23908E5E9B97D3AFD60F3308BFBF2C8CA89EA21878454CD88A1CDDD2F2F0172A6E1E87EF33C56CD7A8D16E9C8
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....jM^...........!................^2... ...@....@.. ...............................y....@..................................2..S....@...................#...`....................................................... ............... ..H............text...d.... ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B................@2......H........#..@...................P ......................................{.v.`)!.t..@.62C<.=...h....X..}.`v.r...g.e...yXa.dat.mwQ.XdJ...M..`..J...$\|.j.6W.U.3.r.A.h.....9Q..\|..,<g..gy..6V9o%..Gd.r.0...........q......0..............q.......0..............q.......0..................0......................0......................0............q.............0............q.............0..............0..................0..................0..................0..........

C:\Program Files\FastestVPN\System.Threading.Tasks.Extensions.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	25984
Entropy (8bit):	6.291520154015514
Encrypted:	false
SSDEEP:	384:1R973o62/KqcAnb05J3w0I5eUGef8s72XBWdvVW2JW8aJcyHRN7WEimpplex:1RZ4nNxnYTb6Blha
MD5:	E1E9D7D46E5CD9525C5927DC98D9ECC7
SHA1:	2242627282F9E07E37B274EA36FAC2D3CD9C9110
SHA-256:	4F81FFD0DC7204DB75AFC35EA4291769B07C440592F28894260EEA76626A23C6
SHA-512:	DA7AB8C0100E7D074F0E680B28D241940733860DFBDC5B8C78428B76E807F27E44D1C5EC95EE80C0B5098E8C5D5DA4D48BCE86800164F9734A05035220C3FF11
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....jM^.........." ..0..8...........V... ...`....... ....................................@..................................V..O....`...............B...#..........PU............................................... ............... ..H............text....6... ...8.................. ..`.rsrc........`.......:..............@..@.reloc...............@..............@..B.................V......H........0...$...................T........................................(......(....z..(....z2.(....s....2.(....s....:........o.....~....~.-..(......}......}......}....~.-..(......}......}......}....Z..}......}......}....J.{....%-.&.o....^.u....,........(.....~.{.....{....3..{.....{.......&...(....2...(...........0..'........{......,..u....%-.&..(...+(....(....n.{....,..(....s.....q......0..a.........{....o0.....,;..{....o2...(......;...3.~.......s......

C:\Program Files\FastestVPN\Updater.exe (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	354984
Entropy (8bit):	6.846739611307464
Encrypted:	false
SSDEEP:	6144:jbz6pzdD/rIJXiQTutgCNktQFvmnoxXTS4ubCjrKglegtKop/4:G9FrIJJaqCNktA+SXfUCP9lvtKop/4
MD5:	D822226C4B35A7305269C8E16E542D3E
SHA1:	12F92D16608AAC1C39DDC92BA2B5AB8B5AAE6C30
SHA-256:	FC504A3F68150AFC8C3304E5528867BF99EDDE0F3707406A30371062DDD86A0E
SHA-512:	3A3A18D96716BD1033C35B06B73674FF6CBBEBE8F5025D0BE260F649FB268745290139B6501B9E208EB43EC5D76C2ABBA0A34C1E2F7E0E9F25E14C41F54E3914
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....I}f.........."...0......D......6.... ... ....@.. ..............................o.....`.....................................O.... ..tA...........@.............................................................. ............... ..H............text...<.... ...................... ..`.rsrc...tA... ...B..................@..@.reloc...............>..............@..B........................H........'... ...........G...............................................~.............,!.(...+.1..(...+(....-..(...+(....s....%o....%.o....o....&....0..5........r...p.s....(.....{....,...}....r!..p.s.......(...."..}......(.....rY..p.......{...."..}......{...."..}......{...."..}......{...."..}......{...."..}......{...."..}......{...."..}......{...."..}....*...0............j(......j(.....(....,#.(....o....,..(....o ....(....o!.....(......&...s"...(.....(

C:\Program Files\FastestVPN\Updater.exe.config (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1106
Entropy (8bit):	5.038231865445437
Encrypted:	false
SSDEEP:	24:2dV8F7H3p2/+XBPpZp2/+XBPqp2/+XBw1irkV:cVg7C+XBR4+XBn+XBvrE
MD5:	75E66AB540561A0C7D4160271F518243
SHA1:	AD6501E407D216744B6C3DE76D7664D9581EBAD2
SHA-256:	091AFFF3BB63024B5A7B14EA30306B6753858FD1A33FC8C98E3B5E65FE92FBE7
SHA-512:	FCB55C0FDBB984B06AFF2FAFCAEA2596C175AA5A07D2F1A401305D3441338AA266A53D2DE7A7577684884A2E12CE3EE430B2E1D0210684A7EEFAF9EAA0DE115F
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>..<configuration>.... <appSettings>.. <add key="DownloadLocation" value=""/>.. </appSettings>.... <runtime>.... <assemblyBinding xmlns="urn:schemas-microsoft-com:asm.v1">.... <dependentAssembly>.... <assemblyIdentity name="System.Runtime" publicKeyToken="b03f5f7f11d50a3a" culture="neutral"/>.... <bindingRedirect oldVersion="0.0.0.0-4.0.0.0" newVersion="4.0.0.0"/>.... </dependentAssembly>.... <dependentAssembly>.... <assemblyIdentity name="System.Threading.Tasks" publicKeyToken="b03f5f7f11d50a3a" culture="neutral"/>.... <bindingRedirect oldVersion="0.0.0.0-4.0.0.0" newVersion="4.0.0.0"/>.... </dependentAssembly>.... <dependentAssembly>.... <assemblyIdentity name="System.Net.Http" publicKeyToken="b03f5f7f11d50a3a" culture="neutral"/>.... <bindingRedirect oldVersion="0.0.0.0-4.0.0.0" newVersion="4.0.0.0"/>.... </dependentAssembly>.... </assemblyBinding>.... </runtime>

C:\Program Files\FastestVPN\VPN.AdvancedNetwork.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	35496
Entropy (8bit):	6.3704146545353355
Encrypted:	false
SSDEEP:	768:yS78zRHlzbzaxUxU7y7y7y7S7CxUxU7y3K7yTyTTN77xNTOLSxY777DKoRREEK79:yS7DOOqf1RuhC5w78K/m
MD5:	26592109F19A24EE91F039EBB40038C4
SHA1:	C8846404EFEB44C6CBB242B4C107F7CCE865AD14
SHA-256:	E3F74128991C128410498223D4185915528360AD3DA92CD01BC23B19D8C2C670
SHA-512:	8B031C53F5529D50A80AE2A4803D7C34F9A71A54DA01A912D1DB4D77D9BC1F490AB634A32F2DF6009EB53A2E57CD21975F3E00AF111BFA8320DE550A17509CA1
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...>............." ..0..X...........v... ........... ...............................S....`..................................v..O....................`..............v..8............................................ ............... ..H............text....W... ...X.................. ..`.rsrc................Z..............@..@.reloc...............^..............@..B.................v......H........3...B...........................................................0.................(n...........................s)...}................s%...}................s....}................s....}................s....}................s....} ...............s!...}!...............s....}"...............s....}#...............s=...}$...............s9...}%...............s5...}&...............sA...}'...............sE...}(...............s-...})...............s1...}........(....(....(....

C:\Program Files\FastestVPN\VPN.Common.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	60584
Entropy (8bit):	6.4260026936119194
Encrypted:	false
SSDEEP:	768:D0YiwXHy9lkD6vudI9C3dt8dNbm+ESg34o556bYIDwpFGpphsA/FIDbaFLdtlxn+:DxJ8kM9CHJ6bY3zkXX8u4iNa7ogBK/o
MD5:	550D6E67BB1795B941E91840508BF7F6
SHA1:	46E22693BDC92F4E8DD8C4C5433D233438A271EF
SHA-256:	D4B4CEB77A3D429EE21412E5172AAC6E36C553E7D990137F212E5ADD6B9A9336
SHA-512:	1271BEC8A700AC925B9AC13FDB84FFCCFFA6A1589FA3F9FA1361282C47BB8985A7C8F0335EFDD422E2A708BF2DD46458AEF64B4E2A54B8488F8ED53750337A23
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L................." ..0.............r.... ........... ....................... ............`................................. ...O......................................8............................................ ............... ..H............text...x.... ...................... ..`.rsrc...............................@..@.reloc..............................@..B................T.......H.......T0..4.............................................................{...."..}......{...."..}......{...."..}......{...."..}......{...."..}......{...."..}....>.(....o4......>.(....o4......>.(....o2......>.(....o2......>.(....o2......v.(....-..(....,..(....+..+....{...."..}....6..s....}......0............(......,...(k.........0..4.......s......(....}......}......}......}.....\|......(...+.0..Y.........(....o....r...p(....(c....(f....(g.....(......,&.

C:\Program Files\FastestVPN\VPN.OpenVpn.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	31912
Entropy (8bit):	6.377831305172757
Encrypted:	false
SSDEEP:	384:i4sSUSsK/Py54Iu67VMam4AX10KIUt0kYcT/EDYZGSPeyc8cHIlkLi7FIYihZM09:izNK/G4IfVswkYLy5L7yYihrK/Y/+mT
MD5:	CE66CBCDA6D3B5047691C4AFF63CFE79
SHA1:	358E3A2284798BE1C537756A41721B61643D2BEE
SHA-256:	B8551ECBE96BB718BAA56E053589A7F16561BFDAB86575441EC5FBE528B32B8C
SHA-512:	7BC26EDD1C018553B163B75250B5862D26B607C26BDBFB6934F0AC5CE20B04D1956EEAF3915CBCE2129CD992ECA6E1B1C311991427D485CB43969A05431270E4
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...r.C..........." ..0..J..........~h... ........... ..............................wt....`.................................h..O....................R..............g..8............................................ ............... ..H............text....H... ...J.................. ..`.rsrc................L..............@..@.reloc...............P..............@..B................^h......H........1...5............................................................{...."..}......{...."..}......{...."..}......{...."..}....&..(........0...........s.......o.....+X..(.........(....o....o....&..(.........,!..r...po....&...(....o....o....&..r...po....&...(....-...........o ......o....o!.....+..............et.......0...........s"...%r...p.o#....%r...pr#..po#....%r+..prA..po#....%r]..p.($...o%...o#....%ro..p.($...o&............o....o'...o#....%r...p.($...o(....

C:\Program Files\FastestVPN\VPN.RAS.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	41128
Entropy (8bit):	6.4006875255426365
Encrypted:	false
SSDEEP:	768:dQq+jQ+JutCjyVmF8Wq8sBP3/7lpKaDBuz3bzrzlJBOKipq8pdwYv4qzsYiCtVK9:gVutFQF873t3/77KaDBuz3bzrBJBOKig
MD5:	FDF4712500755002CD0FFD2F7BEA8C2A
SHA1:	372F4D6F2F19A5DF96FCDEF566AE4761F7AFF2B5
SHA-256:	D61A675E7D11A6DDF12E4CEBCABFD7BAAA24B86AD7B751BE19788E7A8A5ABE39
SHA-512:	6484349215D1347FB3D77E6598AF740045AC416EE06370B8D89E91ECBA930E5AFFCE6F4840CE4ECD2214960E1884CCBE49710E5B5C1FEBE0C96F88A099AE2E4E
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....z:..........." ..0..n..........&.... ........... ....................................`....................................O.......h............v.............@...8............................................ ............... ..H............text...,m... ...n.................. ..`.rsrc...h............p..............@..@.reloc...............t..............@..B........................H........6..PU............................................................{...."..}......{...."..}......~....}......s....}.....(........(.............s...}........0..................,5...(A.....(.........,..~.....(.....s....o.......8..............0....B+......8..... . ...G+.. . ..;....8....~.....(.....s....o.....8....~.....(.....s....o.....+s.o.....~.....(....s....o......(....o ...r...p(!.......,...(.......{.....{....o"....(6...&+...(......s#...(.....+.+....0..F.......

C:\Program Files\FastestVPN\VPN.WireGuard.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	20136
Entropy (8bit):	6.723147332362829
Encrypted:	false
SSDEEP:	384:BaXxdsvBO/dITrZ+VK6G6IYi+PVl0FP27NBY3Yuv+t+QV:BJZl6GHYiGIK/Y/+tB
MD5:	14A266CFF3BC7795C208096E24D4791D
SHA1:	D55A976C562A309B4EEB860E711324A22357470E
SHA-256:	2C2E075009E736927EBC468CDFB7FF273F73670DF87A057C7B98D18A17CA945D
SHA-512:	E4A82644052C82F3CFEBAFFF15DEF713F3883F3E32043FAFB607CEE008498329C2E5A5712B0FEE670D68C9CEE127EC70FEC88977B25AF838B5977595268CD252
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...W/%..........." ..0.............^;... ...@....... ..............................}.....`..................................;..O....@...............$......`......l:..8............................................ ............... ..H............text...d.... ...................... ..`.rsrc........@......................@..@.reloc.......`......."..............@..B................>;......H........$..............................................................F.(....r...p(......{...."..}......0...........s......r...po....&.r-..p.(....o....(....o....&.rI..p.(....o....r_..p(....o....&.rg..p.(....o....(....o....&.(......,...ru..po....&..r...po....&.r...po....&.r...p.(....o....(....o....&.r...po....&.r...p.(....o....r...p(....o....&.(....o.....o....( ......r...p.(....o!...r...p(....r...p.(....o....r...p(....("...&..r?..prK..p.(.........(#...("...&*..r?..pr...

C:\Program Files\FastestVPN\VPN.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	18088
Entropy (8bit):	6.784018634948529
Encrypted:	false
SSDEEP:	384:4iqjQN+Pw2X6VUYNVYuKAiIYiUOX0FP27NBY3Yuv+WO:fqjQ8f5uKAvYidgK/Y/+X
MD5:	CD6CB12E677F6C45BBFE57DED6C90567
SHA1:	C13525F597974BA46B4B2A71F270B1056332F77B
SHA-256:	FA0E1B932B5548F39795B9C24106B48D6221600EA7679D6A1D1DEEED1C8D7D8C
SHA-512:	6D9DC73035F3C053281C9347131C8EF232797507F28271B60428FCA4A82CC43689BF1FA3E6DCE46AE92BC3C0E924745F81E315D2E4D4BD2F5D7991DC78A58FBD
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...X4y..........." ..0.............n3... ...@....... ....................................`..................................3..O....@..H...................`.......2..8............................................ ............... ..H............text...t.... ...................... ..`.rsrc...H....@......................@..@.reloc.......`......................@..B................N3......H........#................................................................{...."..}......{...."..}......{...."..}......(........%-.&r...ps....z(.......(......0..................,..rM..ps....z.(.........,...(....o.......(.......(.....s....o.........(....(......(....o......(....o........&..(.....r...ps....o..................tu.......0..B..........(....%-.&+.o.......&..(.....(....%-.&.+.(......s....o..........................0..B..........(....%-.&+.o ......*&..(.....

C:\Program Files\FastestVPN\WpfAnimatedGif.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	53416
Entropy (8bit):	6.326182355914875
Encrypted:	false
SSDEEP:	768:x0Gl7W1UiZTo1ooEqTh0sq/s/MnBOyvUPrYZbkchJYi/S8K/Y/+A:6qQpZTsooEah0sqU/by4UZzhJ7K8K/S
MD5:	C4BC370961A9E628E64B8FF4586D4DA6
SHA1:	B391F6A1A54B693F14BA7E8CD58DD8976CDDC992
SHA-256:	097B7F6F9ED8B63F0E725DE28D6842F6AC93D8105E441C7498385FAAD243A8C1
SHA-512:	169FD48C453BC95D33137BDAA22225B483CF9BF73CBCE9AFB5B6BF63B62300CC98A968F1D825348CDB8C786232B66D62247659FD809B6B0D7BCBF26C7B4519A4
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L................." ..0.................. ........... ....................................@.................................J...O.......$..........................h...T............................................ ............... ..H............text........ ...................... ..`.rsrc...$...........................@..@.reloc..............................@..B................~.......H........H..Hq...........................................................{......{....V.(......}......}.......0..A........u........4.,/(.....{.....{....o....,.(.....{.....{....o....... ...' )UU.Z(.....{....o....X )UU.Z(.....{....o....X...0..b........r...p......%..{.......%q.........-.&.+.......o ....%..{.......%q.........-.&.+.......o ....(!......0..2..........(....~.......o"...-.~.....s#...%.o$.....o%...&...0..A..........(....~.......o"...,)..o&..., .o'...-.~.....o(

C:\Program Files\FastestVPN\app-icon.ico (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp
File Type:	MS Windows icon resource - 3 icons, 16x16, 32 bits/pixel, 32x32, 32 bits/pixel
Category:	dropped
Size (bytes):	15086
Entropy (8bit):	3.1108966039740653
Encrypted:	false
SSDEEP:	96:FajQ4xW97nzsbzW+0eTODzfHvt0K/UrPdlMoi5U:FTd7nzsbyyqvt1/URiby
MD5:	BC1059DA39659B80A09C994AE6DB5DB7
SHA1:	D7E9D74133C98F897B94C42F09B93F10E3274EDB
SHA-256:	9543C96124919AE5B672FD7C23CCF5946A37FBB83A174112A33DA9FF37449B43
SHA-512:	F88CD2EC86E52EF31C471E580A9733D7DAAA7E3062C7DBCAAF9E50308934A4B679B364A4C1372D9021D9F5A504D5C310B8F631799AFA3248878B4F55A6CB704B
Malicious:	false
Preview:	............ .h...6... .... .........00.... ..%..F...(....... ..... .....@...................................2..A!...........................................................3..#.... ..-...................................................................m....................................................`.............. ................................................... ..]...............G........................................................ ...!...&...,{..........................7...................!...!... ... ......U....................U...+.../...,...'.......................,..7....................4..7(...)...-...4...@...>...2...........N.........................M&..........0...7...Y...j...r...?..i............................(..M...............................................................`...!..}..............._................................................0..!"..............5.......................................................I......................................

C:\Program Files\FastestVPN\fix-dns-leak-32.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	25768
Entropy (8bit):	6.8288213942048985
Encrypted:	false
SSDEEP:	384:tNjMaZomdl7FUC9mhsCVoNycrjIg9J197j26QIYidYFl0FP27NBY3Yuv+tiV:tHhShzuD/Bpa65YiGFuK/Y/+tiV
MD5:	37E6E1D07988932C4360D74A34B27AE9
SHA1:	F53AE2462ECC565EFCC28D1C5BB2C285BF899798
SHA-256:	7E321840FA4F112D0F117D8F4E4DDCA274829693CD1C1189CE1061B6F67550FF
SHA-512:	EFB94F19A885D20BF602AFE84CDD4FE5E9CE89B3A5B7D0BD5273546A6B5D894AD6F1359545DC6B2EEDE06FCB06790286CB69EFB153F249D7D8EF0C677C5D1B3A
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......4.a.pi.Hpi.Hpi.H68.Hri.H68.H\|i.H68.Hri.H68.Hti.H...Hqi.H...Hyi.Hpi.HFi.H};.Hsi.H};.Hqi.H};.Hqi.H};.Hqi.HRichpi.H........PE..L....q.Z...........!.................$.......0...............................p............@..........................7......D:.......P...............:...*...`..x...................................p4..@............0...............................text............................... ..`.rdata.......0......."..............@..@.data...\....@.......2..............@....rsrc........P.......4..............@..@.reloc..x....`.......6..............@..B................................................................................................................................................................................................................................................................................................................

C:\Program Files\FastestVPN\iphelperclose.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	116872
Entropy (8bit):	6.726218253535254
Encrypted:	false
SSDEEP:	3072:8tw0r3S8FpUCSBCLiXdb0NphY3kWlon6ZhPn8agN6K/p:8mWi8FpCBCLybQakA/Pn8agNj/p
MD5:	B9F4D43230B7FB66B95AF05DC03B32DE
SHA1:	56F868C56FFF836CA61055499988F965DCA37D26
SHA-256:	A103634B16841E3A68DD4A6BCBDFC3A1651B8C9F1114D99BF01CA31297664E21
SHA-512:	50EB5DE7D0A1B5D7E1AC38209488635EF77733C2C78DC39D0D473904128DBFC67D4E3EC388D2C2D79645AFDF03FD1965386F6E6D21553C9A6DAB07A58549FD1E
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........V.n.7.=.7.=.7.=.S.<.7.=.S.<o7.=.S.<.7.=._.<.7.=._.<.7.=._.<.7.=.S.<.7.=.7.=.7.=._.<.7.=._.<.7.=._3=.7.=._.<.7.=Rich.7.=........................PE..L...q._]...........!................O........0............................................@.............................T.......<.......................................p...............................@............0...............................text............................... ..`.rdata..4g...0...h..................@..@.data...4...........................@....rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................................

C:\Program Files\FastestVPN\is-05ABD.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	16768
Entropy (8bit):	6.361391591273708
Encrypted:	false
SSDEEP:	192:LGLxTyHvc4ROgcxAdWXYWJeaPtWsI9A9GaHnhWgN7aJeWw0fnCsqnajt:LgGLROZAdWXYW8aPcyHRN7WEqn1lx
MD5:	DA04A75DDC22118ED24E0B53E474805A
SHA1:	2D68C648A6A6371B6046E6C3AF09128230E0AD32
SHA-256:	66409F670315AFE8610F17A4D3A1EE52D72B6A46C544CEC97544E8385F90AD74
SHA-512:	26AF01CA25E921465F477A0E1499EDC9E0AC26C23908E5E9B97D3AFD60F3308BFBF2C8CA89EA21878454CD88A1CDDD2F2F0172A6E1E87EF33C56CD7A8D16E9C8
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....jM^...........!................^2... ...@....@.. ...............................y....@..................................2..S....@...................#...`....................................................... ............... ..H............text...d.... ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B................@2......H........#..@...................P ......................................{.v.`)!.t..@.62C<.=...h....X..}.`v.r...g.e...yXa.dat.mwQ.XdJ...M..`..J...$\|.j.6W.U.3.r.A.h.....9Q..\|..,<g..gy..6V9o%..Gd.r.0...........q......0..............q.......0..............q.......0..................0......................0......................0............q.............0............q.............0..............0..................0..................0..................0..........

C:\Program Files\FastestVPN\is-0G40P.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp
File Type:	MS Windows icon resource - 3 icons, 16x16, 32 bits/pixel, 32x32, 32 bits/pixel
Category:	dropped
Size (bytes):	15086
Entropy (8bit):	3.1108966039740653
Encrypted:	false
SSDEEP:	96:FajQ4xW97nzsbzW+0eTODzfHvt0K/UrPdlMoi5U:FTd7nzsbyyqvt1/URiby
MD5:	BC1059DA39659B80A09C994AE6DB5DB7
SHA1:	D7E9D74133C98F897B94C42F09B93F10E3274EDB
SHA-256:	9543C96124919AE5B672FD7C23CCF5946A37FBB83A174112A33DA9FF37449B43
SHA-512:	F88CD2EC86E52EF31C471E580A9733D7DAAA7E3062C7DBCAAF9E50308934A4B679B364A4C1372D9021D9F5A504D5C310B8F631799AFA3248878B4F55A6CB704B
Malicious:	false
Preview:	............ .h...6... .... .........00.... ..%..F...(....... ..... .....@...................................2..A!...........................................................3..#.... ..-...................................................................m....................................................`.............. ................................................... ..]...............G........................................................ ...!...&...,{..........................7...................!...!... ... ......U....................U...+.../...,...'.......................,..7....................4..7(...)...-...4...@...>...2...........N.........................M&..........0...7...Y...j...r...?..i............................(..M...............................................................`...!..}..............._................................................0..!"..............5.......................................................I......................................

C:\Program Files\FastestVPN\is-1FT3O.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	143528
Entropy (8bit):	6.164743567434074
Encrypted:	false
SSDEEP:	1536:oxi8ae06y7Q0kSutmvEmFk0pBa/+h8k/6kY2F8xB0dhqABtx5yoG9Qd7n8K/m:Q0vDkSutmhFpYqtDqAhjMQdYK/m
MD5:	24DF113016A58EB1D14691CFE947C2C8
SHA1:	E32B2388C9BCB8BD3EEA1A87626B562A06F5E2F9
SHA-256:	4DE9980CF1D3B45FC14F69EA4DFF6F456389C5E817344D44D6FA7C1A3276AFB5
SHA-512:	10DD82391CF51885533A5F9F859D7E79A9016F6E6A24C0A04C9BE08EA4C5A951D73AF467EC89BAB191DAC4B37D51B0C0AB247A24CD05478AD6101A44E9FC0D48
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...U..\.........." ..0.............b.... ... ....... .......................`......q[....@.....................................O.... ..8...................@..........8............................................ ............... ..H............text...8.... ...................... ..`.rsrc...8.... ......................@..@.reloc.......@......................@..B................C.......H........,..L...........,.................................................((...>..}......}......{......{......{.....{....3..{.....{....()......0...........%.u....,..........(.....z.{....%-.&.+.o....{....(a.....(....zN........o+...s,....(....z.s-.....(....zF(U....(O...s.....(....z.(V...s.....(....z.s/....(....z.s0.....(....zN........o+...s1....(....zrr...p(\....c.M...(O...s2....(....zBr...p(Y...s2....(....z.s3....(....z.(X...s4....(!...z.(_...s4...*.(#...z

C:\Program Files\FastestVPN\is-1RGTV.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	75432
Entropy (8bit):	6.020201057914009
Encrypted:	false
SSDEEP:	1536:mjb2NmqeZsE64aEKbMsZG0EN3ovewf8KnWE7LJ/ZEBiUN7TK/P:mjbUmqWL3M/WkV2ZNHK/P
MD5:	8DC8D595216B1D7703575B77282F7147
SHA1:	5FBA510AB9D9677B5AF28757BFCFC3E6EE3228F5
SHA-256:	7A8833790323071279C55854F35A1A802BF5D5766CABCFA381889460F95D5864
SHA-512:	F1E79E49CF5F10C9BC88D2AAA078FABD772027360A8C9692334AC3BBCDFEEDD93C2C6234F4DE6C6B4AFBD443FD6315633FE8943229EE0CB8CA6A6F29C2AE97EE
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...e.Z..........." ..0.............".... ... ....... .......................`......E.....`.....................................O.... ......................@..........T............................................ ............... ..H............text...(.... ...................... ..`.rsrc........ ......................@..@.reloc.......@......................@..B........................H.......pG...................... .......................................6.......(.....~....F~J......o.......N........s....o...+..0............(........~......o2....0............(........~K.....o.....0..%.........(..........(........~L.......o........0..H.........(..........(........~M....o.............(....(.........{........o....2~$....o....2~#....o....2~H....oz...6~I.....o~...:~J......o....2~%....o....2~&....o....>.(.......o....*...0..N........,........s.....

C:\Program Files\FastestVPN\is-1SSK8.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	3070013
Entropy (8bit):	6.39701754184779
Encrypted:	false
SSDEEP:	49152:BdJYVM+9JtzZWnoS2VC23aun8+f5KuGP+VYNCWNtdH333t7:HJYVM+LtVt3P/KuGP+VYNCuf333V
MD5:	A2386053A831B1C65F9BB923F4F17A7B
SHA1:	530BC9411C100138963776A527966EA98D2D1FD9
SHA-256:	3AE0793AF74140734EC43A261FAD664E5871890F28F9CCC692B68B3D6E1A26E5
SHA-512:	2E149D81B13101F9C38EE67396A92527AE5BFD8761D8187BAB635C7736B316E31D9A246DC14D934F28EEE4076F9B3FA78751F912D9CFEB6A032470997382D76F
Malicious:	true
Preview:	MZP.....................@.......................InUn....................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L.....gf.......................................@..........................P/...........@......@...................P,.n.....,.j:....,.$....................................................p,.......................,......@,.(....................text............................. ..`.itext..$.......0................. ..`.data................*.............@....bss.....\|....+..........................idata..j:....,..<...f+.............@....didata.(....@,.......+.............@....edata..n....P,.......+.............@..@.tls....X....`,..........................rdata..]....p,.......+.............@..@.rsrc...$.....,.......+.............@..@.............`0......./.............@..@........................................................

C:\Program Files\FastestVPN\is-21P0F.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	41128
Entropy (8bit):	6.4006875255426365
Encrypted:	false
SSDEEP:	768:dQq+jQ+JutCjyVmF8Wq8sBP3/7lpKaDBuz3bzrzlJBOKipq8pdwYv4qzsYiCtVK9:gVutFQF873t3/77KaDBuz3bzrBJBOKig
MD5:	FDF4712500755002CD0FFD2F7BEA8C2A
SHA1:	372F4D6F2F19A5DF96FCDEF566AE4761F7AFF2B5
SHA-256:	D61A675E7D11A6DDF12E4CEBCABFD7BAAA24B86AD7B751BE19788E7A8A5ABE39
SHA-512:	6484349215D1347FB3D77E6598AF740045AC416EE06370B8D89E91ECBA930E5AFFCE6F4840CE4ECD2214960E1884CCBE49710E5B5C1FEBE0C96F88A099AE2E4E
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....z:..........." ..0..n..........&.... ........... ....................................`....................................O.......h............v.............@...8............................................ ............... ..H............text...,m... ...n.................. ..`.rsrc...h............p..............@..@.reloc...............t..............@..B........................H........6..PU............................................................{...."..}......{...."..}......~....}......s....}.....(........(.............s...}........0..................,5...(A.....(.........,..~.....(.....s....o.......8..............0....B+......8..... . ...G+.. . ..;....8....~.....(.....s....o.....8....~.....(.....s....o.....+s.o.....~.....(....s....o......(....o ...r...p(!.......,...(.......{.....{....o"....(6...&+...(......s#...(.....+.+....0..F.......

C:\Program Files\FastestVPN\is-2448N.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	29352
Entropy (8bit):	6.56368110636982
Encrypted:	false
SSDEEP:	768:vT6rilChUvVsYQTJMS6V4B6PYikK/Y/+V7:7qSsYOwP7kK/77
MD5:	1CFBF0CBA3C87653D9639ADA438C3291
SHA1:	07E36A34319EAD85857CC022E277B69EA132750B
SHA-256:	3525FCE82E2687D8EFAF992147B196881818856EA9EA851A8DC930751329A8DD
SHA-512:	E95FC978E889BD62E92975EFD8F39161B6E43FE97451068552E3A71635943F990E4E8697323794D75F77BB12F3DE4E2CFADB5B9D80EF90F1992C82298EBFD00B
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...t.i..........." ..0..@...........^... ...`....... ....................................`.................................:^..O....`...............H.............\|]..8............................................ ............... ..H............text....>... ...@.................. ..`.rsrc........`.......B..............@..@.reloc...............F..............@..B................n^......H........1...+............................................................{....:.(......}......0..)........u..........,.(.....{.....{....o......v .5Q' )UU.Z(.....{....o....X..0..:........r...p......%..{.......%q.........-.&.+.......o.....(......{....:.(......}........0..)........u..........,.(.....{.....{....o......v . .q )UU.Z(.....{....o....X..0..:........r-..p......%..{.......%q.........-.&.+.......o.....(......{......{....V.(......}......}.....0..A.......

C:\Program Files\FastestVPN\is-3LDP6.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	432
Entropy (8bit):	5.0141792226861375
Encrypted:	false
SSDEEP:	12:MMHdGzNFF7ap+5v5OXrRf/2//FicYo4xT:JduPF7NhOXrRH2/d9y
MD5:	8F6EB9E75E6A6F0C0D58FB697C10CEDF
SHA1:	6944935DFDC33E0C6DB26869BF25EDA85A2622D8
SHA-256:	E2B8677434501735FB0233ED0CC2FFEE5BF6FB4387C51DBCB2585A70E42E4F08
SHA-512:	A946252B2E3705EAE751A2672D4ADE1499ECEB28C48B4BE6150C4201EE20A7B9A4450C75E06B07F5DAA3528041A566931D988FBD0C2EA90240D61008895BA44A
Malicious:	false
Preview:	.<?xml version="1.0" encoding="utf-8"?>..<configuration>.. <runtime>.. <assemblyBinding xmlns="urn:schemas-microsoft-com:asm.v1">.. <dependentAssembly>.. <assemblyIdentity name="Newtonsoft.Json" publicKeyToken="30ad4fe6b2a6aeed" culture="neutral" />.. <bindingRedirect oldVersion="0.0.0.0-13.0.0.0" newVersion="13.0.0.0" />.. </dependentAssembly>.. </assemblyBinding>.. </runtime>..</configuration>

C:\Program Files\FastestVPN\is-446MI.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	117928
Entropy (8bit):	6.160360774488817
Encrypted:	false
SSDEEP:	3072:Hzne5lbC/VlCG2OWMMdWWbWbWw+Hfz+8lKbchOD07PQCFP1IYmDe/WAbBuhEK/a:HFO4WMMdWWbWbWw+Hfz+8lKbchOD07PP
MD5:	FDFDFE021B53B630939D27C6C90CB435
SHA1:	AA0987A6EA6987BB9930B9167EC31C249EF9D885
SHA-256:	D753A7EF62BABC2ADB5D1DBEB0BEBAA2B042CC01CC219726F32F761BBB0A711D
SHA-512:	1FD0C74D0ED3AC4DF26D3E95C0F133E8024D77D1FD06E0C76C630D6AAC7B81124AA1DCA7CFFAC43BC34252A057414F8C3F8EC63A805323B1EF892B5F6A277D3B
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....8............" ..0................. ........... ..............................U.....`.................................w...O......................................T............................................ ............... ..H............text....... ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................H.........................................................................{ .....{!...V.(".....} .....}!......0..A........u........4.,/(#....{ ....{ ...o$...,.(%....{!....{!...o&...... '.(k )UU.Z(#....{ ...o'...X )UU.Z(%....{!...o(...X...0..b........r...p......%..{ ......%q.........-.&.+.......o)....%..{!......%q.........-.&.+.......o)....(...>..su...%.}^......0...........(+...,.....(....o.....8t....o......-2.{,....{-.....g...%..".o.....(/...s0...sk....88....{,...r

C:\Program Files\FastestVPN\is-4EJAE.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	60584
Entropy (8bit):	6.4260026936119194
Encrypted:	false
SSDEEP:	768:D0YiwXHy9lkD6vudI9C3dt8dNbm+ESg34o556bYIDwpFGpphsA/FIDbaFLdtlxn+:DxJ8kM9CHJ6bY3zkXX8u4iNa7ogBK/o
MD5:	550D6E67BB1795B941E91840508BF7F6
SHA1:	46E22693BDC92F4E8DD8C4C5433D233438A271EF
SHA-256:	D4B4CEB77A3D429EE21412E5172AAC6E36C553E7D990137F212E5ADD6B9A9336
SHA-512:	1271BEC8A700AC925B9AC13FDB84FFCCFFA6A1589FA3F9FA1361282C47BB8985A7C8F0335EFDD422E2A708BF2DD46458AEF64B4E2A54B8488F8ED53750337A23
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L................." ..0.............r.... ........... ....................... ............`................................. ...O......................................8............................................ ............... ..H............text...x.... ...................... ..`.rsrc...............................@..@.reloc..............................@..B................T.......H.......T0..4.............................................................{...."..}......{...."..}......{...."..}......{...."..}......{...."..}......{...."..}....>.(....o4......>.(....o4......>.(....o2......>.(....o2......>.(....o2......v.(....-..(....,..(....+..+....{...."..}....6..s....}......0............(......,...(k.........0..4.......s......(....}......}......}......}.....\|......(...+.0..Y.........(....o....r...p(....(c....(f....(g.....(......,&.

C:\Program Files\FastestVPN\is-4QKGT.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	22184
Entropy (8bit):	6.685941492131545
Encrypted:	false
SSDEEP:	384:1hKpVrz0BH8aZqmgBTKDAATaYIYikfF0FP27NBY3Yuv+8N:1hKpVcB15KO7aBYimOK/Y/+g
MD5:	AAA9DA932D572F5B22CBEE1B4E479ED6
SHA1:	D708727DED1298610C2E3D72C8792F12FC60CFF2
SHA-256:	73B55714DB609A1712FD4FC420CE18441E41BB7E3E94D73B11AE28C68CCB1124
SHA-512:	40A8E2CB18FB2D68F0945B6FBF259FA9331327116A6D21A85AAE6AA12600F7FDD3737B5E84E0AE04C584442016882926D9201E16C25EB937838C8BAC24358779
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...z............." ..0.."...........A... ...`....... ...............................6....`..................................A..O....`..`............,..............@..T............................................ ............... ..H............text...."... ...".................. ..`.rsrc...`....`.......$..............@..@.reloc.............................@..B.................A......H........'.......................@.......................................(......0...............(....o........(....s.......0............(.......(....s....(....6r...p..(.....0.._.......s!.....s....}.....{....r...p.r'..p(....o.........."...s....(....%~....(....,..{....o....s....z..0..#.......(......-...(......3...(....s....z...(....%~....(....,.r=..p.r'..p(....s....z..0..#.......(......-..(....&..3..(....&s....z..0..7..........~....%-.&~..........s....%.....(.........

C:\Program Files\FastestVPN\is-50CK2.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	432
Entropy (8bit):	5.0141792226861375
Encrypted:	false
SSDEEP:	12:MMHdGzNFF7ap+5v5OXrRf/2//FicYo4xT:JduPF7NhOXrRH2/d9y
MD5:	8F6EB9E75E6A6F0C0D58FB697C10CEDF
SHA1:	6944935DFDC33E0C6DB26869BF25EDA85A2622D8
SHA-256:	E2B8677434501735FB0233ED0CC2FFEE5BF6FB4387C51DBCB2585A70E42E4F08
SHA-512:	A946252B2E3705EAE751A2672D4ADE1499ECEB28C48B4BE6150C4201EE20A7B9A4450C75E06B07F5DAA3528041A566931D988FBD0C2EA90240D61008895BA44A
Malicious:	false
Preview:	.<?xml version="1.0" encoding="utf-8"?>..<configuration>.. <runtime>.. <assemblyBinding xmlns="urn:schemas-microsoft-com:asm.v1">.. <dependentAssembly>.. <assemblyIdentity name="Newtonsoft.Json" publicKeyToken="30ad4fe6b2a6aeed" culture="neutral" />.. <bindingRedirect oldVersion="0.0.0.0-13.0.0.0" newVersion="13.0.0.0" />.. </dependentAssembly>.. </assemblyBinding>.. </runtime>..</configuration>

C:\Program Files\FastestVPN\is-57IGR.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	20136
Entropy (8bit):	6.723147332362829
Encrypted:	false
SSDEEP:	384:BaXxdsvBO/dITrZ+VK6G6IYi+PVl0FP27NBY3Yuv+t+QV:BJZl6GHYiGIK/Y/+tB
MD5:	14A266CFF3BC7795C208096E24D4791D
SHA1:	D55A976C562A309B4EEB860E711324A22357470E
SHA-256:	2C2E075009E736927EBC468CDFB7FF273F73670DF87A057C7B98D18A17CA945D
SHA-512:	E4A82644052C82F3CFEBAFFF15DEF713F3883F3E32043FAFB607CEE008498329C2E5A5712B0FEE670D68C9CEE127EC70FEC88977B25AF838B5977595268CD252
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...W/%..........." ..0.............^;... ...@....... ..............................}.....`..................................;..O....@...............$......`......l:..8............................................ ............... ..H............text...d.... ...................... ..`.rsrc........@......................@..@.reloc.......`......."..............@..B................>;......H........$..............................................................F.(....r...p(......{...."..}......0...........s......r...po....&.r-..p.(....o....(....o....&.rI..p.(....o....r_..p(....o....&.rg..p.(....o....(....o....&.(......,...ru..po....&..r...po....&.r...po....&.r...p.(....o....(....o....&.r...po....&.r...p.(....o....r...p(....o....&.(....o.....o....( ......r...p.(....o!...r...p(....r...p.(....o....r...p(....("...&..r?..prK..p.(.........(#...("...&*..r?..pr...

C:\Program Files\FastestVPN\is-59D46.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	19624
Entropy (8bit):	6.761472837087098
Encrypted:	false
SSDEEP:	384:pwG3NNuGs7lkviba8FLdwIYieB0FP27NBY3Yuv+4pdS:F+V7PpFLdZYixK/Y/+4S
MD5:	12A69C58D97C26D0132D493111E42345
SHA1:	0DCC8570C7D76B660746A0F657607864F8764AD4
SHA-256:	E6682B67F0C489BEB53C93C399D46CEAEBDD7096AD7DB984BF99DCC68E476F4C
SHA-512:	3335371222BB282C55F1309432CD776CD146EFA9B6D17BF23997EFA6E3A741512FD95B9382EB719F400C6A70BD13E6A445A6011716B4C7637CF1083C8D669BE6
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L................." ..0..............8... ...@....... ...............................P....`.................................j8..O....@..............."......`.......7..8............................................ ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`....... ..............@..B.................8......H.......L'..`............................................................0..?.........(....}.......}.......}.......}......\|......(...+..\|....(......0..7.........(....}.......}.......}......\|......(...+..\|....(......0../.........(....}.......}......\|......(...+..\|....(......0..7.........(....}.......}.......}......\|......(...+..\|....(....6..(...+(......(......(......{..........%..#...(.....%..!...(.....(.....(....*.0..e........{......E....8............(....o ......(!...

C:\Program Files\FastestVPN\is-5EDG5.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1106
Entropy (8bit):	5.038231865445437
Encrypted:	false
SSDEEP:	24:2dV8F7H3p2/+XBPpZp2/+XBPqp2/+XBw1irkV:cVg7C+XBR4+XBn+XBvrE
MD5:	75E66AB540561A0C7D4160271F518243
SHA1:	AD6501E407D216744B6C3DE76D7664D9581EBAD2
SHA-256:	091AFFF3BB63024B5A7B14EA30306B6753858FD1A33FC8C98E3B5E65FE92FBE7
SHA-512:	FCB55C0FDBB984B06AFF2FAFCAEA2596C175AA5A07D2F1A401305D3441338AA266A53D2DE7A7577684884A2E12CE3EE430B2E1D0210684A7EEFAF9EAA0DE115F
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>..<configuration>.... <appSettings>.. <add key="DownloadLocation" value=""/>.. </appSettings>.... <runtime>.... <assemblyBinding xmlns="urn:schemas-microsoft-com:asm.v1">.... <dependentAssembly>.... <assemblyIdentity name="System.Runtime" publicKeyToken="b03f5f7f11d50a3a" culture="neutral"/>.... <bindingRedirect oldVersion="0.0.0.0-4.0.0.0" newVersion="4.0.0.0"/>.... </dependentAssembly>.... <dependentAssembly>.... <assemblyIdentity name="System.Threading.Tasks" publicKeyToken="b03f5f7f11d50a3a" culture="neutral"/>.... <bindingRedirect oldVersion="0.0.0.0-4.0.0.0" newVersion="4.0.0.0"/>.... </dependentAssembly>.... <dependentAssembly>.... <assemblyIdentity name="System.Net.Http" publicKeyToken="b03f5f7f11d50a3a" culture="neutral"/>.... <bindingRedirect oldVersion="0.0.0.0-4.0.0.0" newVersion="4.0.0.0"/>.... </dependentAssembly>.... </assemblyBinding>.... </runtime>

C:\Program Files\FastestVPN\is-5IUQF.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	48256
Entropy (8bit):	6.234996524588368
Encrypted:	false
SSDEEP:	768:AMWC5N7mKWPKz4VJ4e0jeuTGlBh0JzqPPxofk3l9z2I:Y67hCfV8j3TGlB+JsafkHzP
MD5:	37EB7CCE6E282D3572D64C880E1AC3C8
SHA1:	9A2952589A19D650932E7C633577EB9AFC04F959
SHA-256:	039155F155C5D14F5B73F4EE2CD1FBD9290F391B88A1D2A0BA815569205EDB74
SHA-512:	E3C2EF1CC52E3AA5BD77B74DEC93A4FC9E908DF823426F13CA304265D41605DE51970CC8C7E18C2E76319D3225707B2EA2D8613402A25C4FBD3951E70FCFD521
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....v..........." ..0.................. ........... ....................................`.....................................O........................(..............T............................................ ............... ..H............text........ ...................... ..`.rsrc...............................@..@.reloc..............................@..B.......................H........=..da..........0.................................................(......(....^.(.......>...%...}....:.(......}....:.(......}....:.(......}....:.(......}....*.-..(......s....z.~.......0..........(....,....(.....o.......&......................0...........(.......(....-..,....(....,.r...p......%...%...(......( ....(....,.r...p......%...%...%...(.......(!....(....,!r...p......%...%...%...%...(........(".....,&(....,..r...pr...p.(....(#.....($.....(.

C:\Program Files\FastestVPN\is-5L7N2.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	19112
Entropy (8bit):	6.821071301483957
Encrypted:	false
SSDEEP:	384:LVVVVVwhr+vtlzIYilpm0FP27NBY3Yuv+Z:LVVVVVwhKvtl8YijnK/Y/+Z
MD5:	64E2269D156CA2AA5704E2E0908506F9
SHA1:	0F7D6EECE52D8A9A91E389736BE1092739AA3014
SHA-256:	B012720952E3FE9CB303E9EDB4314F924CB388D9C24FB63A968A3479113B665D
SHA-512:	C845E7EB96ED29C564C28D42F07F5EB81C27568F0F89C343533384BF8E704B99566EA073E46259D9F3740A7A3D41AAB5BFA78AEAB05697100B3A179F5C1EDFB6
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....c............" ..0..............6... ...@....... ..............................hj....`.................................16..O....@............... ......`......t5..8............................................ ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B................e6......H.......("..L............................................................~.............s......s......0..B.......(....,.s....(....(....(....(....(....(.....(....(....(.....(......(...+F.(...+(...+(...+F.(...+(...+(...+F.(...+(...+(...+.0..f........(...+(...+(...+(...+(...+(...+(...+(...+(...+(...+(...+(...+(...+(...+(...+(...+(...+(...+(...+(...+..(...+...0...........-......8.......%o.....%o.....o........E........ ...>...+X..(....-...(....+....(......+:..(....-...

C:\Program Files\FastestVPN\is-5TM82.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	26752
Entropy (8bit):	6.512503595653532
Encrypted:	false
SSDEEP:	768:DulwnBhYlTVv2wK5idcgF4of1n6K9zUYJ:ywHYFtKYdcg/f1nXzUYJ
MD5:	970B6E6478AE3AB699F277D77DE0CD19
SHA1:	5475CB28998D419B4714343FFA9511FF46322AC2
SHA-256:	5DC372A10F345B1F00EC6A8FA1A2CE569F7E5D63E4F1F8631BE367E46BFA34F4
SHA-512:	F3AD2088C5D3FCB770C6D8212650EED95507E107A34F9468CA9DB99DEFD8838443A95E0B59A5A6CB65A18EBBC529110C5348513A321B44223F537096C6D7D6E0
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...$:............" ..0..4...........S... ...`....... ....................................`..................................S..O....`...............@...(...........R..T............................................ ............... ..H............text....3... ...4.................. ..`.rsrc........`.......6..............@..@.reloc...............>..............@..B.................S......H........'..P..................,R........................................(......(....^.(.......1...%...}....:.(......}....:.(......}....:.(......}....:.(......}......(......(......(......(....:.(......}......{....:.(......}......{....:.(......}......{......(....:.(......}......{....^.(.......2...%...}....:.(......}......{....z.(......}.......2...%...}....V.(......}......}......{......{....:.(......}......{......{...."..}......{...."..}......{

C:\Program Files\FastestVPN\is-98KKE.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	149896
Entropy (8bit):	6.136390335470081
Encrypted:	false
SSDEEP:	1536:PcRKLBm0ELV6Ra+eKBL24YzRk2XDuzEdnp+4WSspmfxPapkwN5RGV5xz/OEYW58R:qI0KRHeKBszRk2aApjsp7pBtZGh9
MD5:	70B1C15FDBBFB88F91965DC7BBC5527F
SHA1:	A473571DAC42819933CD7EF0C604F1EA0614D2F3
SHA-256:	109878A7A6F6BD13637B7E3A2EBC22D37423716ECD4E954CC09BACB84B92F62B
SHA-512:	C496EE2DDF6C401E9E48FB6D739C44200EBFE36B516E7608CECB3E32FEB620CE1531CC5DE26B1A4CD033C65FD002D6B6315B746CFB8B4D047A2954F6F33CA0A4
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...5A............" ..0..............;... ...@....... ..............................Ri....`.................................N;..O....@...............&...#...`......X:..T............................................ ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`.......$..............@..B.................;......H.......h....Y..........H'.......9........................................(...+.~.....~.....~......%-.&(......%-.&~ .......0..........(!......o"......(7..........................0..........(!......o...+...(...+........................~$...%-.&~%.....&...s'...%.$....(...+.0..D.............,:......o(.....,......o(....3.........o)....(....+.....(...+..0..9.......s......}+.....},.....}-................s/... ....(B...&....0..$........,...r...p......%.....o~......o0...*

C:\Program Files\FastestVPN\is-9ODK7.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	432
Entropy (8bit):	5.0141792226861375
Encrypted:	false
SSDEEP:	12:MMHdGzNFF7ap+5v5OXrRf/2//FicYo4xT:JduPF7NhOXrRH2/d9y
MD5:	8F6EB9E75E6A6F0C0D58FB697C10CEDF
SHA1:	6944935DFDC33E0C6DB26869BF25EDA85A2622D8
SHA-256:	E2B8677434501735FB0233ED0CC2FFEE5BF6FB4387C51DBCB2585A70E42E4F08
SHA-512:	A946252B2E3705EAE751A2672D4ADE1499ECEB28C48B4BE6150C4201EE20A7B9A4450C75E06B07F5DAA3528041A566931D988FBD0C2EA90240D61008895BA44A
Malicious:	false
Preview:	.<?xml version="1.0" encoding="utf-8"?>..<configuration>.. <runtime>.. <assemblyBinding xmlns="urn:schemas-microsoft-com:asm.v1">.. <dependentAssembly>.. <assemblyIdentity name="Newtonsoft.Json" publicKeyToken="30ad4fe6b2a6aeed" culture="neutral" />.. <bindingRedirect oldVersion="0.0.0.0-13.0.0.0" newVersion="13.0.0.0" />.. </dependentAssembly>.. </assemblyBinding>.. </runtime>..</configuration>

C:\Program Files\FastestVPN\is-AHK7Q.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	88192
Entropy (8bit):	6.25584016939133
Encrypted:	false
SSDEEP:	1536:0kUuBN7CjSkp9oa++t1BVryVKXDORdDeCNia6Lj4Fu/qSGnJdo0Wzs:ju/t/VryVKXeDezVLj4F/JdWQ
MD5:	4186A905DC180A0CC2110403727BD792
SHA1:	E0563D20CA7E95688A60F4BFC1AB0127EAE1F651
SHA-256:	40DCB80A87A762745D0A15294B5CA7783A9EAD1D93AD352D25B5EDAF4994651E
SHA-512:	1C3459232B41C531F01BCCE54E46799F2FB3FCD6C87D7F908C633ABCC718D9726D98E65F964B1A870D416A38F545971779054FE65F7C1299905FC7DC24FA2DEC
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L................." ..0..&..........>E... ...`....... ....................................`..................................D..O....`...............0...(...........C..T............................................ ............... ..H............text...D%... ...&.................. ..`.rsrc........`.......(..............@..@.reloc..............................@..B.................E......H........l..@...........02..0...`C........................................(......(....^.(.......k...%...}....:.(......}....:.(......}....:.(......}....:.(......}.....~......0..........(....,....(.....o ......&......................0...........(.......(!...-..,....(....,.r...p......%...%...(".....(#....(....,.r...p......%...%...%...("......($....(....,!r...p......%...%...%...%...(".......(%.....,&(....,..r...pr...p.("...(&.....('....*.(....,.r...p......%...

C:\Program Files\FastestVPN\is-BJ8NM.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	1112
Entropy (8bit):	5.030466366630491
Encrypted:	false
SSDEEP:	24:JdArztW1oF7Nv+IcvH2/+GVTcvH2/+GVhOXrRH2/d9y:3Arzcq7h+Iag+GMg+G27Rgdw
MD5:	B94AE93769D64791440B3C36CC82AC69
SHA1:	E4AAAD9A0FB51051C8B25F768BC1563543F132C0
SHA-256:	432BFD182828A531147812566CB3439702A243BB7A4C45CC816192F9CB91D4A5
SHA-512:	AD978C59980C0194357D5070D53EA77C334493D14593C141B9DBEEF835FC688FD90C99236D687F50860FA7F4FD4125650E432A61EDF7917C77E4EE4E5E3D4E66
Malicious:	false
Preview:	.<?xml version="1.0" encoding="utf-8"?>..<configuration>.. <startup> .. <supportedRuntime version="v4.0" sku=".NETFramework,Version=v4.8" />.. </startup>.. <runtime>.. <legacyCorruptedStateExceptionsPolicy enabled="true" />.. <assemblyBinding xmlns="urn:schemas-microsoft-com:asm.v1">.. <dependentAssembly>.. <assemblyIdentity name="Microsoft.Expression.Interactions" publicKeyToken="31bf3856ad364e35" culture="neutral" />.. <bindingRedirect oldVersion="0.0.0.0-4.5.0.0" newVersion="4.5.0.0" />.. </dependentAssembly>.. <dependentAssembly>.. <assemblyIdentity name="System.Windows.Interactivity" publicKeyToken="31bf3856ad364e35" culture="neutral" />.. <bindingRedirect oldVersion="0.0.0.0-4.5.0.0" newVersion="4.5.0.0" />.. </dependentAssembly>.. <dependentAssembly>.. <assemblyIdentity name="Newtonsoft.Json" publicKeyToken="30ad4fe6b2a6aeed" culture="neutral" />.. <bindingRedirect oldVersion="0.0.0.0-13.0.0

C:\Program Files\FastestVPN\is-CKMSD.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	1192
Entropy (8bit):	5.059106104983516
Encrypted:	false
SSDEEP:	24:JduPF7NV+TkH2/17zVVXBOH2/17zVQ7uH2/XVUrPH2/+C9y:327Gwg1BOg1SagXSg+Cw
MD5:	66373624F8B60F41B8FEC0E61779C0AC
SHA1:	0D3BE3C009F0A2260F89C3FBC9FFEBA0061C17F2
SHA-256:	FE0A5830D875B8BD0864BF4F85705D4F2E3D7A575C07B2B5A18041558DBA1386
SHA-512:	74F084B2697F936122E371042FEF5740BF205914B3FA276F8F7C72561680BF2C39A7DD2970BDEDF36AACC20970CD9552A719211F30090881E498815D91C6CDD0
Malicious:	false
Preview:	.<?xml version="1.0" encoding="utf-8"?>..<configuration>.. <runtime>.. <assemblyBinding xmlns="urn:schemas-microsoft-com:asm.v1">.. <dependentAssembly>.. <assemblyIdentity name="SQLitePCLRaw.core" publicKeyToken="1488e028ca7ab535" culture="neutral" />.. <bindingRedirect oldVersion="0.0.0.0-2.1.6.2060" newVersion="2.1.6.2060" />.. </dependentAssembly>.. <dependentAssembly>.. <assemblyIdentity name="SQLitePCLRaw.batteries_v2" publicKeyToken="8226ea5df37bcae9" culture="neutral" />.. <bindingRedirect oldVersion="0.0.0.0-2.1.6.2060" newVersion="2.1.6.2060" />.. </dependentAssembly>.. <dependentAssembly>.. <assemblyIdentity name="System.Runtime.CompilerServices.Unsafe" publicKeyToken="b03f5f7f11d50a3a" culture="neutral" />.. <bindingRedirect oldVersion="0.0.0.0-6.0.0.0" newVersion="6.0.0.0" />.. </dependentAssembly>.. <dependentAssembly>.. <assemblyIdentity name="System.Memory" publicKeyToken="cc7b13ffc

C:\Program Files\FastestVPN\is-DTS4U.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	53416
Entropy (8bit):	6.326182355914875
Encrypted:	false
SSDEEP:	768:x0Gl7W1UiZTo1ooEqTh0sq/s/MnBOyvUPrYZbkchJYi/S8K/Y/+A:6qQpZTsooEah0sqU/by4UZzhJ7K8K/S
MD5:	C4BC370961A9E628E64B8FF4586D4DA6
SHA1:	B391F6A1A54B693F14BA7E8CD58DD8976CDDC992
SHA-256:	097B7F6F9ED8B63F0E725DE28D6842F6AC93D8105E441C7498385FAAD243A8C1
SHA-512:	169FD48C453BC95D33137BDAA22225B483CF9BF73CBCE9AFB5B6BF63B62300CC98A968F1D825348CDB8C786232B66D62247659FD809B6B0D7BCBF26C7B4519A4
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L................." ..0.................. ........... ....................................@.................................J...O.......$..........................h...T............................................ ............... ..H............text........ ...................... ..`.rsrc...$...........................@..@.reloc..............................@..B................~.......H........H..Hq...........................................................{......{....V.(......}......}.......0..A........u........4.,/(.....{.....{....o....,.(.....{.....{....o....... ...' )UU.Z(.....{....o....X )UU.Z(.....{....o....X...0..b........r...p......%..{.......%q.........-.&.+.......o ....%..{.......%q.........-.&.+.......o ....(!......0..2..........(....~.......o"...-.~.....s#...%.o$.....o%...&...0..A..........(....~.......o"...,)..o&..., .o'...-.~.....o(

C:\Program Files\FastestVPN\is-EQOPF.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	25984
Entropy (8bit):	6.291520154015514
Encrypted:	false
SSDEEP:	384:1R973o62/KqcAnb05J3w0I5eUGef8s72XBWdvVW2JW8aJcyHRN7WEimpplex:1RZ4nNxnYTb6Blha
MD5:	E1E9D7D46E5CD9525C5927DC98D9ECC7
SHA1:	2242627282F9E07E37B274EA36FAC2D3CD9C9110
SHA-256:	4F81FFD0DC7204DB75AFC35EA4291769B07C440592F28894260EEA76626A23C6
SHA-512:	DA7AB8C0100E7D074F0E680B28D241940733860DFBDC5B8C78428B76E807F27E44D1C5EC95EE80C0B5098E8C5D5DA4D48BCE86800164F9734A05035220C3FF11
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....jM^.........." ..0..8...........V... ...`....... ....................................@..................................V..O....`...............B...#..........PU............................................... ............... ..H............text....6... ...8.................. ..`.rsrc........`.......:..............@..@.reloc...............@..............@..B.................V......H........0...$...................T........................................(......(....z..(....z2.(....s....2.(....s....:........o.....~....~.-..(......}......}......}....~.-..(......}......}......}....Z..}......}......}....J.{....%-.&.o....^.u....,........(.....~.{.....{....3..{.....{.......&...(....2...(...........0..'........{......,..u....%-.&..(...+(....(....n.{....,..(....s.....q......0..a.........{....o0.....,;..{....o2...(......;...3.~.......s......

C:\Program Files\FastestVPN\is-F6R4E.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	30888
Entropy (8bit):	6.550270680442998
Encrypted:	false
SSDEEP:	384:RzfFYXOvijvSGpUprWHEvgr0KnB4C7GrhIYiRSk0FP27NBY3Yuv+U:RxyOg9bxr9qaGKYi8K/Y/+U
MD5:	96D7E9527C5D8BDBA798F72B5FD9B94A
SHA1:	C9CE9813C74493084D6E3DDA37C35C8822CA381F
SHA-256:	6942DC9FDBB229D066BA3E1844883B9DA3EAE21F7035FFF2674C3F19C6331B55
SHA-512:	BE88433F513C4D9F58BDDFED57427DEC12BA0490E2D7C79176144732FBB7969956FA55B03E462C50EA3508389B3C29BC5A559F4B6002C6022C93D059C65B5C44
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...f6............" ..0..F...........e... ........... ....................................`..................................e..O....................N..............d..8............................................ ............... ..H............text....E... ...F.................. ..`.rsrc................H..............@..@.reloc...............L..............@..B................be......H.......\4..$0............................................................(......{...."..}......{...."..}....V.(......(......(.....0..7.........(....}.......}.......}......\|......(...+..\|....(......{...."..}......{...."..}......{...."..}......{...."..}......(......(......(......(.......(.....0..?.........(....}3......}4......}5......}2.....\|3.....(...+..\|3...(......0..7.........(....}#......}$......}".....\|#.....(...+..\|#...(....*..0..?.........(....}.......}

C:\Program Files\FastestVPN\is-FCV4A.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	25768
Entropy (8bit):	6.623350319992477
Encrypted:	false
SSDEEP:	384:21Vrp7wobZBVBhB3GmLiVWgktWe9JHEDIYirwt0FP27NBY3Yuv+1WyT1g:21VV7TbXX72MtWQJHEsYi/K/Y/+1Wy5g
MD5:	D92BF2C8E0A192E18B1F0B24CCB75171
SHA1:	2A6343C3409172E1D426B763151E0CBA3B35E473
SHA-256:	BEED084878EACA4A745A53CC21FAAD1A76F4F82C955BB507496B5B9F23032F1C
SHA-512:	71AD4963BCEBE516FD9EE526F2DD1ECB13F10E1424D0D3CED08A19A38D902DA562C9B1D0E308C4B898E30187773F040CF6A437210EFEF52B957623F798E59459
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...R.s..........." ..0..2..........:Q... ...`....... ..............................I/....`..................................P..O....`...............:.............,P..8............................................ ............... ..H............text...@1... ...2.................. ..`.rsrc........`.......4..............@..@.reloc...............8..............@..B.................Q......H.......`(...'...........................................................0..M........r...p}.....r...p}.....(......{..... (....(....(......{..... (....(....(....^~....-.s.........~......{...."..}......{...."..}......0..8........(........(.....(.....o....r...p(....o.......&..r...p.........--.......0..(.......(.....o........(.....(.......&..r...p..................0..X........o.....[.&......+9...Z.o.... ....(........Z.X.o.... ....(......b`.......X...o.....[2...0..V...

C:\Program Files\FastestVPN\is-FRGRO.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	2059432
Entropy (8bit):	7.651137710710665
Encrypted:	false
SSDEEP:	24576:+3zNmj7tPN/PPINv2lYnvqfI1L3ciKKqjnTVlKJ+hgyiTebWmDXQHMkgXvYOdSYB:84vtPNvCv2Qqfobuvq+hqCTDgHMT
MD5:	01CF6EF766C41BB2C99A2CCCDECC69C1
SHA1:	8DD5EB983C1C8F2E3A2538E50295644BB778A69E
SHA-256:	9A9B95CA40D32FA23A615A122FA3AAF7AEB32FBEF2850D729F77C1169FFC0452
SHA-512:	9EE4D4D7852555F67CF0C9B372DCA87EC0727AB0A6FC5EAE309CF6BF5467FC75C6868A5E528D34AB605CDC736D30684D35A1451D4ABE3B99BA37D276474AC940
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....G............"...0......D........... ... ....@.. ...............................P ...`.................................^...O.... ...A...........B.................8............................................ ............... ..H............text........ ...................... ..`.rsrc....A... ...B..................@..@.reloc...............@..............@..B........................H.......DD..T`......-....... v...........................................0..O.......s....%.o....%.o ...%.o!...%..o".....o#........($........(%..._,...o&...(.......(......{...."..}......{...."..}......{...."..}......{...."..}.......(.......(....(.......(....(.......(....(......0..5........('...-...((.....o)...(...(+...(,.......,..o-.................)........(....2.(/...o0.....(1....(2...2.(....o3.....(....o4...&.(.....o5....(.....o5....(....o6...&2.(....o7

C:\Program Files\FastestVPN\is-GFG66.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	108200
Entropy (8bit):	7.332504567097915
Encrypted:	false
SSDEEP:	1536:Gn5VJM3T5szyxa9PuIKb8wmtyYVzH0cfNbQSi/GoP4YNjZ34A7GZK/ZIVQ:GWsEa9GIdyAUKWeYNl34AwK/ZV
MD5:	261A5044C94F318DEEA20D178ED9F36E
SHA1:	2A9704F70A543EE219481A3AA756A0CF151E1999
SHA-256:	D17E9B0C62C224D1BA56E7206D8A44FE382FE99752C511BA211A7725D83FEF43
SHA-512:	E53C320DBF6B2AAEEC01FE5AFF1FAD5A8D75B2483A78BA0E1B510F2A7A8C5C510ACD603541734F4A002748D0781FC11AFBF6967EBCDB41A6FC9A29C828ABC2A3
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...l.g..........." ..0..p.............. ........... ....................................`.....................................O....................\|.................p............................................ ............... ..H............text....n... ...p.................. ..`.rsrc................r..............@..@.reloc...............z..............@..B........................H........O..\|w..................,.......................................V!.)1......s............0..$........u......,...o.....u......,...o.....0..&........u......,....o ....u......,....o!......0..&........u......,....o"....u......,....o#...B.(Y...-.(.......{!..."..}!...>.{....o........0..9........(.....($.....(......,..o%...-..,..o&...-..,..o%.....*....0...........s'...}.....((....(....-..s....+.(....}......{....o....(....}.....(!....{...........s)...o.....{....

C:\Program Files\FastestVPN\is-GRQCB.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	159368
Entropy (8bit):	6.32384599449582
Encrypted:	false
SSDEEP:	3072:OcqXDYZbIkCKezJaoCNVljUmcmAs6Jm4AFt2iPaTatnhrOKK/E:9qbKwcB4njeXBSTcpOT/E
MD5:	7AE17C855F3CC63174E90EA527B6138B
SHA1:	0FE1E1B2252511F33EDA3FFCF1F8FC8586AB040A
SHA-256:	26FF04208EC4D26EF4DDD9B3CF01C4D2A1544550BCD59EFDE6F30170053A1170
SHA-512:	453BA41332A704F491FC9E1EE5FBE9F883EDDB4C26A71D207C93992726E9C5B7FEDC48EEEE2A2087F64B083F9473EE794FB2C8F3B77C9DBCBBC47B67816BD156
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........y..............Y.......................................................................Rich....................PE..L.....[...........!.........................................................`..................................................P.... ..`............@.......0..(...0...............................0...@............................................text....w.......................... ..`.rdata...A.......P..................@..@.data....6....... ..................@....rsrc...`.... ......................@..@.reloc..2(...0...0..................@..B................................................................................................................................................................................................................................................................................................................

C:\Program Files\FastestVPN\is-HC0TS.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	70824
Entropy (8bit):	6.23750269831583
Encrypted:	false
SSDEEP:	1536:rMDv5NwVvDK0HBDk4rVHe061i/kObvmaLLJBr+tTe7TK/SB0:UorK0HBDk4rV21HObvm2LJB4eHK/SO
MD5:	0F7D6DEE75C3FBB958529AB6A351CBDF
SHA1:	1CA639AB692ECD972C51C8BF826BF9BF089359FE
SHA-256:	C5B07CBACD0FF045485A0A4CE6FB3CCB330A0623E3EFE347D61DA4E698FDE412
SHA-512:	58F0B5ED44E3290D6C9FB0E624F2A351CD5BB4744A84AC55AC47FB1B087026DE4DBAA6BBC83255EEC51A2BB3ED9A680EF53E8FC7035586B4A74CA68016AE0F5D
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.... F..........." ..0.............J.... ... ....... .......................`...........`.....................................O.... ......................@......D...8............................................ ............... ..H............text...P.... ...................... ..`.rsrc........ ......................@..@.reloc.......@......................@..B................,.......H.......0<................................................................("...^.("......I...%...}....:.(".....}....b.{....%-.&..s#...o$....0..)........{.........(%...t......\|......(...+...3.....0..)........{.........('...t......\|......(...+...3...((.....{...."..}......{...."..}......{...."..}....2.(....s).....{...."..}......{...."..}......{...."..}......((.....{...."..}......{...."..}......{...."..}......{...."..}......((.....{...."..}......{

C:\Program Files\FastestVPN\is-HNNPS.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	18088
Entropy (8bit):	6.784018634948529
Encrypted:	false
SSDEEP:	384:4iqjQN+Pw2X6VUYNVYuKAiIYiUOX0FP27NBY3Yuv+WO:fqjQ8f5uKAvYidgK/Y/+X
MD5:	CD6CB12E677F6C45BBFE57DED6C90567
SHA1:	C13525F597974BA46B4B2A71F270B1056332F77B
SHA-256:	FA0E1B932B5548F39795B9C24106B48D6221600EA7679D6A1D1DEEED1C8D7D8C
SHA-512:	6D9DC73035F3C053281C9347131C8EF232797507F28271B60428FCA4A82CC43689BF1FA3E6DCE46AE92BC3C0E924745F81E315D2E4D4BD2F5D7991DC78A58FBD
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...X4y..........." ..0.............n3... ...@....... ....................................`..................................3..O....@..H...................`.......2..8............................................ ............... ..H............text...t.... ...................... ..`.rsrc...H....@......................@..@.reloc.......`......................@..B................N3......H........#................................................................{...."..}......{...."..}......{...."..}......(........%-.&r...ps....z(.......(......0..................,..rM..ps....z.(.........,...(....o.......(.......(.....s....o.........(....(......(....o......(....o........&..(.....r...ps....o..................tu.......0..B..........(....%-.&+.o.......&..(.....(....%-.&.+.(......s....o..........................0..B..........(....%-.&+.o ......*&..(.....

C:\Program Files\FastestVPN\is-IPA77.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	22696
Entropy (8bit):	6.669675167195394
Encrypted:	false
SSDEEP:	384:PICREYcfpyXOT9Z7a6WmYWXWIYiAh70FP27NBY3Yuv+9gfK:PIiE9QXM1xYioMK/Y/+9gi
MD5:	657A48C8DA3DE14059498E383EBEF318
SHA1:	ECCC9AB4E6804EB0581AC5BBD684B7DB5A13F028
SHA-256:	201EC78B195DCE51330985026A8A4EC641F9ACE53429C5C2F5BB3F1CE7BEEC4A
SHA-512:	C4F2410470BBEA5680958490B705C828254992441D27E5FB7837957583FDA8D639EA8D9EF00035DB63ABACF28C5E4560D642C1D19F144255908C44F5C37CE8DE
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....oY.........." ..0..$..........:C... ...`....... ....................................@..................................B..O....`..............................A............................................... ............... ..H............text...@#... ...$.................. ..`.rsrc........`.......&..............@..@.reloc...............,..............@..B.................C......H.......h'..p............?..X...0A......................................j~....%-.&(....s....%..........0..$.........(.....o.......&...,....o....,.....................,!(....,..r...p.(....(......(......(....,.r...p......%...%...(......(.....(....,.r...p......%...%...%...(.......(.....(....,!r...p......%...%...%...%...(........(....2r...p.(..........(......(....R. ...(...+%-.&("...^. ...(#....(...+&~ ....s%..."..s&.....('....*....0........................((

C:\Program Files\FastestVPN\is-K82F0.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	35496
Entropy (8bit):	6.3704146545353355
Encrypted:	false
SSDEEP:	768:yS78zRHlzbzaxUxU7y7y7y7S7CxUxU7y3K7yTyTTN77xNTOLSxY777DKoRREEK79:yS7DOOqf1RuhC5w78K/m
MD5:	26592109F19A24EE91F039EBB40038C4
SHA1:	C8846404EFEB44C6CBB242B4C107F7CCE865AD14
SHA-256:	E3F74128991C128410498223D4185915528360AD3DA92CD01BC23B19D8C2C670
SHA-512:	8B031C53F5529D50A80AE2A4803D7C34F9A71A54DA01A912D1DB4D77D9BC1F490AB634A32F2DF6009EB53A2E57CD21975F3E00AF111BFA8320DE550A17509CA1
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...>............." ..0..X...........v... ........... ...............................S....`..................................v..O....................`..............v..8............................................ ............... ..H............text....W... ...X.................. ..`.rsrc................Z..............@..@.reloc...............^..............@..B.................v......H........3...B...........................................................0.................(n...........................s)...}................s%...}................s....}................s....}................s....}................s....} ...............s!...}!...............s....}"...............s....}#...............s=...}$...............s9...}%...............s5...}&...............sA...}'...............sE...}(...............s-...})...............s1...}........(....(....(....

C:\Program Files\FastestVPN\is-K9S0M.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	711952
Entropy (8bit):	5.967185619483575
Encrypted:	false
SSDEEP:	12288:GBja5bBvR8Q0TE2HB0WLmvXbsVG1Gw03RzxNHgKhwFBkjSHXP36RMGy1NqTUO:GBjk38WuBcAbwoA/BkjSHXP36RMG/
MD5:	195FFB7167DB3219B217C4FD439EEDD6
SHA1:	1E76E6099570EDE620B76ED47CF8D03A936D49F8
SHA-256:	E1E27AF7B07EEEDF5CE71A9255F0422816A6FC5849A483C6714E1B472044FA9D
SHA-512:	56EB7F070929B239642DAB729537DDE2C2287BDB852AD9E80B5358C74B14BC2B2DDED910D0E3B6304EA27EB587E5F19DB0A92E1CBAE6A70FB20B4EF05057E4AC
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...p$?..........." ..0.............B.... ........... ....................... ............`....................................O......................../.......... ...T............................................ ............... ..H............text........ ...................... ..`.rsrc...............................@..@.reloc..............................@..B................$.......H.......x...(9............................................................(......(....^.(...........%...}....:.(......}....:.(......}......(....:.(......}......{......(......(....:.(......}......{.....(.............}.....(......{.....X.....}......0...........-.~.....~....X....b...aX...X...X..+....b....aX....X.....2.....cY.....cY....cY..\|....(......._..{........+,..{\|....3...{{......(....,...{{.....{}.......-.....0...........-.r...ps....z.o......-.~.....~....

C:\Program Files\FastestVPN\is-L8FIT.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	160936
Entropy (8bit):	5.261187861382329
Encrypted:	false
SSDEEP:	3072:kgeojL/a7WvVHjizsw+Uu5MBBA4TigO8K/1:5jDzvVDizsQWMB1iR/1
MD5:	F3F2EB62314A960AD5F60B61A8193CBD
SHA1:	FD77AD6D9F96762CD7EE8D17454D9A7490FD8148
SHA-256:	0F74E741958310B8E65E3B2393828998DB075EBF4C5B29045707948C65CB03CC
SHA-512:	A62D09CF93E604AE0282F05842B607216533800F82ABF75E7D0FF1E9DED5F748B9E34D5E38170F1C837A0957D15FC4C6DF101FF2BE48D90C880807D0FB95D3E6
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...2.Z...........!.........,......n:... ...@....... ....................................@..................................:..S....@..8)...........J..............8............................................... ............... ..H............text...t.... ...................... ..`.rsrc...8)...@.....................@..@.reloc...............H..............@..B................P:......H........#......................P ............................................y.....3....f........UE#.H.NDC..\3,.\|7...1...=.w..n.w.P5.y.......p.._Z@B..h..#,._...p...\|..qXV..6.......i[..2;.'`..=.;...~......0..T.......(..........(....(......r...pr...p(...........s..........,..(......T+...~....(....T..~....,.~....o..........~....,.~....(...........0..e.......s.......o....s......r5..p.o ....r?..p.o ....rQ..pry..po .....s!........~.....("...s#.....r...p($...&....0..A.......

C:\Program Files\FastestVPN\is-LFVH5.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	147848
Entropy (8bit):	6.032707503792338
Encrypted:	false
SSDEEP:	3072:yiq8kuub1o2/5pds7tUMZNFxtPwVrHlGZ6U1SiWUwBpXtNpTE1MNniv:WFwzFQ9FGZ1SityhtNpTECU
MD5:	B6DB385295FA78A6AABCF217FD3C3F83
SHA1:	71E2A93223A6B8204EED6B9834284C0FA1D7EBD0
SHA-256:	ABF40F07643E6D29D0817021991F9D27410B7DCAEF80980D849634ACEF255BDC
SHA-512:	122FDB77C0AC6A7A2ECF5519BB059097EF119390E6D3C34F9FAB303D60279EE8649175617E3B6FC2A3D118B422CE8BC1BFFC208332D0A9F012271325AC0A0EE7
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....@..........." ..0..............1... ...@....... ..............................0b....`.................................71..O....@...................'...`.......0..T............................................ ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B................k1......H.......8...d].................../.......................................0..s........r...p(......(....,.r...psK...z.rW..po....-.r[..pro..p(X....s.....~.....o....o......+8..o....t.........o.....o ...o!.....o.....o ...o!...o".....o#...-.....u........,...o$.....r...po%...,.r[..pr...p(X.....rS..po%...,.r[..prg..p(X....~&....~&......o%...,.....o'...&..o%...,.....o'...&.(....,..(....,.r...p.r...p((...sK...z.(....-&.(....-.r...p.r%..p((.....r)..p.((............U.E........(....*.

C:\Program Files\FastestVPN\is-NSK8U.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	53624
Entropy (8bit):	6.18841715621451
Encrypted:	false
SSDEEP:	768:mLtojuUUUbf/l0lwELEEEqi8g15qTLT5HGoV0weeezxSoL3G7Yl9zndG:mE17Iw8/i8gM5maee8SoL13zdG
MD5:	B7ABAF6A90E95E585E71C0C22D90AF73
SHA1:	C9756883D1738A9931D0BF58D6F69CBB8DFD5870
SHA-256:	3BA247FDCC6953B5CC672A361983B7B0AF3051A83128970BCEBAB22036D1E859
SHA-512:	3A67EF230A06FAE3095926EAD9AAF329009BC0F2ED6AA1E6683C426ADA29DDD9CB77EC3BE134DFC4CD10A1F675D518FB4986363C4FE649D4247770B96DBC7A56
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....#2..........." ..0.................. ........... ...............................0....`.....................................O.......................x'..........t...T............................................ ............... ..H............text........ ...................... ..`.rsrc...............................@..@.reloc..............................@..B.......................H........E...w..........................................................&...(....2.r...p(....V.(......}......}......{......{......{......(......}......}......}.......}.......}......{......{......{......{......{.......0..'.......~.........(....t............(...+...3...0..'.......~.........(....t............(...+...3...0..'.......~.........(....t............(...+...3...0..'.......~.........(....t............(...+...3...0..'.......~.........(....t............(...

C:\Program Files\FastestVPN\is-O5MTV.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	301224
Entropy (8bit):	5.823114295644
Encrypted:	false
SSDEEP:	3072:I856+Aq4WBT5TjbyfQ5d2ap3BES3l+3p7z8p5+cyIqrKMjE3g2AJX5ex4uyj0bOa:v56+Aq4WBTWpSqXhpeEioU2Uh/b
MD5:	4798226EE22C513302EE57D3AA94398B
SHA1:	F42C6CFA4068263D955608DE47E60D099AD8B394
SHA-256:	38F32C75433A2AF902D33511BC3BBBE5BBF66D87FEC7D3AD1694AECEEB7E485E
SHA-512:	94BB5E38CBCDC1E40BBD3AB14A3C92C8C90F64EA1910108BB2DE80E00BEA358A13A063031B5E3417A55102DB238488F5C3E766A1AF3ACEDB8806FEC5DD81990C
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........._.Y.1.Y.1.Y.1..l.[.1...>.].1.[.5.[.1.9.\|.X.1...l.D.1.Y.0.p.1...n.V.1...Q.M.1...o.X.1...k.X.1.RichY.1.........PE..L...[..@.................J...................`...............................P................... ...........................=..T....@...............n...*..............................................@............................................text....I.......J.................. ..`.data...L....`.......N..............@....rsrc........@.......^..............@..@........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files\FastestVPN\is-OKMTN.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	25768
Entropy (8bit):	6.8288213942048985
Encrypted:	false
SSDEEP:	384:tNjMaZomdl7FUC9mhsCVoNycrjIg9J197j26QIYidYFl0FP27NBY3Yuv+tiV:tHhShzuD/Bpa65YiGFuK/Y/+tiV
MD5:	37E6E1D07988932C4360D74A34B27AE9
SHA1:	F53AE2462ECC565EFCC28D1C5BB2C285BF899798
SHA-256:	7E321840FA4F112D0F117D8F4E4DDCA274829693CD1C1189CE1061B6F67550FF
SHA-512:	EFB94F19A885D20BF602AFE84CDD4FE5E9CE89B3A5B7D0BD5273546A6B5D894AD6F1359545DC6B2EEDE06FCB06790286CB69EFB153F249D7D8EF0C677C5D1B3A
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......4.a.pi.Hpi.Hpi.H68.Hri.H68.H\|i.H68.Hri.H68.Hti.H...Hqi.H...Hyi.Hpi.HFi.H};.Hsi.H};.Hqi.H};.Hqi.H};.Hqi.HRichpi.H........PE..L....q.Z...........!.................$.......0...............................p............@..........................7......D:.......P...............:...*...`..x...................................p4..@............0...............................text............................... ..`.rdata.......0......."..............@..@.data...\....@.......2..............@....rsrc........P.......4..............@..@.reloc..x....`.......6..............@..B................................................................................................................................................................................................................................................................................................................

C:\Program Files\FastestVPN\is-PTLVI.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	124072
Entropy (8bit):	6.169344446608534
Encrypted:	false
SSDEEP:	3072:LurAkSCDvkOtt+niUnQY8/LFEMnK8VQW5K/7:LJkSCDv+iUnQXLFEEM/7
MD5:	2DC3102392DAEF9B935CDF4939A9B132
SHA1:	F56261CE19BFC14F8317C2AA05F010E9ACFBCE02
SHA-256:	B6D9088505C220F23132D78675004BC31E0FB5C04257357C2B02072EF8C28DAD
SHA-512:	596AFAA1347CF730D2D0312857366EE3AD4C5C439E2F93BD6D38B29129C7B3530523B206FAEEF1DB3F6D9A18482162FF56321C9F1A1FA4F296F6B29AE8659321
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...q............" ..0.................. ........... ....................... ......Q.....`.....................................O......................................8............................................ ............... ..H............text........ ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................H.......d................................................................0...........s....%r...pr...po....%rk..pru..po....%r...pr...po....}......(....(...+o.....(...+o.......o....r!..p.o....(....}......o....}......o....}......o....}.....(....r%..p( ...-..(....re..p( ...,...}......}......{......{......{......{......{....J.......s!...s:....~....%-.&~..........s!...%.....s:...J.......s"...s#...J.......s!...s:.....0..........(...+o$.....E........9...^...*.r...pr...pr..

C:\Program Files\FastestVPN\is-QNEIM.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	116872
Entropy (8bit):	6.726218253535254
Encrypted:	false
SSDEEP:	3072:8tw0r3S8FpUCSBCLiXdb0NphY3kWlon6ZhPn8agN6K/p:8mWi8FpCBCLybQakA/Pn8agNj/p
MD5:	B9F4D43230B7FB66B95AF05DC03B32DE
SHA1:	56F868C56FFF836CA61055499988F965DCA37D26
SHA-256:	A103634B16841E3A68DD4A6BCBDFC3A1651B8C9F1114D99BF01CA31297664E21
SHA-512:	50EB5DE7D0A1B5D7E1AC38209488635EF77733C2C78DC39D0D473904128DBFC67D4E3EC388D2C2D79645AFDF03FD1965386F6E6D21553C9A6DAB07A58549FD1E
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........V.n.7.=.7.=.7.=.S.<.7.=.S.<o7.=.S.<.7.=._.<.7.=._.<.7.=._.<.7.=.S.<.7.=.7.=.7.=._.<.7.=._.<.7.=._3=.7.=._.<.7.=Rich.7.=........................PE..L...q._]...........!................O........0............................................@.............................T.......<.......................................p...............................@............0...............................text............................... ..`.rdata..4g...0...h..................@..@.data...4...........................@....rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................................

C:\Program Files\FastestVPN\is-QTCOF.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	49320
Entropy (8bit):	6.325351798150663
Encrypted:	false
SSDEEP:	768:Qmbo2ICFobV6wsLIcUIh/61jCouvi1Ys7ZYiG6K/Y/+Z:QmbrbU6ws0cGjCoei1Ys7Z7G6K/P
MD5:	C22900453EF4B917460ADEA7DE87225B
SHA1:	6878237656DA68C046FB95FAA8CAF3B4C719851B
SHA-256:	9AF8C8105093B7D62FC578DAE3497FF0AD796C9ABD638EB14269DED4270DFF96
SHA-512:	2E7D0EB99E2924FB375AAF8891968228193C65C133E362F66567C044E8B744ABC3A992EF7606644690D1BB81AD13A64A35D8107BDBDD9D5942BEA1DD1074EA3C
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L................." ..0................. ........... ....................................`.................................p...O.......,..............................T............................................ ............... ..H............text....... ...................... ..`.rsrc...,...........................@..@.reloc..............................@..B........................H........L...\............................................................{".....{#...V.($.....}".....}#......0..A........u........4.,/(%....{"....{"...o&...,.('....{#....{#...o(...... ?Y.. )UU.Z(%....{"...o)...X )UU.Z('....{#...o...X...0..b........r...p......%..{"......%q.........-.&.+.......o+....%..{#......%q.........-.&.+.......o+....(,.....{-.....{....V.($.....}-.....}.....0..A........u........4.,/(%....{-....{-...o&...,.('....{.....{....o(...... (... )UU.

C:\Program Files\FastestVPN\is-RU768.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	31912
Entropy (8bit):	6.377831305172757
Encrypted:	false
SSDEEP:	384:i4sSUSsK/Py54Iu67VMam4AX10KIUt0kYcT/EDYZGSPeyc8cHIlkLi7FIYihZM09:izNK/G4IfVswkYLy5L7yYihrK/Y/+mT
MD5:	CE66CBCDA6D3B5047691C4AFF63CFE79
SHA1:	358E3A2284798BE1C537756A41721B61643D2BEE
SHA-256:	B8551ECBE96BB718BAA56E053589A7F16561BFDAB86575441EC5FBE528B32B8C
SHA-512:	7BC26EDD1C018553B163B75250B5862D26B607C26BDBFB6934F0AC5CE20B04D1956EEAF3915CBCE2129CD992ECA6E1B1C311991427D485CB43969A05431270E4
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...r.C..........." ..0..J..........~h... ........... ..............................wt....`.................................h..O....................R..............g..8............................................ ............... ..H............text....H... ...J.................. ..`.rsrc................L..............@..@.reloc...............P..............@..B................^h......H........1...5............................................................{...."..}......{...."..}......{...."..}......{...."..}....&..(........0...........s.......o.....+X..(.........(....o....o....&..(.........,!..r...po....&...(....o....o....&..r...po....&...(....-...........o ......o....o!.....+..............et.......0...........s"...%r...p.o#....%r...pr#..po#....%r+..prA..po#....%r]..p.($...o%...o#....%ro..p.($...o&............o....o'...o#....%r...p.($...o(....

C:\Program Files\FastestVPN\is-TIP8B.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	25976
Entropy (8bit):	6.331152456306087
Encrypted:	false
SSDEEP:	384:Z90ljCvGQJ+GlfmER/asDZ0WN1L4meT6pmOW2ZZWeQMWMLHRN7S37EHR9zCt+:Z9EIGk+GlfmERxcFz2ZSCL+7Ex9zS+
MD5:	3C5DFBB4E3F1AD153EB2E203B56EA0AE
SHA1:	59623BF1D67D87264C165E421F12426DA998AF46
SHA-256:	9E8252429D0E6529B87A2C79A13119F4DF56ABE924949F3750B024C51D747378
SHA-512:	94DF20E98A2E5D7AC93B63EFEBCE4DAAFBF25AB6B4A2B76AF0BB46D9EDE102AC8C8E1147D5813CDB879AADD5A8AA4073FD0E6066286AF4EF4D368FAB983BE3B5
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....w............" ..0..4...........S... ...`....... ....................................`..................................S..O....`...............>..x'..........XR..T............................................ ............... ..H............text....3... ...4.................. ..`.rsrc........`.......6..............@..@.reloc...............<..............@..B.................S......H.......l,..l%...................Q........................................(.....0..H.........~....,...~....~..........(......~....%-.&s....%...........,..(..............#<.......0..%.......~..........(...............,..(.........................0..........~..........(....(....o....(...+....,..(.................".......0..0.......~..........(....(.....o.....(...+....,..(...............$.......0..).......~..........(....(......o.......,..(.....*....................0..b...

C:\Program Files\FastestVPN\is-UN9A1.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	354984
Entropy (8bit):	6.846739611307464
Encrypted:	false
SSDEEP:	6144:jbz6pzdD/rIJXiQTutgCNktQFvmnoxXTS4ubCjrKglegtKop/4:G9FrIJJaqCNktA+SXfUCP9lvtKop/4
MD5:	D822226C4B35A7305269C8E16E542D3E
SHA1:	12F92D16608AAC1C39DDC92BA2B5AB8B5AAE6C30
SHA-256:	FC504A3F68150AFC8C3304E5528867BF99EDDE0F3707406A30371062DDD86A0E
SHA-512:	3A3A18D96716BD1033C35B06B73674FF6CBBEBE8F5025D0BE260F649FB268745290139B6501B9E208EB43EC5D76C2ABBA0A34C1E2F7E0E9F25E14C41F54E3914
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....I}f.........."...0......D......6.... ... ....@.. ..............................o.....`.....................................O.... ..tA...........@.............................................................. ............... ..H............text...<.... ...................... ..`.rsrc...tA... ...B..................@..@.reloc...............>..............@..B........................H........'... ...........G...............................................~.............,!.(...+.1..(...+(....-..(...+(....s....%o....%.o....o....&....0..5........r...p.s....(.....{....,...}....r!..p.s.......(...."..}......(.....rY..p.......{...."..}......{...."..}......{...."..}......{...."..}......{...."..}......{...."..}......{...."..}......{...."..}....*...0............j(......j(.....(....,#.(....o....,..(....o ....(....o!.....(......&...s"...(.....(

C:\Program Files\FastestVPN\is-UORP7.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	61608
Entropy (8bit):	6.287396747644481
Encrypted:	false
SSDEEP:	768:SmOGveifSTtyXEQ3nPGLb4PFvSMJCD2j+/IfHq1wJd9P581Icm/DskdFPYi3K/Ye:yLTtyXEQ3+bO6U+QlrPi1QLsgFP73K/h
MD5:	A760AEACBE049C8C0D5DD66DD9EAA7A0
SHA1:	975896722F2D5A365621EE407ACE3E3294CFC1C3
SHA-256:	C3618538771839CBC6A855E41A1664D5B86313070FC75CA1B58EF74D007DBDE4
SHA-512:	64CF42CF493686A4286320819D10A37CC075088509866E867A341651B7762FFD88750417E3AD72E6FA78908DD17C66363752E5AA2955066BA4930889D36AE3CA
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....b..........." ..0.................. ........... ....................... .......L....`.....................................O.......0..............................T............................................ ............... ..H............text........ ...................... ..`.rsrc...0...........................@..@.reloc..............................@..B........................H.......@@..<...........\|.................................................(......(......(...........Z~....,..oB...&.............b~....-.r...ps....z~.....(#...o8....0..........(#......o9.....(....Q6.(.....(%....0..........(#........o:.....(....QR.(.......(....('...:(#......o?...N.(.....(.....()...2(#....o;...2(#....o<.....o......o....2(#....o=...2(#....o>...6(#.....o.......0..........s"......}"....{"...-...+....#...s.......(1...6(#.....o....*6..(....(3..

C:\Program Files\FastestVPN\is-V02LD.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	3316968
Entropy (8bit):	6.532906510598102
Encrypted:	false
SSDEEP:	49152:JIBbo0WIgmjljFtXCdRLRBcJd+KaGxHIkMNqzP56O8lZ7qXUqi9Y:6BbBWIgWljGxRB/LLY
MD5:	0CF454B6ED4D9E46BC40306421E4B800
SHA1:	9611AA929D35CBD86B87E40B628F60D5177D2411
SHA-256:	E51721DC0647F4838B1ABC592BD95FD8CB924716E8A64F83D4B947821FA1FA42
SHA-512:	85262F1BC67A89911640F59A759B476B30CA644BD1A1D9CD3213CC8AAE16D7CC6EA689815F19B146DB1D26F7A75772CEB48E71E27940E3686A83EB2CF7E46048
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....R............" ..0..r2..........&1.. ....2...... ........................2.....6Q3...@.................................G&1.O.....2..............\|2.. ....2.....X.(.p............................................ ............... ..H............text....p2.. ...r2................. ..`.rsrc.........2......t2.............@..@.reloc........2......z2.............@..B................{&1.....H...........$....................(.....................................V!........s..........~....-(....o....o....o.........~....-.~.........~......( ......0..G.......(!....o"....s.1....s,..%..(.... ....o.....o 0...Zo....t....o8(..(......0..$..........(.....(....o.....(!.......io#...z...(....(!....o"...o....(......0............T....r...p.(O....o$....(......0..I.......sG...sB)..s.(..s.(...(....s6(....,..o%....2...(....sV(....+.....%..ox.....( ...*V.(&.....}......}..

C:\Program Files\FastestVPN\is-VTVPL.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	110760
Entropy (8bit):	5.479763068610726
Encrypted:	false
SSDEEP:	1536:hpKSyD3hoE3PQU9xb1iPKHKWU//6hE2rkQQc76rK/8:qSyLhZ/X9xb1YKqn/unQcOrK/8
MD5:	3FC875FFEFAC2BBA64E6F2A6A7CFF45B
SHA1:	CAB48D6D156261CD9612633D70A61DA670D0D093
SHA-256:	5A12A8D3CA02716C616F56342C920422966ABF79B49C4B1E1C7FF36E97764E1B
SHA-512:	DDA0B6F0587D7915B490FFA2225E72374A2AA671E2019ABDC72EB7598B642906CF09302575C5B5B495B832FF434D45BAD0650C0409358E5D1786F4561FAE3636
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....oY.........." ..0..v..........j.... ........... ....................................@.....................................O..................................t................................................ ............... ..H............text...pu... ...v.................. ..`.rsrc................x..............@..@.reloc..............................@..B................K.......H.......,S..0>..........\.................................................(....&.l(....k&.l(....k..l.l(....k&.l(....k&.l(....k&.l(....kj~....%-.&(....s....%........0..$.........(.....o.......&...,....o....,.....................,!(....,..r...p.(....(......(......(....,.r...p......%...%...(......(.....(....,.r...p......%...%...%...(.......(.....(....,!r...p......%...%...%...%...(........(....2r...p.(....2rG..p.(....2r...p.(....2r...p.(..........(.......

C:\Program Files\FastestVPN\nfapi.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	159368
Entropy (8bit):	6.32384599449582
Encrypted:	false
SSDEEP:	3072:OcqXDYZbIkCKezJaoCNVljUmcmAs6Jm4AFt2iPaTatnhrOKK/E:9qbKwcB4njeXBSTcpOT/E
MD5:	7AE17C855F3CC63174E90EA527B6138B
SHA1:	0FE1E1B2252511F33EDA3FFCF1F8FC8586AB040A
SHA-256:	26FF04208EC4D26EF4DDD9B3CF01C4D2A1544550BCD59EFDE6F30170053A1170
SHA-512:	453BA41332A704F491FC9E1EE5FBE9F883EDDB4C26A71D207C93992726E9C5B7FEDC48EEEE2A2087F64B083F9473EE794FB2C8F3B77C9DBCBBC47B67816BD156
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........y..............Y.......................................................................Rich....................PE..L.....[...........!.........................................................`..................................................P.... ..`............@.......0..(...0...............................0...@............................................text....w.......................... ..`.rdata...A.......P..................@..@.data....6....... ..................@....rsrc...`.... ......................@..@.reloc..2(...0...0..................@..B................................................................................................................................................................................................................................................................................................................

C:\Program Files\FastestVPN\subinacl.exe (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	301224
Entropy (8bit):	5.823114295644
Encrypted:	false
SSDEEP:	3072:I856+Aq4WBT5TjbyfQ5d2ap3BES3l+3p7z8p5+cyIqrKMjE3g2AJX5ex4uyj0bOa:v56+Aq4WBTWpSqXhpeEioU2Uh/b
MD5:	4798226EE22C513302EE57D3AA94398B
SHA1:	F42C6CFA4068263D955608DE47E60D099AD8B394
SHA-256:	38F32C75433A2AF902D33511BC3BBBE5BBF66D87FEC7D3AD1694AECEEB7E485E
SHA-512:	94BB5E38CBCDC1E40BBD3AB14A3C92C8C90F64EA1910108BB2DE80E00BEA358A13A063031B5E3417A55102DB238488F5C3E766A1AF3ACEDB8806FEC5DD81990C
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........._.Y.1.Y.1.Y.1..l.[.1...>.].1.[.5.[.1.9.\|.X.1...l.D.1.Y.0.p.1...n.V.1...Q.M.1...o.X.1...k.X.1.RichY.1.........PE..L...[..@.................J...................`...............................P................... ...........................=..T....@...............n...*..............................................@............................................text....I.......J.................. ..`.data...L....`.......N..............@....rsrc........@.......^..............@..@........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files\FastestVPN\unins000.dat

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp
File Type:	InnoSetup Log 64-bit FastestVPN, version 0x418, 28615 bytes, 899552\37\user\37, C:\Program Files\FastestVPN\376\377\377\00
Category:	dropped
Size (bytes):	28615
Entropy (8bit):	3.445479985432549
Encrypted:	false
SSDEEP:	192:4BghCardZ7epOa8A9fINlxeiyMzW1VSgOf2KGPUO6a7r00Ho:QAbexDwQ300Ho
MD5:	2A68FB84D2B0B759111726E909628BB6
SHA1:	3E83684E2295E1B6D8EB62F3F26193D5F078D32A
SHA-256:	4970FE9212F672E058F280FE5F76616A52BE20F15AB7233238F0F063498F465F
SHA-512:	76AFA1F4E2E0E52DD9F954E6A463999A56F11BEDDE6BC2E6620DD5CEF30C3F17B379BD7851A3C9D562C1D79F5A946620FEAB303FAA9D4E24FE1B688B7322B69B
Malicious:	false
Preview:	Inno Setup Uninstall Log (b) 64-bit.............................FastestVPN......................................................................................................................FastestVPN...............................................................................................................................o...................................................................................................................2..........e.@......s........8.9.9.5.5.2......a.l.f.o.n.s......C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.F.a.s.t.e.s.t.V.P.N....................B.. ........................C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.F.a.s.t.e.s.t.V.P.N......C.:.\.P.r.o.g.r.a.m.D.a.t.a.\.M.i.c.r.o.s.o.f.t.\.W.i.n.d.o.w.s.\.S.t.a.r.t. .M.e.n.u.\.P.r.o.g.r.a.m.s.\.F.a.s.t.e.s.t.V.P.N......F.a.s.t.e.s.t.V.P.N......e.n........................."...<........C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.F.a.s.t.e.s.t.V.P.N.................C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.F.a.s.t.e.s.t.V.P.N.\.B.o.u.n.

C:\Program Files\FastestVPN\unins000.exe (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	3070013
Entropy (8bit):	6.39701754184779
Encrypted:	false
SSDEEP:	49152:BdJYVM+9JtzZWnoS2VC23aun8+f5KuGP+VYNCWNtdH333t7:HJYVM+LtVt3P/KuGP+VYNCuf333V
MD5:	A2386053A831B1C65F9BB923F4F17A7B
SHA1:	530BC9411C100138963776A527966EA98D2D1FD9
SHA-256:	3AE0793AF74140734EC43A261FAD664E5871890F28F9CCC692B68B3D6E1A26E5
SHA-512:	2E149D81B13101F9C38EE67396A92527AE5BFD8761D8187BAB635C7736B316E31D9A246DC14D934F28EEE4076F9B3FA78751F912D9CFEB6A032470997382D76F
Malicious:	true
Preview:	MZP.....................@.......................InUn....................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L.....gf.......................................@..........................P/...........@......@...................P,.n.....,.j:....,.$....................................................p,.......................,......@,.(....................text............................. ..`.itext..$.......0................. ..`.data................*.............@....bss.....\|....+..........................idata..j:....,..<...f+.............@....didata.(....@,.......+.............@....edata..n....P,.......+.............@..@.tls....X....`,..........................rdata..]....p,.......+.............@..@.rsrc...$.....,.......+.............@..@.............`0......./.............@..@........................................................

C:\ProgramData\FastestVPN\ServicePort.txt

Download File

Process:	C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	4
Entropy (8bit):	1.5
Encrypted:	false
SSDEEP:	3:kS:kS
MD5:	3499738F724B2AE08A1871B6A0A7D175
SHA1:	A1AB9117DC426032D0E013BB62EDF31CD37B1CAF
SHA-256:	715FCF6424D0AC2F19B5A65364795EBB982885F040E93A1BF4FDD594D9478251
SHA-512:	3B1F29ADDCC165F7807149B13451ABE9DB7E0258F5A77F5802AEA11672B37CBC3439D4D8EB2AAB81F37B302B6631CD9573D64CF281FE4C9E44C672BF31BFF902
Malicious:	false
Preview:	9030

C:\ProgramData\Microsoft\Network\Downloader\edb.log

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.8307233233252883
Encrypted:	false
SSDEEP:	1536:gJhkM9gB0CnCm0CQ0CESJPB9JbJQfvcso0l1T4MfzzTi1FjIIXYvjbglQdmHDugn:gJjJGtpTq2yv1AuNZRY3diu8iBVqFR
MD5:	6EB9B5542248F870E530EC41B4F54482
SHA1:	FC24AD0BC4A023776A7FD75C3BB7275639968BAF
SHA-256:	E7928EF6F04A084DAA066FA75D6E72985D5FFAF3EBDB9FA0D1D911BC56165F08
SHA-512:	444B437463242DC6C159DAC43A6F85B6EBFE59AD68388F9FD9BB04CC06E4627A8852B500F55FB3CEB310CBC3A88C8F29B391931515365554C8C3082F2C452348
Malicious:	false
Preview:	...M........@..@.-...{5..;...{..........<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@......................4..........E.[.rXrX.#.........`h.................h.5.......3.....X\...;...{..................C.:.\.P.r.o.g.r.a.m.D.a.t.a.\.M.i.c.r.o.s.o.f.t.\.N.e.t.w.o.r.k.\.D.o.w.n.l.o.a.d.e.r.\.q.m.g.r...d.b....................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0x61acafc9, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.6585799420806527
Encrypted:	false
SSDEEP:	1536:ZSB2ESB2SSjlK/rv5rO1T1B0CZSJRYkr3g16P92UPkLk+kAwI/0uzn10M1Dn/di6:Zaza9v5hYe92UOHDnAPZ4PZf9h/9h
MD5:	72A621AA0214FBAA98F15E3F8686AB76
SHA1:	19726C0C1AC3524503B1A406915DB07038FCA21B
SHA-256:	A0881FDD94A3B4DBDD39258247E05EC73E9D9006AE34FA210987189D4FF39A83
SHA-512:	570925ED006A47090DF669C304240AE8826D47D782FE28A51F8C44F6BFC516A6F6E40407B2ED5B200670AE1B19A99B6543EB3AFB1F3C472D42BE2C6B1F46A8BB
Malicious:	false
Preview:	a...... ...............X\...;...{......................0.z..........{......\|'.h.\|.........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... ........-...{5..............................................................................................................................................................................................2...{..................................^.......\|'....................s*....\|'..........................#......h.\|.....................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.07925452414577644
Encrypted:	false
SSDEEP:	3:6bKYe4gZrAkGuAJkhvekl1wKUllAllrekGltll/SPj:6bKzZrbrxlOKU/AJe3l
MD5:	8A496B36706A7DFF60D2E5E8EC42A211
SHA1:	59A18B62319919A3D7C72A6EA64E18111637B417
SHA-256:	28C937ED414882AA892AC6929C96B6893CE1A48F9A71804F970B2BD11CE1D3DE
SHA-512:	437829232BF1CC2EDBB0492EADE9FD370D6B6DED9A2570CA68058770E0D92EC1554AAA6CE4A333942C037B058A2B5EB512BAE2C1B67DF1EF9EBA6330ADC4C73C
Malicious:	false
Preview:	6........................................;...{......\|'......{...............{.......{...XL......{.....................s....\|'.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\FastestVPN\FastestVPN.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Icon number=0, Archive, ctime=Thu Oct 3 07:29:22 2024, mtime=Thu Oct 3 07:29:22 2024, atime=Thu Jun 27 19:18:16 2024, length=2059432, window=hide
Category:	dropped
Size (bytes):	1765
Entropy (8bit):	3.216936257744624
Encrypted:	false
SSDEEP:	24:8UwMddv5O8IcQhpLAsVd/Z6d/nd/VkIbfd/VyRm:8Qddv5rTy8sVd/Z6d/nd/Vkcd/VO
MD5:	D62BEC3DE822869312B5035AF27D9792
SHA1:	2C417B4D0D274916E117711437DD2815C651A3C9
SHA-256:	D85889F4C73D8A7B9D6B0B04E6046FC8A0A6ED12475B5B0895F120DB40A9DF79
SHA-512:	831C65232E49E72D0EEAFE30CFD125F83008491758FCF158130835DF4EB74B9E7CB322909A8BE8BF6B9937A4A824447C166FE281EF36E6C7AAA3A29B961BCB72
Malicious:	false
Preview:	L..................F.@.. .....%Yn...J.6Yn......$.....l...........................P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.IDW.r....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....^.1.....CY.C..FASTES~1..F......CY.CCY.C....*.......................\.F.a.s.t.e.s.t.V.P.N.....j.2..l...XH. .FASTES~1.EXE..N......CY.CCY.C....J.........................F.a.s.t.e.s.t.V.P.N...e.x.e.......Y...............-.......X...........?..(.....C:\Program Files\FastestVPN\FastestVPN.exe..9.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.F.a.s.t.e.s.t.V.P.N.\.F.a.s.t.e.s.t.V.P.N...e.x.e...C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.F.a.s.t.e.s.t.V.P.N.(.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.F.a.s.t.e.s.t.V.P.N.\.a.p.p.-.i.c.o.n...i.c.o.........%SystemDrive%\Program Files\FastestVPN\app-icon.ico.....................................................................................................................................

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\FastestVPN\Uninstall FastestVPN.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Archive, ctime=Thu Oct 3 07:29:22 2024, mtime=Thu Oct 3 07:29:22 2024, atime=Thu Oct 3 07:28:57 2024, length=3070013, window=hide
Category:	dropped
Size (bytes):	885
Entropy (8bit):	4.5337971926259355
Encrypted:	false
SSDEEP:	12:8muG20YXNh9hC1+dpF4G/UWSKO8DSzyOjA0DRkbdpBo6bdpBgdV0KmV:8muA1+ddv5O8EyyAEwd/o+d/gd5m
MD5:	F2DA94165ECB78B742AF597A98DCD46E
SHA1:	4364541CC45EF6DD3ADDCBC7286C6F991512D6FB
SHA-256:	A5B948A553CA82B40EBE1C87C688F854FF9159A58097E1C0E303DE17CEF2399C
SHA-512:	B9B3DF047E20206923954D8A6B9EC8C11F35A567948E578454DD70A35E62D0CF7E8903AA7A1DCABB1925855395846CCC768F17D255707CD8C1D8AF87F6A660F6
Malicious:	false
Preview:	L..................F.... ...6..Xn...F..Xn.....8Jn...=............................P.O. .:i.....+00.../C:\.....................1.....CY.C..PROGRA~1..t......O.ICY.C....B...............J.....t.&.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....^.1.....CY.C..FASTES~1..F......CY.CCY.C....*.......................\.F.a.s.t.e.s.t.V.P.N.....f.2.=...CY.C .unins000.exe..J......CY.CCY.C............................e.u.n.i.n.s.0.0.0...e.x.e.......W...............-.......V...........?..(.....C:\Program Files\FastestVPN\unins000.exe..7.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.F.a.s.t.e.s.t.V.P.N.\.u.n.i.n.s.0.0.0...e.x.e...C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.F.a.s.t.e.s.t.V.P.N.`.......X.......899552...........hT..CrF.f4... ...2=.b...,...W..hT..CrF.f4... ...2=.b...,...W..E.......9...1SPS..mD..pH.H@..=x.....h....H.....K...YM...?................

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_FastestVPN.Windo_53ebd9cdf731fce6dc6bf88ca253274667038a7_2affa00b_d5e4799b-2154-461e-9610-7e7fed80b7bf\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	1.0633118697131008
Encrypted:	false
SSDEEP:	192:2bWJvoNa0BU/6aGiJ6OIzuiF1Z24IO8u:cWJvoLBU/6at9IzuiF1Y4IO8u
MD5:	1831D1719505D156068DF328653E3812
SHA1:	46035F94C56D37068B2EB0C73F0667D85A52D5DB
SHA-256:	C6057F10140FAECBD313E57B3695FF5E4CCD0F37C4C75BBC1F04963A18E4F91D
SHA-512:	8ACA32B42836511557999B4BC38528A915218C09453A7320A2B8F70077CCEAC30923215FECD0FFFA70A02EF0F17A8A733FC5CADE64E171627F69C8E332343F89
Malicious:	false
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.C.L.R.2.0.r.3.....E.v.e.n.t.T.i.m.e.=.1.3.3.7.2.4.1.7.7.7.6.6.7.0.2.0.9.1.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.7.2.4.1.7.7.7.7.1.8.5.8.1.6.3.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.d.5.e.4.7.9.9.b.-.2.1.5.4.-.4.6.1.e.-.9.6.1.0.-.7.e.7.f.e.d.8.0.b.7.b.f.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.e.1.3.6.b.7.3.b.-.1.b.7.f.-.4.d.8.a.-.8.a.a.9.-.7.c.1.b.a.6.5.d.7.4.e.8.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.F.a.s.t.e.s.t.V.P.N...W.i.n.d.o.w.s.S.e.r.v.i.c.e...e.x.e.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e.=.F.a.s.t.e.s.t.V.P.N...W.i.n.d.o.w.s.S.e.r.v.i.c.e...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.8.8.4.-.0.0.0.1.-.0.0.1.4.-.b.3.a.b.-.8.a.6.0.6.e.1.5.d.b.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.b.3.7.5.a.5.b.0.1.c.c.e.6.9.2.0.b.8.4.1.1.a.f.c.e.d.8.6.5.7.1.0.0.0.0.0.0.0.0.0.!.0.0.0.0.a.b.1.8.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER4D36.tmp.csv

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	86280
Entropy (8bit):	3.062017231829248
Encrypted:	false
SSDEEP:	1536:Cp8p7Qcvgqpkl8hfqxvywZBnn+O+ovTvo+o+of+u+I+UqxZN:Cp8p7Qcvgqpkl8hfqxvywvnn+O+ovTvb
MD5:	3A8FEFD0FE2E706B9000B33E6DDA645B
SHA1:	FCABFF03142B0359D9333C0DBF6E38B51B8144F6
SHA-256:	76B63ADD60B2980199F80FB71E6623D403131C5D000B9A9B5C821A6D744B6D7A
SHA-512:	C0CA4E6682B7E5123783083C3EC8294C02E9CC0ECB09976EAE4B4B3191EC527336A4E7106801646E21A5092952F3A3F28EB16B4F70BB1B616CCF7000276D4CE1
Malicious:	false
Preview:	I.m.a.g.e.N.a.m.e.,.U.n.i.q.u.e.P.r.o.c.e.s.s.I.d.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.,.W.o.r.k.i.n.g.S.e.t.P.r.i.v.a.t.e.S.i.z.e.,.H.a.r.d.F.a.u.l.t.C.o.u.n.t.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.H.i.g.h.W.a.t.e.r.m.a.r.k.,.C.y.c.l.e.T.i.m.e.,.C.r.e.a.t.e.T.i.m.e.,.U.s.e.r.T.i.m.e.,.K.e.r.n.e.l.T.i.m.e.,.B.a.s.e.P.r.i.o.r.i.t.y.,.P.e.a.k.V.i.r.t.u.a.l.S.i.z.e.,.V.i.r.t.u.a.l.S.i.z.e.,.P.a.g.e.F.a.u.l.t.C.o.u.n.t.,.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.P.e.a.k.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.Q.u.o.t.a.P.e.a.k.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.e.a.k.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.e.a.k.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.r.i.v.a.t.e.P.a.g.e.C.o.u.n.t.,.R.e.a.d.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.W.r.i.t.e.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.O.t.h.e.r.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.R.e.a.d.T.r.a.n.s.f.e.r.C.o.u.n.t.,.W.r.i.t.e.T.r.a.n.s.f.e.r.C.o.u.n.t.,.O.t.h.e.r.T.r.a.n.s.f.e.r.C.o.u.n.t.,.H.a.n.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER4D86.tmp.txt

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	13340
Entropy (8bit):	2.685635882192288
Encrypted:	false
SSDEEP:	96:TiZYWvuobdfY7Y3BWYFnHAQYEZvc8tCi3E3RqwbMDJaxRHqMoDNIQZ3:2ZDvPcwvgGcJKJaxhqMoDSQZ3
MD5:	922F44AE69463763DE399434470C854B
SHA1:	CB761FB76B576B2AAFF7F95C909ABED33D407299
SHA-256:	7B351F30AB0C7F5A009808509ED70F425AD25F354D6C256BA1F3CEE5FBF24EF6
SHA-512:	E848E16620B8DC6D0FD19193AF3CE106D9F63EC87F671402798788C0D30F848E5C486C7A0F89E6FAF57E30ED8FA7EEA6C64989F110D43DB79BB622339F536275
Malicious:	false
Preview:	B...T.i.m.e.r.R.e.s.o.l.u.t.i.o.n. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1.5.6.2.5.0.....B...P.a.g.e.S.i.z.e. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .4.0.9.6.....B...N.u.m.b.e.r.O.f.P.h.y.s.i.c.a.l.P.a.g.e.s. . . . . . . . . . . . . . . . . . . . . . . . . . .1.0.4.8.3.3.3.....B...L.o.w.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . . . . . . . . .2.....B...H.i.g.h.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . .1.3.1.0.7.1.9.....B...A.l.l.o.c.a.t.i.o.n.G.r.a.n.u.l.a.r.i.t.y. . . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.i.n.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.a.x.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . .1.4.0.7.3.7.4.8.8.2.8.9.7.9.1.....B...A.c.t.i.v.e.P.r.o.c.e.s.s.o.r.s.A.f.f.i.n.i.t.y.M.a.s.k. . . . . . .

C:\ProgramData\Microsoft\Windows\WER\Temp\WERB2AA.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 15 streams, Thu Oct 3 08:29:36 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	223945
Entropy (8bit):	4.069725931859541
Encrypted:	false
SSDEEP:	1536:p4P7Jxlg6WpN4uE2aOnLTgvFn8SVX91XAoAyICCDFMtTANbte+IhSTlHuBojRLXG:pP6g4uEqnLTgvF8y8yAF2se8TLLXR
MD5:	405E73DB01802AFEE6FA146EE927B56F
SHA1:	83604FFFBB6ED538BE4392A60FCD7C74B89C91D7
SHA-256:	ED135640AFE928058451C6462C6F683AEBB7FB5CF120A4A9ECD82B47F4D4AC34
SHA-512:	06C5A7BB2F48ACF598E2FA6912C63691523482EA569FEA19E7254A394A785BCE6BC3A2677B0D4D64B49C92766D882131FBA4421CB761128B6C135C908D9809AC
Malicious:	false
Preview:	MDMP..a..... ........U.f....................................$............"...@..........`.......8...........T...........h*..a@......................................................................................................eJ......\ ......GenuineIntel............T............U.f.............................0..............,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.......................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WERB3D4.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8486
Entropy (8bit):	3.701081841590198
Encrypted:	false
SSDEEP:	192:R6l7wVeJKR6p6Ybx6ZgmfZa0DynprU89bCysfPWm:R6lXJM6p6Yt6ZgmfEQuCxf3
MD5:	97BA7E294E8183423AA44E7FE81B7BE6
SHA1:	3F607692C027D2BE27826D074B2D694AF3159952
SHA-256:	55B31D963C1D1FF5107C574EFBD70A91B8414E67FB68756F34D41EB16A9BC627
SHA-512:	01EEFA09CEAE981911F4AEB662616066FFFC2EBCDAC24317F28E4D99DA08818E559E93E93ED5BBC3AACD2849684114A156FA4CFACB2C29020B90F9D1BCD092DC
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.6.2.7.6.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERB3F4.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4887
Entropy (8bit):	4.554016226918778
Encrypted:	false
SSDEEP:	48:cvIwWl8zseYJg77aI9BWWpW8VYiYm8M4JCA2tf8HcFmM+q8vV2tf8HQkgIjUPV2R:uIjf/I7n37VSJC1sCKMsQzUUPMjd
MD5:	2B4A25A3A7554C8C0F82D47EF4C2597A
SHA1:	C01BA283FE9B015E9AC5B271A8EE1CFD9B76AB05
SHA-256:	0D54A969C3F8457BB01E937AD81A8EA38F8AFD8547ECC08F75B59DA9C5B01487
SHA-512:	537DEEE9EDB49B737023BE535DFBEEB09396CC1B98954F186A084E5C98B305C6F8AB9C43B00EE11196B1D3A15E175FF8ABBD9268617A560A8822E6B93FA5064B
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="527012" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\ProgramData\Microsoft\Windows\WER\Temp\WERB402.tmp.csv

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	85822
Entropy (8bit):	3.067588532863177
Encrypted:	false
SSDEEP:	1536:Se5Q+swVwuuNh9/eP0dalBMzpJ/+g+N5Bo34C:Se5Q+swVwuuNh9/eP0dalBMzX/+g+N5Y
MD5:	08E145B08028AE617B056F5792467E61
SHA1:	513026B8472A495FC06F237480A8DC37477F06AA
SHA-256:	4D773FE4FE4BC1275819EFF9B44DD6AB4E316F339B971DDE5724F3F7974B6129
SHA-512:	B67C390CF9A25C167893DCF0253F6FAB678228A695BBE3927FF3B97C724025E32E2451429B11CC2B01E131DAF78E1BEA0A8535F68698CE88AB2FE0ED67A9C349
Malicious:	false
Preview:	I.m.a.g.e.N.a.m.e.,.U.n.i.q.u.e.P.r.o.c.e.s.s.I.d.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.,.W.o.r.k.i.n.g.S.e.t.P.r.i.v.a.t.e.S.i.z.e.,.H.a.r.d.F.a.u.l.t.C.o.u.n.t.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.H.i.g.h.W.a.t.e.r.m.a.r.k.,.C.y.c.l.e.T.i.m.e.,.C.r.e.a.t.e.T.i.m.e.,.U.s.e.r.T.i.m.e.,.K.e.r.n.e.l.T.i.m.e.,.B.a.s.e.P.r.i.o.r.i.t.y.,.P.e.a.k.V.i.r.t.u.a.l.S.i.z.e.,.V.i.r.t.u.a.l.S.i.z.e.,.P.a.g.e.F.a.u.l.t.C.o.u.n.t.,.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.P.e.a.k.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.Q.u.o.t.a.P.e.a.k.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.e.a.k.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.e.a.k.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.r.i.v.a.t.e.P.a.g.e.C.o.u.n.t.,.R.e.a.d.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.W.r.i.t.e.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.O.t.h.e.r.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.R.e.a.d.T.r.a.n.s.f.e.r.C.o.u.n.t.,.W.r.i.t.e.T.r.a.n.s.f.e.r.C.o.u.n.t.,.O.t.h.e.r.T.r.a.n.s.f.e.r.C.o.u.n.t.,.H.a.n.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERB470.tmp.txt

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	13340
Entropy (8bit):	2.685080143531309
Encrypted:	false
SSDEEP:	96:TiZYW/kyRPk1oYMOYvW9iHlYEZthtFit3pvuvwrU/kapRHdDYM8YxEIaZ3:2ZD/kwDOQRW1aphWM8GzaZ3
MD5:	F0B6AC4F0A8B052B0973A87218576813
SHA1:	F36D6359C76B3F2C165CD5F3DF2FE3F839E17118
SHA-256:	991D659A0136D1F87A99B0A7D8F93D397573660AC42A9318ADCE622E31B18ED5
SHA-512:	788F6BDED512ED084EADB210397A0B34FA317CF93CC2B8F880BBC57272305F6A86BD03E5C1DA390CC37103DB60E9EB14B10F3C7D4C06A3AFF4CCEF17F62F24FB
Malicious:	false
Preview:	B...T.i.m.e.r.R.e.s.o.l.u.t.i.o.n. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1.5.6.2.5.0.....B...P.a.g.e.S.i.z.e. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .4.0.9.6.....B...N.u.m.b.e.r.O.f.P.h.y.s.i.c.a.l.P.a.g.e.s. . . . . . . . . . . . . . . . . . . . . . . . . . .1.0.4.8.3.3.3.....B...L.o.w.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . . . . . . . . .2.....B...H.i.g.h.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . .1.3.1.0.7.1.9.....B...A.l.l.o.c.a.t.i.o.n.G.r.a.n.u.l.a.r.i.t.y. . . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.i.n.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.a.x.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . .1.4.0.7.3.7.4.8.8.2.8.9.7.9.1.....B...A.c.t.i.v.e.P.r.o.c.e.s.s.o.r.s.A.f.f.i.n.i.t.y.M.a.s.k. . . . . . .

C:\Users\Public\Desktop\FastestVPN.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Icon number=0, Archive, ctime=Thu Oct 3 07:29:22 2024, mtime=Thu Oct 3 07:29:27 2024, atime=Thu Jun 27 19:18:16 2024, length=2059432, window=hide
Category:	dropped
Size (bytes):	1747
Entropy (8bit):	3.213687677976615
Encrypted:	false
SSDEEP:	24:8nh1+ddv5O8IcQhpLAsod/Z6d/nd/VkIbfd/VyRm:8h1+ddv5rTy8sod/Z6d/nd/Vkcd/VO
MD5:	7B9C40A0A2EA989DD2D3185A6481996A
SHA1:	29CA5AEC03EB674140C3637D2CDAB258EC6D469D
SHA-256:	4D0C134D85317F890CB0122499745893090B44AF0567469BB18CE87CD1DB5B23
SHA-512:	B6C5AE02F24D2FAFEF390562E1085C06E59DFA6D17A0F0D5EECF87BB6FDC987D350821777A9AE2906728959BDCCE8392F3AFBD1EF857248A6513780E1313831C
Malicious:	false
Preview:	L..................F.@.. .....%Yn...W.(\n......$.....l...........................P.O. .:i.....+00.../C:\.....................1.....CY.C..PROGRA~1..t......O.ICY.C....B...............J.....t.&.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....^.1.....CY.C..FASTES~1..F......CY.CCY.C....*.......................\.F.a.s.t.e.s.t.V.P.N.....j.2..l...XH. .FASTES~1.EXE..N......CY.CCY.C....J.........................F.a.s.t.e.s.t.V.P.N...e.x.e.......Y...............-.......X...........?..(.....C:\Program Files\FastestVPN\FastestVPN.exe..0.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.F.a.s.t.e.s.t.V.P.N.\.F.a.s.t.e.s.t.V.P.N...e.x.e...C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.F.a.s.t.e.s.t.V.P.N.(.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.F.a.s.t.e.s.t.V.P.N.\.a.p.p.-.i.c.o.n...i.c.o.........%SystemDrive%\Program Files\FastestVPN\app-icon.ico.......................................................................................................................................................

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F2E248BEDDBB2D85122423C41028BFD4

Download File

Process:	C:\Program Files\FastestVPN\FastestVPN.exe
File Type:	Certificate, Version=3
Category:	dropped
Size (bytes):	1428
Entropy (8bit):	7.688784034406474
Encrypted:	false
SSDEEP:	24:nIGWnSIGWnSGc9VIyy0KuiUQ+7n0TCDZJCCAyuIqwmCFUZnPQ1LSdT:nIL7LJSRQ+QgAyuxwfynPQmR
MD5:	78F2FCAA601F2FB4EBC937BA532E7549
SHA1:	DDFB16CD4931C973A2037D3FC83A4D7D775D05E4
SHA-256:	552F7BDCF1A7AF9E6CE672017F4F12ABF77240C78E761AC203D1D9D20AC89988
SHA-512:	BCAD73A7A5AFB7120549DD54BA1F15C551AE24C7181F008392065D1ED006E6FA4FA5A60538D52461B15A12F5292049E929CFFDE15CC400DEC9CDFCA0B36A68DD
Malicious:	false
Preview:	0...0..x..........W..!2.9...wu\0....H........0b1.0...U....US1.0...U....DigiCert Inc1.0...U....www.digicert.com1!0...U....DigiCert Trusted Root G40...130801120000Z..380115120000Z0b1.0...U....US1.0...U....DigiCert Inc1.0...U....www.digicert.com1!0...U....DigiCert Trusted Root G40.."0....H.............0..........sh..]J<0"0i3..%..!=..Y..).=X.v..{....0....8..V.m...y....._..<R.R....~...W.YUr.h.p..u.js2...D.......t;mq.-... .. .c)-..^N..!a.4...^.[......4@_.zf.w.H.fWW.TX..+.O.0.V..{]..O^.5.1..^......@.y.x...j.8.....7...}...>..p.U.A2...sn..\|!L....u]xf.:1D.3@...ZI...g.'..O9..X..$\F.d..i.v.v=Y]Bv...izH....f.t..K...c....:.=...E%...D.+~....am.3...K...}....!........p,A`..c.D..vb~.....d.3....C....w.....!..T)%.l..RQGt.&..Au.z._.?..A..[..P.1..r."..\|Lu?c.!_. Qko....O..E_. ........~.&...i/..-............B0@0...U.......0....0...U...........0...U..........q]dL..g?....O0....H..............a.}.l.........dh.V.w.p...J...x\.._...)V.6I]Dc...f.#.=y.mk.T..<.C@..P.R..;...ik.

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F2E248BEDDBB2D85122423C41028BFD4

Download File

Process:	C:\Program Files\FastestVPN\FastestVPN.exe
File Type:	data
Category:	dropped
Size (bytes):	254
Entropy (8bit):	3.0528988669712294
Encrypted:	false
SSDEEP:	6:kKck3pLDcJgjcalgRAOAUSW0PTKDXMOXISKlUp:EMpLYS4tWOxSW0PAMsZp
MD5:	AAF180209F27FCA2D15B95154EA77496
SHA1:	6DE24E0A704B4037DCC6E42F9FEF97856C6CA359
SHA-256:	E1066491B261DBB5F661A105983122C1795FCF3E6827D90283D2A6EEB914D044
SHA-512:	C43F70984F36A57C5B518DB30E7B841E6AE485EED37AB7087636EE0F3B394FAEED8E680EC3D254B229544F0C59B0D37CBB0D16CFD37B1AC6120D932DD384323F
Malicious:	false
Preview:	p...... ....l....).fn...(....................................................... ............n......................h.t.t.p.:././.c.a.c.e.r.t.s...d.i.g.i.c.e.r.t...c.o.m./.D.i.g.i.C.e.r.t.T.r.u.s.t.e.d.R.o.o.t.G.4...c.r.t...".5.a.2.8.6.4.1.7.-.5.9.4."...

C:\Users\user\AppData\Local\FastestVPN\FastestVPN.exe_Url_eplmg30frbssdwvao0rtvq0jja20avcl\1cse5002.newcfg

Download File

Process:	C:\Program Files\FastestVPN\FastestVPN.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	393
Entropy (8bit):	4.9531103888019015
Encrypted:	false
SSDEEP:	12:TMHdGGpOiYX4t/rAFQD4t/rA0y4t/KDSMdu6kG3xT:2ddY4zrUzRyl3
MD5:	862D30CA45F60177D808B23FE3CFE7E6
SHA1:	59B3F505AAD38FAFAACE84CB3FFB33D995FD17AD
SHA-256:	5507B15F1FDD939E600D213A2DD943CAB0B3516C46F379C871781A886337ACBF
SHA-512:	138C588D5DD7930BEF6B08C0E9B56B9343EBA22557AE6ECB955C82C7DF16335681D020628E616BB2DCAE1A5EBC27C2FEC1C047C8385319CC55A7179EA17D6D6D
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>..<configuration>.. <appSettings>.. <add key="AppCenterEnabled" value="False" />.. <add key="AppCenterServiceEnabled_analytics" value="False" />.. <add key="AppCenterServiceEnabled_crashes" value="False" />.. <add key="AppCenterInstallId" value="77a89d64-944c-4744-b602-85ca0cedced7" />.. </appSettings>..</configuration>

C:\Users\user\AppData\Local\FastestVPN\FastestVPN.exe_Url_eplmg30frbssdwvao0rtvq0jja20avcl\4tqfbq3l.newcfg

Download File

Process:	C:\Program Files\FastestVPN\FastestVPN.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	166
Entropy (8bit):	4.816940765206284
Encrypted:	false
SSDEEP:	3:vFWWMNHU8LdgCQcIMOofqRqLVuXKCWAawLEHJq0Vq4tlKaF9ULVuuQIMOn:TMVBd1IGpOSDH40Vq4t/G3QIT
MD5:	90401247D5A6AF2729E2F23FBA0A6351
SHA1:	977D37740A245C9A41AD5B8916C07A699B181A09
SHA-256:	C4622D6EF948D316ED1C28E5BD2EE8CCE28BE710E9815CA67BDFF4C2648AACA4
SHA-512:	1F47BC3EFD2AB121663FF12F753DF519DE18CFDE43C79C475D7CEC32D70AFC7CE8A696EBCE5BA2519CBAA4F58FBEDDEC082B3AC6EFCE50996D54A2975B2C27DE
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>..<configuration>.. <appSettings>.. <add key="AppCenterEnabled" value="False" />.. </appSettings>..</configuration>

C:\Users\user\AppData\Local\FastestVPN\FastestVPN.exe_Url_eplmg30frbssdwvao0rtvq0jja20avcl\AppCenter.config (copy)

Download File

Process:	C:\Program Files\FastestVPN\FastestVPN.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	166
Entropy (8bit):	4.816940765206284
Encrypted:	false
SSDEEP:	3:vFWWMNHU8LdgCQcIMOofqRqLVuXKCWAawLEHJq0Vq4tlKaF9ULVuuQIMOn:TMVBd1IGpOSDH40Vq4t/G3QIT
MD5:	90401247D5A6AF2729E2F23FBA0A6351
SHA1:	977D37740A245C9A41AD5B8916C07A699B181A09
SHA-256:	C4622D6EF948D316ED1C28E5BD2EE8CCE28BE710E9815CA67BDFF4C2648AACA4
SHA-512:	1F47BC3EFD2AB121663FF12F753DF519DE18CFDE43C79C475D7CEC32D70AFC7CE8A696EBCE5BA2519CBAA4F58FBEDDEC082B3AC6EFCE50996D54A2975B2C27DE
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>..<configuration>.. <appSettings>.. <add key="AppCenterEnabled" value="False" />.. </appSettings>..</configuration>

C:\Users\user\AppData\Local\FastestVPN\FastestVPN.exe_Url_eplmg30frbssdwvao0rtvq0jja20avcl\kvrc0i3c.newcfg

Download File

Process:	C:\Program Files\FastestVPN\FastestVPN.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	390
Entropy (8bit):	4.960433134947827
Encrypted:	false
SSDEEP:	12:TMHdGGpOiYX/rAFQD/rA0y/KDSMdu6kG3xT:2ddYDrP7l3
MD5:	0751F54FC0AC7BAC7D6E0C921C287C20
SHA1:	A297A591D5761768C4819F6B832386B46AE14684
SHA-256:	A15C2358AA5AB40DBD6C2B18E04A208EF85B4341131BAD8F015675EA042DC039
SHA-512:	AD20AD3F55648113E456A8E0E0DFCAE386EBA98825607642186C75D62DC8779F4D77E172782F9D2971E1528BF8642DE8AD979DBAEE30F0499065631493CD3C3E
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>..<configuration>.. <appSettings>.. <add key="AppCenterEnabled" value="True" />.. <add key="AppCenterServiceEnabled_analytics" value="True" />.. <add key="AppCenterServiceEnabled_crashes" value="True" />.. <add key="AppCenterInstallId" value="77a89d64-944c-4744-b602-85ca0cedced7" />.. </appSettings>..</configuration>

C:\Users\user\AppData\Local\FastestVPN\FastestVPN.exe_Url_eplmg30frbssdwvao0rtvq0jja20avcl\pl102yi3.newcfg

Download File

Process:	C:\Program Files\FastestVPN\FastestVPN.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	391
Entropy (8bit):	4.96667176035501
Encrypted:	false
SSDEEP:	12:TMHdGGpOiYX/rAFQD/rA0y4t/KDSMdu6kG3xT:2ddYDrPRyl3
MD5:	05764BF58382E1554DFC1299A59557C3
SHA1:	EAE5A73A934180CAEE53E8382014449179D4E54F
SHA-256:	34FF50B1AD68C1ED5C5A96924FC1948C11E63251D587B6AB7CE354DCBF4D3133
SHA-512:	D9550BD6E92F60C2FDC86AD9F693056DD3560771421AA76F5D08727569E437E566AFE6C0FD1E1B1194DC26B5338B7890F3CFD9F36EC420DFBD2291E683041FC2
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>..<configuration>.. <appSettings>.. <add key="AppCenterEnabled" value="True" />.. <add key="AppCenterServiceEnabled_analytics" value="True" />.. <add key="AppCenterServiceEnabled_crashes" value="False" />.. <add key="AppCenterInstallId" value="77a89d64-944c-4744-b602-85ca0cedced7" />.. </appSettings>..</configuration>

C:\Users\user\AppData\Local\FastestVPN\FastestVPN.exe_Url_eplmg30frbssdwvao0rtvq0jja20avcl\voc0zqbi.newcfg

Download File

Process:	C:\Program Files\FastestVPN\FastestVPN.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	237
Entropy (8bit):	4.807606594598902
Encrypted:	false
SSDEEP:	6:TMVBd1IGpOSDH40Vq4t/S4JAFQDuq4t/G3QIT:TMHdGGpOiYX4t/rAFQD4t/G3xT
MD5:	183EBDEC24DDC45FF5E38C915A0F1F2E
SHA1:	E1FFE9DA68D9F934FD66E0EB15857C9C1F9BC48D
SHA-256:	6165A855053058DA8ABDE8798FABCD9F0E6ECAD175E52A3DFE0F3CF081C82E4E
SHA-512:	41F7B750B6CE0B096A3D5FD7ECF6CD1E222C7B26C4FF3F0463B1AAB2D5718245CF4A91AB396B02ED8B125A55E62574D5E11949B95C5A636899CD1A2F4F795D06
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>..<configuration>.. <appSettings>.. <add key="AppCenterEnabled" value="False" />.. <add key="AppCenterServiceEnabled_analytics" value="False" />.. </appSettings>..</configuration>

C:\Users\user\AppData\Local\FastestVPN\FastestVPN.exe_Url_eplmg30frbssdwvao0rtvq0jja20avcl\whhfk44u.newcfg

Download File

Process:	C:\Program Files\FastestVPN\FastestVPN.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	392
Entropy (8bit):	4.964207724341754
Encrypted:	false
SSDEEP:	12:TMHdGGpOiYX/rAFQD4t/rA0y4t/KDSMdu6kG3xT:2ddYDrUzRyl3
MD5:	3131918A1622FC2C3819A09F49BEDA82
SHA1:	CC11EBB2FE641823592E1E1F746714F9100B9056
SHA-256:	369D5AEB72B80F379793552A46618CE16866226E07ADCCE06D12F74541028112
SHA-512:	C30897D0A5D5AE51EBD260581F132B0A39814EB39578EBFAC7536B595EB5030831606992926F731C235ABE4E872864E741A22646E362F9BAEEE3D19B99A2EC79
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>..<configuration>.. <appSettings>.. <add key="AppCenterEnabled" value="True" />.. <add key="AppCenterServiceEnabled_analytics" value="False" />.. <add key="AppCenterServiceEnabled_crashes" value="False" />.. <add key="AppCenterInstallId" value="77a89d64-944c-4744-b602-85ca0cedced7" />.. </appSettings>..</configuration>

C:\Users\user\AppData\Local\FastestVPN\FastestVPN.exe_Url_eplmg30frbssdwvao0rtvq0jja20avcl\zduiz5to.newcfg

Download File

Process:	C:\Program Files\FastestVPN\FastestVPN.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	306
Entropy (8bit):	4.786578375552194
Encrypted:	false
SSDEEP:	6:TMVBd1IGpOSDH40Vq4t/S4JAFQDuq4t/S4JAHUfq4t/G3QIT:TMHdGGpOiYX4t/rAFQD4t/rA0y4t/G3p
MD5:	9BD7587F34E11ECFAD8B5DEEED8364B6
SHA1:	93765EE7A4A27B2F84134001FAAB307984BD58BE
SHA-256:	B9870C1A6239C96F710CEB8B8E21A745433A8C8151B0D2FD9C17A0D2C4AB1C29
SHA-512:	7B0B26DFE2CD19BF210AE3E916D95D9EE97D6677C11979D2F8787C2EC9F682FC52078B4D126BC4671661CFD98EF8D7C9AE18F9AE5F8D6DF141F8B25B52A5D5C3
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>..<configuration>.. <appSettings>.. <add key="AppCenterEnabled" value="False" />.. <add key="AppCenterServiceEnabled_analytics" value="False" />.. <add key="AppCenterServiceEnabled_crashes" value="False" />.. </appSettings>..</configuration>

C:\Users\user\AppData\Local\FastestVPN\localdata.xml

Download File

Process:	C:\Program Files\FastestVPN\FastestVPN.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	684
Entropy (8bit):	5.189133149847151
Encrypted:	false
SSDEEP:	12:TMHdha8iPirqVUpQBCCxCGjg37KYv5K/jIDkcJ//0b6QnQxUrrCYb:2dk8pjQ0nG0Vv5KER5yZp
MD5:	D1B14DE3FE3D596A3D57E7BE7A95B6D4
SHA1:	000C7835981F6292DE55CB40238075C4C1BB98B1
SHA-256:	E9078E2F2D16DCB6035701994BAD2FF12909D566C10A9E80117E34EB1FCD1A1D
SHA-512:	133B293F6CF7C7D303CAA8A73B208243C1D5CD71711DE83CDCA981269D802F634372BFC252340981DEFC2F8645327FC39BF163A48F5A318923D5205CF4495207
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>..<Settings xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema">.. <Password />.. <ServerGroups />.. <AvailableProtocols />.. <EnabledProtocols />.. <Favorites />.. <SplitTunnelingStatus>false</SplitTunnelingStatus>.. <SplitTunnellingApps />.. <HasSeenSplitTunneling>false</HasSeenSplitTunneling>.. <ConnectOnLaunch>false</ConnectOnLaunch>.. <EnableAdBlock>false</EnableAdBlock>.. <RedialOnDrop>false</RedialOnDrop>.. <IsIKSEnabled>false</IsIKSEnabled>.. <IsConnectFallbackEnabled>false</IsConnectFallbackEnabled>.. <IsMinimizeLaunchEnabled>false</IsMinimizeLaunchEnabled>..</Settings>

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\FastestVPN.WindowsService.exe.log

Download File

Process:	C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe
File Type:	ASCII text, with CRLF line terminators
Category:	modified
Size (bytes):	1803
Entropy (8bit):	5.3407719505798275
Encrypted:	false
SSDEEP:	48:MO8mH2HKlIHoVnM6YHKh3oPtHo6hAHKzeEHKKHKx1qH6HKmTH3:fWqlIIVM6Yqh3oPtI6eqzPqKqxwaqqX
MD5:	077007B5E9C8A61A51283FAC0B0B1260
SHA1:	F9EABAC9D0664999C4D46AEB57C99D9041FD7F49
SHA-256:	DD99B5C1E5B54D11E9BE692C4201D18FC5CF4764B5EFFA232EFF142617F9EA2A
SHA-512:	007E65ABAA38E36B0DD4DD58EDFFDD4538B0F6D269F7067FEED2176DE1971EACF39E0E4BCF4365A383765C1DD49DDD2BFFA044EF94A8B50BB4270A17B74411FF
Malicious:	false
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.ServiceProcess, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..3,"System.Configuration.Install, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Confe64a9051#\48ee4ec9441351bbe4d9095c96b8ea01\System.Configuration.Install.ni.dll",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\2192b0d5aa4aa14486ae08118d3b9fcc\System.Configuration.ni.dll",0..3,"System.X

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\FastestVPN.exe.log

Download File

Process:	C:\Program Files\FastestVPN\FastestVPN.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1785
Entropy (8bit):	5.341273156781821
Encrypted:	false
SSDEEP:	48:MxHKlYHKh3ouHgJHreylEHMHKo1AmHKntHo6hAHKzeR:iqlYqh3ou0aymsqu/qntI6eqzm
MD5:	595CF857FACB9D100C163C39E2F2FE08
SHA1:	BD30AB70391652932B3BE7EF5D84A9B4C617B7FF
SHA-256:	A2E82A1EA4819A2C30BB6C841870CDA86A8DF0DF1B7ED5D18DC707F1B3962995
SHA-512:	A583D205C967908D847EC7EAD1ED1E039E9BAE253406690D71E621108189374E15E4BAE206C492D85E971EEBD18B8B7A621D686802B4D57126DDB4A1CFFE2ADA
Malicious:	false
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..3,"WindowsBase, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35","C:\Windows\assembly\NativeImages_v4.0.30319_32\WindowsBase\4d760e3e4675c4a4c66b64205fb0d001\WindowsBase.ni.dll",0..3,"PresentationCore, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35","C:\Windows\assembly\NativeImages_v4.0.30319_32\PresentationCore\17470ef0c7a174f38bdcadacc3e310ad\PresentationCore.ni.dll",0..3,"PresentationFramework, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35","C:\Windows\assembly\NativeImages_v4.0.30319_32\Presentatio5ae0f00f#\

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	1312
Entropy (8bit):	5.411547818704221
Encrypted:	false
SSDEEP:	24:3l1WSKco4KmM6GjKbmOIl+mN1s4RPQoU99tXt/NK3R88bJ0mrMf:11WSU4Yym/+ms4RIoU99tlNWR83mk
MD5:	D1B1461DFC1B2E9AD95B50AD1DA25543
SHA1:	E6079B5B56AEB951FBE2B20690F03D564674E52B
SHA-256:	008345A0301B2926FB5C62738E29B0483D97BF0ED795D76DF2764FA99F92211C
SHA-512:	9FDE3EE1520ABE698A07BD3CA06B13DE58A181C566BE3FE843931FF0361F0071933F3ECEC622F8AB9207BB4BB4DA14ACFE7764EB2E51E9C1A56E3EFEC727B5C0
Malicious:	false
Preview:	@...e................................................@..........P................1]...E...........(.Microsoft.PowerShell.Commands.ManagementH...............o..b~.D.poM......... .Microsoft.PowerShell.ConsoleHost0......................C.l]..7.s........System..4....................D...{..\|f........System.Core.D...............4..7..D.#V.............System.Management.Automation<................t.,.lG....M...........System.Management...@................z.U..G...5.f.1........System.DirectoryServices<...............i..VdqF...\|...........System.Configuration4.................%...K... ...........System.Xml..4.....................@.[8]'.\........System.Data.H................WY..2.M.&..g(g........Microsoft.PowerShell.Security...L.................gQ?O.....x5.......#.Microsoft.Management.Infrastructure.8..................1...L..U;V.<}........System.Numerics.<...............V.}...@...i...........System.Transactions.D....................+.H..!...e........System.Configuration.Ins

C:\Users\user\AppData\Local\Temp\191b37e9

Download File

Process:	C:\Program Files\FastestVPN\Resources\ComDebug.exe
File Type:	data
Category:	dropped
Size (bytes):	1198680
Entropy (8bit):	7.585146963404902
Encrypted:	false
SSDEEP:	24576:kp37lngoh8vbcHnCq/T8A58+RXBkVvCP81H/1Im7M/FFI8pBx:ixOq/oAZmKPoNh7M/FFzpBx
MD5:	8E960508C5C684B0DD921F919358506D
SHA1:	E8AC2F09E4D292DA7D9FD617D0E435DBBBAC0063
SHA-256:	05238D1C415413669BF14351D6E6EBCE193BEB29A6D1417DEEDA762B15D0A687
SHA-512:	90D25CCC32F0BE9E9B1FCE6FB0C31F6859A66C0EE7D293866B6C7337BA22FBE6246A63E1752CA9A8B83C23381601F7411392A29BAA6D3C31C0646611A21B3151
Malicious:	false
Preview:	...F...F...F...F...F...F...F...F...F...F...F...F...F...F...F...F...F...F...F...F...F...F...F...F...F...F...F...F...F...F...F...F...F...F...F...F...F...F...F...F...F...F...F...F...F...F...F...F...F...F...F...F...F...F...F...F...F...F...F...F...F...F...F...F...F...F...F...F...F...F...F...F...F...F...F...F...F...F...F...F...F...F...F...F...F...F...F...F...F...F...F...F...F...F...F...F...F...F...F...F...F...F...F...F...F...F...F...F...F...F...F...F...F...F...F...F...F...F...F...F...F...F...F...F...F...F...F...F...F...F...F...F...F...F...F...F../F.L~..Lz..Qc/..A5.kZ..d@".z]..yO4.-c#.xr..bI4.`]..yO4.x^F...F...F...F...F...F...F...F...F...F...F...F.bg(.yG'.dT#.u.F...F...F...F...F...F...F...F...F...F...F...F...F...F...F...F...F...F...F...F...F...F.bm4.lZ#.c]2.cM#...F...F...F...F...F...F...F...F...F...F...F...F...F...F...F...F...F...F...F...F...F.Zg..D\|c.@G%.b]).y...Yr..lC#.b\-...F...F...F...F...F...F...F...F...F...F...F...F...F...F...F...F...F.?.v.8.q.:.F...F...F...F...F...F...F...F...F...F...F

C:\Users\user\AppData\Local\Temp\Launcher.exe

Download File

Process:	C:\Windows\SysWOW64\netsh.exe
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	77928
Entropy (8bit):	6.451537762257313
Encrypted:	false
SSDEEP:	1536:nY46jZxP60lH2liSFlaxaAahjYKTsTBOohsxFOoh6xL:YzzXlWTax85YKTsdOosOoE
MD5:	F43C6B629BAAAAEE1E7FE095A8821631
SHA1:	F0E4B84BB1FA6BA985E281F3AFC9642AFCA168B5
SHA-256:	4196F6776110E75A9670FB5843F373E90E88C0826EAD45A30E9578221FF44AE3
SHA-512:	2B475850705FA37DD0C1B093D31CCCE48FFDBCC614215FFB304070B4F31E16CA651D4569AF39B36482C848751F1E31B7FD647BD23245718A0A1E877A6417878A
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......t...0..R0..R0..R.!.S(..R9.lR9..R0..RY..R.p.R2..R.p.R2..R.p.R3..R.!.S1..R.!.R1..R.!.S1..RRich0..R........................PE..L....h.e.................h...n......x!............@.................................9<....@.................................<...x.......................hZ......T.......p...............................@............................................text....f.......h.................. ..`.rdata..,\.......^...l..............@..@.data...............................@....rsrc...............................@..@.reloc..T...........................@..B................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_10ymolqe.hdo.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_nb5qbyqu.pzp.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\dglbpg

Download File

Process:	C:\Windows\SysWOW64\netsh.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	394752
Entropy (8bit):	6.762438184655051
Encrypted:	false
SSDEEP:	12288:eawkohoVYcATU+rugwDyicQGMjmHedtbY5lI34:eaL2kzguaQZaHed0V
MD5:	AC23DB89F30270BA0E9AD7C458870F41
SHA1:	A1A176DEBF79833009786F72443AE38375D9623E
SHA-256:	9FACF275E102D4F10BD1B9C79C57967F323858B3F97981A6424A14890F492061
SHA-512:	0C677D0DB1535280DB3F585E02D26C2ECA5662FF3EBFE82CC88A20BE92128528F0093D5F0CE6691A8A5005459E7D5C1FF53E4C70EBBB4AC2F14B94EF21BC6780
Malicious:	true
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L...d..^............................@.............@.......................................@.....................................x............................ ..xM...................................................................................text............................... ..`.rdata...*.......,..................@..@.data...............................@....reloc..xM... ...N...l..............@..Bljfcd....P...p...L..................@...................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\is-8EE2F.tmp\_isetup\_setup64.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp
File Type:	PE32+ executable (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	6144
Entropy (8bit):	4.720366600008286
Encrypted:	false
SSDEEP:	96:sfkcXegaJ/ZAYNzcld1xaX12p+gt1sONA0:sfJEVYlvxaX12C6A0
MD5:	E4211D6D009757C078A9FAC7FF4F03D4
SHA1:	019CD56BA687D39D12D4B13991C9A42EA6BA03DA
SHA-256:	388A796580234EFC95F3B1C70AD4CB44BFDDC7BA0F9203BF4902B9929B136F95
SHA-512:	17257F15D843E88BB78ADCFB48184B8CE22109CC2C99E709432728A392AFAE7B808ED32289BA397207172DE990A354F15C2459B6797317DA8EA18B040C85787E
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......^...............l...............=\......=\......=\......Rich............................PE..d.....R..........#............................@.............................`.......,......................................................<!.......P..H....@..0.................................................................... ...............................text............................... ..`.rdata..\|.... ......................@..@.data...,....0......................@....pdata..0....@......................@..@.rsrc...H....P......................@..@................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp

Download File

Process:	C:\Users\user\Desktop\PVUfopbGfc.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	3045888
Entropy (8bit):	6.41066353205617
Encrypted:	false
SSDEEP:	49152:pdJYVM+9JtzZWnoS2VC23aun8+f5KuGP+VYNCWNtdH333tQ:PJYVM+LtVt3P/KuGP+VYNCuf333i
MD5:	259E3EE4646FC251C3513EEF2683479F
SHA1:	BE09457567F0562E8942A28BD90759F6DCE6DCB5
SHA-256:	BD9F32A9B7B9663A3AFDD1DC0CCC3D6423783B360DB341691FE2FE71C543EC53
SHA-512:	56607419EF2E2F98A8DAA6478DEA4B49925F4A17AB649E450F34331490281E2FCF976F17813F1A80FA460EE258C02901528A43B508093098135C1FADB5902B24
Malicious:	true
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L.....gf.......................................@..........................P/...........@......@...................P,.n.....,.j:....,.$....................................................p,.......................,......@,.(....................text............................. ..`.itext..$.......0................. ..`.data................*.............@....bss.....\|....+..........................idata..j:....,..<...f+.............@....didata.(....@,.......+.............@....edata..n....P,.......+.............@..@.tls....X....`,..........................rdata..]....p,.......+.............@..@.rsrc...$.....,.......+.............@..@.............`0......./.............@..@........................................................

C:\Users\user\AppData\Local\Temp\{d561b4bd-4963-934e-b2b1-0e0727e36250}\SET9435.tmp

Download File

Process:	C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exe
File Type:	Windows setup INFormation
Category:	dropped
Size (bytes):	7537
Entropy (8bit):	5.046488463217706
Encrypted:	false
SSDEEP:	192:wr8tW9yCTi3K4vlQd22bjR+iAUC7bdP+io3DcNSj6jvKFkinuEQTXvzLd4Z:LWlGMdkxzo3DcNSj6jvKFkinuEQTXvzq
MD5:	50D29CA2E3DDB8A696923420EC2AC4FA
SHA1:	D85F4E65FE10F13DED1780DDBD074EDFC75F2D25
SHA-256:	817DFF7F4944A255A0A33B8D74EB60A755D8D268CC7AFD46FCE41E102E0A004B
SHA-512:	03778A9CDDD23639C88E24BB5D0446DA3A400BB6B3321FB35887CD23D88D0F7AD3FE911642CC7F8D16D29CD9E42106851B0028379E8DBCB3C6721C238FC4A0D3
Malicious:	false
Preview:	; ***************************************************************************..; Copyright (C) 2002-2014 OpenVPN Technologies, Inc. ..; This program is free software; you can redistribute it and/or modify ..; it under the terms of the GNU General Public License version 2 ..; as published by the Free Software Foundation. ..; *************************************************************************....; SYNTAX CHECKER..; cd \WINDDK\3790\tools\chkinf..; chkinf c:\src\openvpn\tap-win32\i386\oemvista.inf..; OUTPUT -> file:///c:/WINDDK/3790/tools/chkinf/htm/c%23+src+openvpn+tap-win32+i386+__OemWin2k.htm....; INSTALL/REMOVE DRIVER..; tapinstall install OemVista.inf tapoas..; tapinstall update OemVista.inf tapoas..; tapinstall remove tapoas....;*******************************************************..; Note to Developers:..;..; If you are bundling the TAP-Windows driver with your app,..; you should try

C:\Users\user\AppData\Local\Temp\{d561b4bd-4963-934e-b2b1-0e0727e36250}\SET9446.tmp

Download File

Process:	C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exe
File Type:	data
Category:	dropped
Size (bytes):	10711
Entropy (8bit):	7.2254581318251425
Encrypted:	false
SSDEEP:	192:PqDhDNF748XJCO39JnxrEwJqKkhYCxXA6qnaj/rHr:OXPJxXxkh3xXhlzX
MD5:	225E7BA0E5E2D46813E5C858A4D0D5B0
SHA1:	5DD49014764F634164520583FD0CEC87AB1A1625
SHA-256:	B0BAF5CB84FA4ACB34B77A6231052061DA6B8676D216833724B7A602622161FB
SHA-512:	9C77ADF7E71ACA94489DFEB536F796A017B7C05771962274BAE2C614E2AE6799CCEB36CC58AC470184C37F52DEAC75988BB14E6A329F432C6D7CEDBCA18272A8
Malicious:	false
Preview:	0.)....H........).0.)....1.0...`.H.e......0..M..+.....7.....>0..:0...+.....7..........dG.'$....g..191023085812Z0...+.....7.....0..T0.... .}..ID.U..;.t.`.U..h.z.F.......K1..0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.:.1.0...0...0<..+.....7...1.0,...F.i.l.e........o.e.m.v.i.s.t.a...i.n.f...0U..+.....7...1G0E0...+.....7.......010...`.H.e....... .}..ID.U..;.t.`.U..h.z.F.......K0....._Ne...=.....N.._-%1..0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.:.1.0...0...0<..+.....7...1.0,...F.i.l.e........o.e.m.v.i.s.t.a...i.n.f...0.....D.......L..S.4..b.1..0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.:.1.0...0...0:..+.....7...1,0...F.i.l.e........t.a.p.0.9.0.1...s.y.s...0.... .?;..{.x....H..4...k).VB.......1..0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.:.1.0...0...0:..+.....7...1,0*...F.i.l.e........t.a.p.0.9.0.1...s.y.s...0]..+.....7...1O0M0...+.....7...0...........010...`.H.e....... .?;..{.x....H..4...k).VB...........0...0....+.

C:\Users\user\AppData\Local\Temp\{d561b4bd-4963-934e-b2b1-0e0727e36250}\SET9466.tmp

Download File

Process:	C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exe
File Type:	PE32+ executable (native) x86-64, for MS Windows
Category:	dropped
Size (bytes):	39920
Entropy (8bit):	6.333649052940754
Encrypted:	false
SSDEEP:	768:bCxLEO/+ApBG35KBOXZZoZmTD11a+uiExMFYQjdJxh63NOe:tCI46F1a+jExMFFjzv69
MD5:	059E578D456043A8C3B76EC365B375F3
SHA1:	42189B6A1B8C736397113BFC2283F5E1E1A44E8E
SHA-256:	A0170CF78105CE757E0549D79E4AE7C412240E8B81D262A24D76A047F181F881
SHA-512:	99E6B6AF018D0E3509D9DBE00301A7D5D6645A2070A8144ACFF04842F8BBACCD81E7651578D08F47639CD2B7D00EB64ACDDFA8725BCE9A073580B7FCF7964E6A
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........~..[...[...[....w..Z....w..^...[...m....w.._....w..^.../t..Q.../t..Z.../t..Z...Rich[...........................PE..d......].........."......Z.....................@....................................P.....`A....................................................<.......X....p..H....x...#...........R..8............................S...............P...............................text...W>.......@.................. ..h.rdata..\|....P.......D..............@..H.data........`.......P..............@....pdata..H....p.......R..............@..HPAGE.................V.............. ..`INIT.................d.............. ..b.rsrc...X............p..............@..B.reloc...............v..............@..B................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\{d561b4bd-4963-934e-b2b1-0e0727e36250}\oemvista.inf (copy)

Download File

Process:	C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exe
File Type:	Windows setup INFormation
Category:	dropped
Size (bytes):	7537
Entropy (8bit):	5.046488463217706
Encrypted:	false
SSDEEP:	192:wr8tW9yCTi3K4vlQd22bjR+iAUC7bdP+io3DcNSj6jvKFkinuEQTXvzLd4Z:LWlGMdkxzo3DcNSj6jvKFkinuEQTXvzq
MD5:	50D29CA2E3DDB8A696923420EC2AC4FA
SHA1:	D85F4E65FE10F13DED1780DDBD074EDFC75F2D25
SHA-256:	817DFF7F4944A255A0A33B8D74EB60A755D8D268CC7AFD46FCE41E102E0A004B
SHA-512:	03778A9CDDD23639C88E24BB5D0446DA3A400BB6B3321FB35887CD23D88D0F7AD3FE911642CC7F8D16D29CD9E42106851B0028379E8DBCB3C6721C238FC4A0D3
Malicious:	false
Preview:	; ***************************************************************************..; Copyright (C) 2002-2014 OpenVPN Technologies, Inc. ..; This program is free software; you can redistribute it and/or modify ..; it under the terms of the GNU General Public License version 2 ..; as published by the Free Software Foundation. ..; *************************************************************************....; SYNTAX CHECKER..; cd \WINDDK\3790\tools\chkinf..; chkinf c:\src\openvpn\tap-win32\i386\oemvista.inf..; OUTPUT -> file:///c:/WINDDK/3790/tools/chkinf/htm/c%23+src+openvpn+tap-win32+i386+__OemWin2k.htm....; INSTALL/REMOVE DRIVER..; tapinstall install OemVista.inf tapoas..; tapinstall update OemVista.inf tapoas..; tapinstall remove tapoas....;*******************************************************..; Note to Developers:..;..; If you are bundling the TAP-Windows driver with your app,..; you should try

C:\Users\user\AppData\Local\Temp\{d561b4bd-4963-934e-b2b1-0e0727e36250}\tap0901.cat (copy)

Download File

Process:	C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exe
File Type:	data
Category:	dropped
Size (bytes):	10711
Entropy (8bit):	7.2254581318251425
Encrypted:	false
SSDEEP:	192:PqDhDNF748XJCO39JnxrEwJqKkhYCxXA6qnaj/rHr:OXPJxXxkh3xXhlzX
MD5:	225E7BA0E5E2D46813E5C858A4D0D5B0
SHA1:	5DD49014764F634164520583FD0CEC87AB1A1625
SHA-256:	B0BAF5CB84FA4ACB34B77A6231052061DA6B8676D216833724B7A602622161FB
SHA-512:	9C77ADF7E71ACA94489DFEB536F796A017B7C05771962274BAE2C614E2AE6799CCEB36CC58AC470184C37F52DEAC75988BB14E6A329F432C6D7CEDBCA18272A8
Malicious:	false
Preview:	0.)....H........).0.)....1.0...`.H.e......0..M..+.....7.....>0..:0...+.....7..........dG.'$....g..191023085812Z0...+.....7.....0..T0.... .}..ID.U..;.t.`.U..h.z.F.......K1..0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.:.1.0...0...0<..+.....7...1.0,...F.i.l.e........o.e.m.v.i.s.t.a...i.n.f...0U..+.....7...1G0E0...+.....7.......010...`.H.e....... .}..ID.U..;.t.`.U..h.z.F.......K0....._Ne...=.....N.._-%1..0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.:.1.0...0...0<..+.....7...1.0,...F.i.l.e........o.e.m.v.i.s.t.a...i.n.f...0.....D.......L..S.4..b.1..0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.:.1.0...0...0:..+.....7...1,0...F.i.l.e........t.a.p.0.9.0.1...s.y.s...0.... .?;..{.x....H..4...k).VB.......1..0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.:.1.0...0...0:..+.....7...1,0*...F.i.l.e........t.a.p.0.9.0.1...s.y.s...0]..+.....7...1O0M0...+.....7...0...........010...`.H.e....... .?;..{.x....H..4...k).VB...........0...0....+.

C:\Users\user\AppData\Local\Temp\{d561b4bd-4963-934e-b2b1-0e0727e36250}\tap0901.sys (copy)

Download File

Process:	C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exe
File Type:	PE32+ executable (native) x86-64, for MS Windows
Category:	dropped
Size (bytes):	39920
Entropy (8bit):	6.333649052940754
Encrypted:	false
SSDEEP:	768:bCxLEO/+ApBG35KBOXZZoZmTD11a+uiExMFYQjdJxh63NOe:tCI46F1a+jExMFFjzv69
MD5:	059E578D456043A8C3B76EC365B375F3
SHA1:	42189B6A1B8C736397113BFC2283F5E1E1A44E8E
SHA-256:	A0170CF78105CE757E0549D79E4AE7C412240E8B81D262A24D76A047F181F881
SHA-512:	99E6B6AF018D0E3509D9DBE00301A7D5D6645A2070A8144ACFF04842F8BBACCD81E7651578D08F47639CD2B7D00EB64ACDDFA8725BCE9A073580B7FCF7964E6A
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........~..[...[...[....w..Z....w..^...[...m....w.._....w..^.../t..Q.../t..Z.../t..Z...Rich[...........................PE..d......].........."......Z.....................@....................................P.....`A....................................................<.......X....p..H....x...#...........R..8............................S...............P...............................text...W>.......@.................. ..h.rdata..\|....P.......D..............@..H.data........`.......P..............@....pdata..H....p.......R..............@..HPAGE.................V.............. ..`INIT.................d.............. ..b.rsrc...X............p..............@..B.reloc...............v..............@..B................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\FastestVPN.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Icon number=0, Archive, ctime=Thu Oct 3 07:29:22 2024, mtime=Thu Oct 3 07:29:27 2024, atime=Thu Jun 27 19:18:16 2024, length=2059432, window=hide
Category:	dropped
Size (bytes):	1771
Entropy (8bit):	3.2158852597305763
Encrypted:	false
SSDEEP:	24:8Jh1+ddv5O8IcQhpLAskd/Z6d/nd/VkIbfd/VyRm:8/1+ddv5rTy8skd/Z6d/nd/Vkcd/VO
MD5:	CCA5624B296E564CF2C76B52AE01CF4D
SHA1:	0C6471A781723C9922C3DA3B6D7A017EAD00A1D5
SHA-256:	0C28677882D1331E76DD2FD911288FF6369FEA165AEC353CD66694D5D9A95538
SHA-512:	988AC62EC580A6458DBEB9C9CBA74D104CC7662637795DD76B742551B2E715E113971F20D4CEBCACA5FCF11409483CEAD2CC69F8287DD8DC29CA037BBA73A727
Malicious:	false
Preview:	L..................F.@.. .....%Yn...s3/\n......$.....l...........................P.O. .:i.....+00.../C:\.....................1.....CY.C..PROGRA~1..t......O.ICY.C....B...............J.....t.&.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....^.1.....CY.C..FASTES~1..F......CY.CCY.C....*.......................\.F.a.s.t.e.s.t.V.P.N.....j.2..l...XH. .FASTES~1.EXE..N......CY.CCY.C....J.........................F.a.s.t.e.s.t.V.P.N...e.x.e.......Y...............-.......X...........?..(.....C:\Program Files\FastestVPN\FastestVPN.exe..<.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.F.a.s.t.e.s.t.V.P.N.\.F.a.s.t.e.s.t.V.P.N...e.x.e...C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.F.a.s.t.e.s.t.V.P.N.(.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.F.a.s.t.e.s.t.V.P.N.\.a.p.p.-.i.c.o.n...i.c.o.........%SystemDrive%\Program Files\FastestVPN\app-icon.ico...............................................................................................................................

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\FastestVPN.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Thu Oct 3 07:29:22 2024, mtime=Thu Oct 3 07:29:27 2024, atime=Thu Jun 27 19:18:16 2024, length=2059432, window=hide
Category:	dropped
Size (bytes):	1801
Entropy (8bit):	3.234896182696819
Encrypted:	false
SSDEEP:	24:81h1+ddv5O8IcQhpLAsKd/Z6d/SCqd/VkIbfd/VyRm:8b1+ddv5rTy8sKd/Z6d/sd/Vkcd/VO
MD5:	DA925845CE0501E0C505B7AF7100A3CE
SHA1:	FFDEF442AE7FDDB1F34D821DCBE4C0EC89AAB289
SHA-256:	0942B800417A810F2B393B166202C8FBE16952CC8D9F29911600657C6E9A0B20
SHA-512:	A168394EF5DBAB87C0B1B010291F7CFE28A8F4007CED8582185CE94A1E149DDD3543D2912B86A9108C2A687C6A7C69EF9A9423EAAAC44D5829CC25C96EDFE023
Malicious:	false
Preview:	L..................F.@.. .....%Yn....8\n......$.....l...........................P.O. .:i.....+00.../C:\.....................1.....CY.C..PROGRA~1..t......O.ICY.C....B...............J.....t.&.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....^.1.....CY.C..FASTES~1..F......CY.CCY.C....*.......................\.F.a.s.t.e.s.t.V.P.N.....j.2..l...XH. .FASTES~1.EXE..N......CY.CCY.C....J.........................F.a.s.t.e.s.t.V.P.N...e.x.e.......Y...............-.......X...........?..(.....C:\Program Files\FastestVPN\FastestVPN.exe..B.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.F.a.s.t.e.s.t.V.P.N.\.F.a.s.t.e.s.t.V.P.N...e.x.e...C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.F.a.s.t.e.s.t.V.P.N...-.a.u.t.o.r.u.n.(.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.F.a.s.t.e.s.t.V.P.N.\.a.p.p.-.i.c.o.n...i.c.o.........%SystemDrive%\Program Files\FastestVPN\app-icon.ico.................................................................................................

C:\Users\user\AppData\Roaming\linkinfo\desktop_drop_plugin.dll

Download File

Process:	C:\Program Files\FastestVPN\Resources\ComDebug.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	321936
Entropy (8bit):	6.249416182192696
Encrypted:	false
SSDEEP:	6144:49C2dRHqGR0N9BdVLATWWFQEDyhNSDEAIjUoMfqC9ulMdUBIKL:Z2dRHqGRyhAT9FxoSIAIx/C9ulMe2KL
MD5:	5C1752EF16C7E3B28D9662E3C08FB08F
SHA1:	4B3F3BE508D4C6CD8374FBB812EE30E99F8128C0
SHA-256:	1BF45DF354D53D400EAF644E205DADDB0C07B408EB0C03D8CCFF765BD6659FB3
SHA-512:	296F8AA642527C3A2364B9FA0E1C9F3EE3B7AD6F82D51685F71601F4E4A0E5DA5327FF1E1884F6264E7961417D54028B4E9BBE1B836968FF0F9D6685EBEE0327
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........Z.H.;...;...;..6K...;..6K..q;.......;.......;.......;..6K...;..6K...;...G...;...;...;.......;.......;....p..;.......;..Rich.;..........................PE..d...O.wf.........." ...(............0....................................... ......h1....`..........................................t..t...Du..x................-..............................................(.......@............@...............................text...,(......................... ..`.rdata..rC...@...D..................@..@.data...x7....... ...r..............@....pdata...-..........................@..@.rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\linkinfo\desktop_multi_window_plugin.dll

Download File

Process:	C:\Program Files\FastestVPN\Resources\ComDebug.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	397712
Entropy (8bit):	6.40156340476818
Encrypted:	false
SSDEEP:	12288:ThaEhq4cY0f8IlE6BZR2nUx9lYOUgLZUrd:T4EhqR5lE6xSUx9lYOUg6rd
MD5:	42C063882FD7CEDD3CC62356450D8987
SHA1:	A09DB77F70A6F7D7C59418FC08250A8E13E8A60D
SHA-256:	37D1EBFC8F423BF02DEC598C6421E4124C8C5666C27782180D84003039E88DFF
SHA-512:	77AC9C670F91059B2CAA12DA9B5417CD71D525F900B7DDA51FFCF499AA2882734B342F6803814C6FDE1B527C9742ED9CF67AB1EE8D141CB437B57C979D89B456
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......Q{.?...l...l...l.j.m...l.j.m...l.j.m...l..m...l..m...l..mY..l.j.m...l.f.m...l...m...l...l...l...m...l...m...l..zl...l...l...l...m...lRich...l........PE..d...j.wf.........." ...(.....L......l........................................0......E.....`..........................................*......x+..........h[.......3........... ..`...............................(...p...@............................................text...\|........................... ..`.rdata...o.......p..................@..@.data....?...@...(...2..............@....pdata...3.......4...Z..............@..@.rsrc...h[.......\..................@..@.reloc..`.... ......................@..B........................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\linkinfo\file_selector_windows_plugin.dll

Download File

Process:	C:\Program Files\FastestVPN\Resources\ComDebug.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	346512
Entropy (8bit):	6.253406880555808
Encrypted:	false
SSDEEP:	6144:sQz5UqJwVKCsnOeuj9PDnBQpUZyNVHhl/FPTCgTx:sQ1UqChsnOeMhBaQy9l/FPW0x
MD5:	9641732F1DB2EAB135130C9128C1427A
SHA1:	88B0857CFE055A1D920E55B3094116162E4EAA00
SHA-256:	B47CD11E4089FE0AE8BAF4E05B4CCF19B1DFE403FD392649E9253C05D58F3CBC
SHA-512:	5C87B26E51771B61FDF87D577781B1FB163527D0F03E74327BC11EA1A24B1B449D4AB23F7393466ED4BAF3809A5151EB30928F462B5FCD55BB8DE4BD733856A8
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......]..B........................f......f......f..J.............................a......a......aZ.....a.....Rich...........PE..d...r.wf.........." ...(.p...........v...............................................=....`.........................................p...\|.......x....`....... ...1...........p..,...PK.......................M..(....J..@............................................text...`o.......p.................. ..`.rdata...V.......X...t..............@..@.data...T8......."..................@....pdata...1... ...2..................@..@.rsrc........`....... ..............@..@.reloc..,....p......."..............@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\linkinfo\flutter_custom_cursor_plugin.dll

Download File

Process:	C:\Program Files\FastestVPN\Resources\ComDebug.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	313744
Entropy (8bit):	6.2705364965004815
Encrypted:	false
SSDEEP:	6144:7OqwvZdI0CglL0fN5ra4KBb5cSgQkJjMoplVNLQDrkHW:6qwvigF0fN5OB5dgQkBplVNLQDeW
MD5:	2EEEB7F9DCC44DC28CBFBAF94176CA6F
SHA1:	65055D6EE4E5A322DB3C74B0EF8CDADECDB32737
SHA-256:	966DDE59F9ABD125F763A95273BF923C2543A4B9F43F6F0C5587CCA308BD9FFD
SHA-512:	5919481A1768E9B19CE79ADDDFFC25A6BCDA326232FEB6E61729C2173292F3E2EC7266C646090DCC061A2E9643084583E43947774FDF76842316249B3B2E911F
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......@D..%...%...%...U...%...U..%...U...%......%......%.....H%...U...%...Y...%...%..}%.......%.......%....v..%.......%..Rich.%..................PE..d...t.wf.........." ...(.................................................................`.........................................0].......]..P................,..............................................(.......@............0..x............................text...,........................... ..`.rdata..h;...0...<..................@..@.data....7...p.......T..............@....pdata...,...........r..............@..@.rsrc...............................@..@.reloc..............................@..B................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\linkinfo\flutter_gpu_texture_renderer_plugin.dll

Download File

Process:	C:\Program Files\FastestVPN\Resources\ComDebug.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	344464
Entropy (8bit):	6.268258211828341
Encrypted:	false
SSDEEP:	6144:eyhvW10qILfhXrbR0fkN0addZrKKOYQ9gsYlFtx/pP8fW5:eyhW0qIF10fkNBvgK5QRYlFtxxP8fW5
MD5:	E6C6C72226677BACF6EC83BEDA63F49D
SHA1:	C0E75C5A5B9D7C8CD07E80A2BA4D809801EFF649
SHA-256:	2018F17E324516FC891E5C868E2045970855A3A1521D73F0F6AE12EBF12CFBBA
SHA-512:	3A52B60711EFB4A34E5FF655E60D51A29C6D4B2CD4561A421A51647D5FCB2C75F1468A8F93C25206EDEBCF259112A4C7DA41F90181FF7E53946E1FFF5FB3F353
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........@..!...!...!...Q...!...Q..l!...Q...!.......!.......!......!...Q...!...]...!...!..C!......!......!...~..!......!..Rich.!..........................PE..d...z.wf.........." ...(.l...........e...............................................j....`.........................................0.......8...<....`....... ...2...&.......p.......M.......................O..(....L..@...............x............................text...tj.......l.................. ..`.rdata...Q.......R...p..............@..@.data....=......."..................@....pdata...2... ...4..................@..@.rsrc........`......................@..@.reloc.......p......................@..B........................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\linkinfo\flutter_windows.dll

Download File

Process:	C:\Program Files\FastestVPN\Resources\ComDebug.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	17983376
Entropy (8bit):	6.549243204630475
Encrypted:	false
SSDEEP:	98304:2M5ISKnKKu/60i9gzTcriqcN9MX4C7GsIAfiz8xS6RWhi62KFfQWmLu2EkKZ3uNx:xO6ggzLI7op6Rt69L2kuNx
MD5:	E3E8D995E4A1D5E84EE11DBD58D21F3B
SHA1:	52E7AFB03DD3F45F7B8839879FEC1ACC7965A62E
SHA-256:	29782AC1F424865FA1007A5F818F35ABB5307B01C099AAA38067513E516A0454
SHA-512:	F4FB26D4DC2D91D36FD8F26B9BE6B74F50DF94DE530AFDD8D2D5E9D6D6300B52FB9C6EFBD94A95D630094CE59D5D1AA1B898F810BE8806B7E9DFC5466D312659
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.............J..J..J..fJ..J...K..J...K..J...Ko.J...K..J...K..J...K..J...K..J..Jh.J..J..Jr..K..Jr..K..JRich..J........................PE..d...]. f.........." ...".d....=......;....................................................`.........................................0[.......b...............p.......L..................T.......................(...`...@....................Y..`....................text... b.......d.................. ..`.rdata....-.......-..h..............@..@.data................v..............@....pdata.......p......................@..@_RDATA..\............2..............@..@.reloc...............4..............@..B................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\linkinfo\geek.dxf

Download File

Process:	C:\Program Files\FastestVPN\Resources\ComDebug.exe
File Type:	data
Category:	dropped
Size (bytes):	929318
Entropy (8bit):	7.900306716974538
Encrypted:	false
SSDEEP:	24576:+20deSdhsNk795wZ08KxwK29H7hfnn3MQYa:+20ddsy95WKxwKQnc2
MD5:	2D1F8BF06610A54B8A61894239012C3B
SHA1:	98BA3AEC7A32B6BCB264B51364A0A8A664E4FE82
SHA-256:	8FAFAB1032577F2EDC583C676A9BBFEECF929B5BE22950183C9A77BC2123798B
SHA-512:	AE9DB2DEA48BFC54274975306FA98921882EA43A590DCF60733B964253C3E9D97BE9CC97F45F18ECCB65802C0EC4599BAFBFF781FE635D6364BD0B657C95655E
Malicious:	false
Preview:	..]r.U..x..F.q...aI..`vkqqNsSLg..b..F.Iq`..o`y.gm.N._a.lJF.D\FpNm.RRYR.b.to.r.mhG.x.._...F.f.WO.nH..l.ldPH.[m..h..r..YX..mq....i.Q....F....H.m..r...N.JY\k.`T..nLx].oqf..........b.hV.m.TWicY.dpV....IE.d.Tjs.^tS..CUW..F....\......r.yrs.C.I.Xcql..c.....qe.K..T.^..q.i.B.NV_...gk..ACuS..n..]..g.O.yX.....u.J^dPj.g.mHP....E]B..h...HtjI.M\.^.cs.H...q...........p.x^..urE...C`..K..h...`i.M.H...^.Pt..S..p...Y.TP...E.M....\...k.S.m.Hu...Q.....juxX.s.gUG..wrAT[.gc..H...V....j.h.kL...Kgd[bMW...EKa.h..jw....D........F..qFC..Q.HFS.Z.L.....h.B.r...`.xqZ..O.bK.I_kEChAWH`.K..b.kqG.k..cw.i..x...d.yC.....R...^[]]\JD.u\v.HM.....p.a.y]ugLa..Dc.f.MSa[^.sV.Z.hWdD..nRr.V..D.h.Zx.D....O.guI]W.f.].qw.y.UPyO..T.Em.eV..p.^L.j.lPh....jMY.g.Vf.K.YHp[grw.kbx..T.V.]SQm..Eg.\...^q...u.gTh..w..wJ...a.bc..b.....gQo..TtjB.TU....eA..QY....V...uf..B.\oh.w.J.D..R.....x..[_.m..wMD.c.Er.D..E_f...Cm.HX].CKb....E..S...H..Dj.d...kNa.^F...s.teH..w......w......Q.i.d.XD..n..S...u....M.OS.....M...rS.E.G.h.R.\U.N.ASoEw.a.B...O`..DO.Ck.

C:\Users\user\AppData\Roaming\linkinfo\gymnasium.m4a

Download File

Process:	C:\Program Files\FastestVPN\Resources\ComDebug.exe
File Type:	data
Category:	dropped
Size (bytes):	63258
Entropy (8bit):	4.638400083452387
Encrypted:	false
SSDEEP:	1536:PcJillRMp5RLRYkKJdcmFT38Q9aSePEUX5:PcJiDRMD9YdtePz5
MD5:	127A512367895E269AD9922079C47761
SHA1:	7444878FEF13B7B4FCBE57D2DB2C527A34CA48C5
SHA-256:	E841508B1B3D7615F17E691334ECB6B1A7F7A83BC531BFF272E85F048AA3DDFD
SHA-512:	90E486FA09945BCCBD24542C31F832BEC4AA6EAE7D7A1522526018D0AC38CE855F545E1AB7AEFA1B6F7D78E6F0C8333A607E8A9BF1DCFA74E9E4F3B113AFD15F
Malicious:	false
Preview:	.c.jPxZ...PF...L.f.Ih..t...[.....O...O.o..l...Y.u.....mZ^P...u.v.l...E...W....f.....d.u...M.J.Nyd.i....uH.o.Jid.E..^..x..x.Z..kfmuexCyd.RD._Cm...]G....jwcu.q[.xx..Vj.bsRP.lh...t..j..s...f.ZgNgGc.....Rdk.sHK..q[jD.S.f.i.aZWv..F.O.tp...Zs.n..S..o..be.....d.^Xe..QpnXhy^..eVU..qwe_...[MZ..MTbS.j..n..u..]y.u.t..J.rcm..`e.y...IF..N\..Wt..uOE.dQ..^b..ksh.q..p.U..aLW.EfqS.H.Lm.p.OA..Sa...EY.vUbN.D.V..KqdWL....pE..Enuj.RG.`.R.s....mV.W.i...nc.a.^.m...hg...a...FGX..J...E`....\Z...U...Q....II..xk.]L.mX]........W.F.X.k.f..^M[.....y.Oj.h.eOk_Dj..QRT..SK`.T..G^..n.t..\N..CR.l...G..p..r..V..NoUZVJH.ld..Y.h..jVT.n..S..poIbY.X`.F.mp.BoZ.rW..Wo..b.TI.].RmK.pY..^..F..gRc..q....v..WGn.......C]g...Qh..\Mq..._.....kXB..HV.I]...D.ZIDW[...K.A..H.Pt..O....xJtu......J....^o..J.....WWY..L.VE........b.....[..oA_.n.ac...MKn..W.Q.maX........s..s..c[...Ij....Mu.ux...tPT.\.[..F..gpAH..mA...U..N...mE..y.\..q.C.gG..o..Kms.LL.P\.....cPDD.g.Y.rJZ.aF.iTA....].S.NL.r...l..]...n.`.]`..G^QQuPhO.DL.k.S_y.hD._..sour.i.wfg..`yI

C:\Users\user\AppData\Roaming\linkinfo\screen_retriever_plugin.dll

Download File

Process:	C:\Program Files\FastestVPN\Resources\ComDebug.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	545680
Entropy (8bit):	6.371479071684404
Encrypted:	false
SSDEEP:	12288:8xqABhfuM6KsuJPR9K+EvLHhDcsgsEO5CllKDh/eF4:8xqDM9+lHNcsgACllKDh/eF4
MD5:	2D885495E81A8B8D1D5305FE20566484
SHA1:	F1D2083D399DD48927CBD83E23F90AD3CE3E0632
SHA-256:	EB2E18881DDD80A3E54527264B3E7C5046F15854A196B76CCAD28E8258F3F1B2
SHA-512:	E2BB9F8E377B381CC13538B39E8B3FB749341FCEF84E7B26749BF35141C6C52A48636BB00C6FA7C585EEC4C01B03CD0EC38C8F3E85E0CA2C2CDA26D026DEF326
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......Do!O..O...O...O..~L...O..~J...O..~K...O..L...O..K...O..J.K.O..~N...O..rN...O...N.y.O...J...O...O...O.......O...M...O.Rich..O.........................PE..d...\|.wf.........." ...(.&...&......................................................$D....`.............................................\|.......P....p....... ..TB...8..........P...p........................ ..(...0...@............@...............................text...P$.......&.................. ..`.rdata.......@.....................@..@.data...tA.........................@....pdata..TB... ...D..................@..@.rsrc........p.......&..............@..@.reloc..P............(..............@..B........................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\linkinfo\texture_rgba_renderer_plugin.dll

Download File

Process:	C:\Program Files\FastestVPN\Resources\ComDebug.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	323472
Entropy (8bit):	6.260791393809843
Encrypted:	false
SSDEEP:	6144:xadPqy3/nKyWFZS3PCmxiVvUTiJ+1I2hWHlHTkPXdxs4:wqyAA3PCmwV8i41I2gHlHTkvdW4
MD5:	128D06B8C5739F35A7C76A76BF1E6149
SHA1:	901F9698BF4C4A10E8E902E6DBDDF1782E1067D0
SHA-256:	BF585DBC4E4DCE47F9EFDEEAD15F67A69644CE6F1177CEEC518882DC85ECC096
SHA-512:	ECE9254486347751D6F68AE86AFB36508FED81B00C4588F555DB584A0E9DE5F4710A24E6BB5B2B19A25BEE20AA4BF90068F9EB2E37B48271614B6C97199E419C
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........x.........................Y...........>w......>w......>w..............<...........u....p.......p.......p......p......Rich............................PE..d...Y.wf.........." ...(.............5....................................... ............`..........................................t......0u..<...............L/..................P...........................(.......@............@..P............................text...0,.......................... ..`.rdata...B...@...D...2..............@..@.data...X6....... ...v..............@....pdata..L/.......0..................@..@.rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\linkinfo\uni_links_desktop_plugin.dll

Download File

Process:	C:\Program Files\FastestVPN\Resources\ComDebug.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	543632
Entropy (8bit):	6.3781262731970685
Encrypted:	false
SSDEEP:	12288:zqzF5VH24Jy+0PeZOYbxobw+QY0heC9lVNLETyoK:zqh32SRoc+QY0n9lVNLETbK
MD5:	94267176E212B8EBFF06728CC6C3F432
SHA1:	F65313083C2B3177F405B7AB884BA0A9BE3251D9
SHA-256:	08D08CBFA4D5531CEEE16BFCB2255EDA79C5B7F7C0894C4E6F49F673457AB362
SHA-512:	014459C9D3DBE7C09E0D6DB085CE9F715248BA6D784845339B2D6896A8BA7B680C93E707D4990350E30C8853A95FD0DC6F8E9244643787DB65AB8A2F95C26967
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........W..6..6..6..XF..6..XF...6..XF..6......6......6.......6..XF..6..}J..6..6...6.....6.....6...O.6.....6..Rich.6..........PE..d...~.wf.........." ...(.....4......L.....................................................`.........................................p...........d....p....... ...B...0..........................................(...p...@............0...............................text............................... ..`.rdata.......0......................@..@.data....J.......2..................@....pdata...B... ...D..................@..@.rsrc........p......................@..@.reloc............... ..............@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\linkinfo\url_launcher_windows_plugin.dll

Download File

Process:	C:\Program Files\FastestVPN\Resources\ComDebug.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	323472
Entropy (8bit):	6.24323878406639
Encrypted:	false
SSDEEP:	6144:aK/qrBUA8kikYQQ2sXvNnot1bdNtb1lHSdrkjoE:a8qC5kikpQX1ny1bdv1lHSdYjoE
MD5:	BFEC2012B6589D4496EA0283E90A5269
SHA1:	813E3FAD5CFE4A30E20F05080D106811C5544FA3
SHA-256:	F9406ECAA9C86F2946F8B9D997F0210F1F5EE974BE6548D1DB039014D1B45552
SHA-512:	396F28EB15ED793DB453CD3B3E9118F4386FE24A75E3F3914E881CCA3ADA8918B98751BDAC51C4A5E897CCA1E700B2A545686463A6B0DD6719EA172682CFB928
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......`&..$Gt.$Gt.$Gt..7w.!Gt..7q.Gt..7p.4Gt...w..Gt...p.Gt...q.iGt..7u."Gt..;u.'Gt.$Gu.\Gt.7.q.#Gt.7.t.%Gt.7..%Gt.7.v.%Gt.Rich$Gt.........PE..d...^.wf.........." ...(.................................................... .......7....`.........................................@x..\|....x..d...............P...............................................(.......@............@..x............................text...@).......*.................. ..`.rdata...F...@...H..................@..@.data....6....... ...v..............@....pdata..P........0..................@..@.rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\linkinfo\window_manager_plugin.dll

Download File

Process:	C:\Program Files\FastestVPN\Resources\ComDebug.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	589712
Entropy (8bit):	6.371606969587959
Encrypted:	false
SSDEEP:	12288:Qnu0YqCbnvh0xDqjFR0NdzhdkPJZIR0vnrXkcc9VNLqYWTF:Qu0YqInZCD7mZI0vnrPc9VNLqYWB
MD5:	EAB165F7A1856FC4FC191416A26F20F3
SHA1:	3E3BAAA9A8AE20680D4B347A3A65E4A388DC0F4D
SHA-256:	A2C87DFE4D43C7CC8AC44F2AC43BD45EC4F3F6BA87A2C73AE8B55F26286600E9
SHA-512:	897E0F107BEB1FCC6402183C535F2550E954B379451415E8B40403D0575EFA6E1D1373F9F0B9A0649AB09515259490C7BFB9E9926F76735EE513F68460FB5143
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........:q..T"..T"..T"..W#..T"..Q#W.T"7MW#..T"7MP#..T"7MQ#..T"..P#..T"..U#..T"5.U#..T"..U"T.T".JQ#..T".JT#..T".J."..T".JV#..T"Rich..T"................PE..d.....wf.........." ...(.....P.......8.......................................@............`..........................................\..x...8]....... ..........tF...........0......@...........................(.......@............................................text............................... ..`.rdata..2...........................@..@.data....C.......,...^..............@....pdata..tF.......H..................@..@.rsrc........ ......................@..@.reloc.......0......................@..B................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\linkinfo\window_size_plugin.dll

Download File

Process:	C:\Program Files\FastestVPN\Resources\ComDebug.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	539536
Entropy (8bit):	6.374120901700144
Encrypted:	false
SSDEEP:	12288:F2qV/eGvVJVbhqs7MRkPXpaCLz9gS+f/9VNtP8zC:F2q9rVJeMp1Lz9gj/9VNtP8zC
MD5:	7024D49DF9315B5718F40FCD29A8656F
SHA1:	EF243D1EC09F2FB714459D596F40A87B5B51C054
SHA-256:	51877E41297AE94FE33D01D980717AE18938A3E81A32C57ADC77D754EF7E66BE
SHA-512:	D9B7661B923B45020641F80A4695079A86F92848A022C8374C9339258A3F63D628000628CF75163B7C707A8506BB4D4928A1EA75E09FA6416EB9A2150EB5B705
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........k....m...m...m..zn...m..zh._.m..zi...m.?.n...m.?.i...m.?.h...m..zl...m.=vl...m...l.}.m..h...m..m...m.....m..o...m.Rich..m.........................PE..d...`.wf.........." ...(.....&......<........................................p.......N....`.........................................P...p.......P....P..........<B... .......`..\...P...........................(.......@............ ...............................text............................... ..`.rdata..,.... ......................@..@.data....B.......*..................@....pdata..<B.......D..................@..@.rsrc........P......................@..@.reloc..\....`......................@..B........................................................................................................................................................................................................................

C:\Windows\INF\oem4.inf

Download File

Process:	C:\Windows\System32\drvinst.exe
File Type:	Windows setup INFormation
Category:	dropped
Size (bytes):	7537
Entropy (8bit):	5.046488463217706
Encrypted:	false
SSDEEP:	192:wr8tW9yCTi3K4vlQd22bjR+iAUC7bdP+io3DcNSj6jvKFkinuEQTXvzLd4Z:LWlGMdkxzo3DcNSj6jvKFkinuEQTXvzq
MD5:	50D29CA2E3DDB8A696923420EC2AC4FA
SHA1:	D85F4E65FE10F13DED1780DDBD074EDFC75F2D25
SHA-256:	817DFF7F4944A255A0A33B8D74EB60A755D8D268CC7AFD46FCE41E102E0A004B
SHA-512:	03778A9CDDD23639C88E24BB5D0446DA3A400BB6B3321FB35887CD23D88D0F7AD3FE911642CC7F8D16D29CD9E42106851B0028379E8DBCB3C6721C238FC4A0D3
Malicious:	false
Preview:	; ***************************************************************************..; Copyright (C) 2002-2014 OpenVPN Technologies, Inc. ..; This program is free software; you can redistribute it and/or modify ..; it under the terms of the GNU General Public License version 2 ..; as published by the Free Software Foundation. ..; *************************************************************************....; SYNTAX CHECKER..; cd \WINDDK\3790\tools\chkinf..; chkinf c:\src\openvpn\tap-win32\i386\oemvista.inf..; OUTPUT -> file:///c:/WINDDK/3790/tools/chkinf/htm/c%23+src+openvpn+tap-win32+i386+__OemWin2k.htm....; INSTALL/REMOVE DRIVER..; tapinstall install OemVista.inf tapoas..; tapinstall update OemVista.inf tapoas..; tapinstall remove tapoas....;*******************************************************..; Note to Developers:..;..; If you are bundling the TAP-Windows driver with your app,..; you should try

C:\Windows\INF\setupapi.dev.log

Download File

Process:	C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exe
File Type:	Generic INItialization configuration [BeginLog]
Category:	dropped
Size (bytes):	58713
Entropy (8bit):	5.206566591601887
Encrypted:	false
SSDEEP:	384:OGdni80C/8g0atRf7yr14ujuNY9AZi3Z/oUtwrP3UQGSE254VkWe/DnJL6zsf4P6:Own95cdyYloiwTyz25nUshj
MD5:	60552CCBEDF0DB88B21D29A4FCB27D7F
SHA1:	834DC74C2EB26EC5AEB5447465A9A8F58D27082E
SHA-256:	6830C732628CCCA1487A2D5A02BDEAB20DB6178F05FD2BFD80A3667354D429AA
SHA-512:	6B83B359B6B6D57948E725905E38FCAF6A5881B226E05C3BC4D2CCF9B84F461C92C6C78A641987B39C1165A2D1F998229E48333E24DE4F3FB83545FFE50594B9
Malicious:	false
Preview:	[Device Install Log].. OS Version = 10.0.19045.. Service Pack = 0.0.. Suite = 0x0100.. ProductType = 1.. Architecture = amd64....[BeginLog]....[Boot Session: 2023/10/03 09:57:02.288]....>>> [Setup Import Driver Package - C:\Windows\system32\spool\tools\Microsoft Print To PDF\prnms009.Inf]..>>> Section start 2023/10/03 09:57:37.904.. cmd: C:\Windows\System32\spoolsv.exe.. inf: Provider: Microsoft.. inf: Class GUID: {4D36E979-E325-11CE-BFC1-08002BE10318}.. inf: Driver Version: 06/21/2006,10.0.19041.1806.. inf: Catalog File: prnms009.cat.. ump: Import flags: 0x0000000D.. pol: {Driver package policy check} 09:57:37.920.. pol: {Driver package policy check - exit(0x00000000)} 09:57:37.920.. sto: {Stage Driver Package: C:\Windows\system32\spool\tools\Microsoft Print To PDF\prnms009.Inf} 09:57:37.920.. inf: {Query Configurability: C:\Windows\system32\spool\tools\Microsoft Print To PDF\prnms009.Inf} 09:57:37.920.. inf:

C:\Windows\Logs\NetSetup\service.0.etl

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	524288
Entropy (8bit):	0.42451526077131835
Encrypted:	false
SSDEEP:	192:IL/zm8DmT1xMS92sICkjd0x5AUko5HOLboAcKYzFlgbmCcs8m:IL/ZM7mjhRoZO/oAPRIm
MD5:	2BC3848BBB6892617503C92520EB9184
SHA1:	532900C958CD40D3E3EFE1E26C76FB1A6DF2349C
SHA-256:	68DC35609AA81E0E278FF93EEBAF206BD7681DDD7A0DAF03287D640773DD56DE
SHA-512:	5EC4281BBA43A83D63B4CEC206104B0D188E5432030BF27FF456F3A3C6068CCF3DDAA582F71A56C6DD8418F3B7241753454D274BDDAAC79A1A3C795DE18B18DD
Malicious:	false
Preview:	....8...8...........................................!....................................?......................eJ......Z.`n...Zb..................................................@.t.z.r.e.s...d.l.l.,.-.2.6.2.......................................................@.t.z.r.e.s...d.l.l.,.-.2.6.1...........................................................@K5..............?..............N.e.t.C.f.g.T.r.a.c.e...C.:.\.W.i.n.d.o.w.s.\.L.o.g.s.\.N.e.t.S.e.t.u.p.\.s.e.r.v.i.c.e...0...e.t.l.........P.P..........?..................................................................8.B..?......19041.1.amd64fre.vb_release.191206-1406.....7.@..?.......I.[.8+m.!N8$......NetSetupEngine.pdb......4.@..?.........>*.....Nr8..a....NetSetupApi.pdb.db......4.@..?.........E_iC...F........NetSetupSvc.pdb.........4.@..?.........E_iC...F........NetSetupSvc.pdb.............................................................................................................................................................

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

C:\Windows\System32\DriverStore\Temp\{3501cea1-1def-284d-aeaa-53ba66ad3796}\SET989A.tmp

Download File

Process:	C:\Windows\System32\drvinst.exe
File Type:	Windows setup INFormation
Category:	dropped
Size (bytes):	7537
Entropy (8bit):	5.046488463217706
Encrypted:	false
SSDEEP:	192:wr8tW9yCTi3K4vlQd22bjR+iAUC7bdP+io3DcNSj6jvKFkinuEQTXvzLd4Z:LWlGMdkxzo3DcNSj6jvKFkinuEQTXvzq
MD5:	50D29CA2E3DDB8A696923420EC2AC4FA
SHA1:	D85F4E65FE10F13DED1780DDBD074EDFC75F2D25
SHA-256:	817DFF7F4944A255A0A33B8D74EB60A755D8D268CC7AFD46FCE41E102E0A004B
SHA-512:	03778A9CDDD23639C88E24BB5D0446DA3A400BB6B3321FB35887CD23D88D0F7AD3FE911642CC7F8D16D29CD9E42106851B0028379E8DBCB3C6721C238FC4A0D3
Malicious:	false
Preview:	; ***************************************************************************..; Copyright (C) 2002-2014 OpenVPN Technologies, Inc. ..; This program is free software; you can redistribute it and/or modify ..; it under the terms of the GNU General Public License version 2 ..; as published by the Free Software Foundation. ..; *************************************************************************....; SYNTAX CHECKER..; cd \WINDDK\3790\tools\chkinf..; chkinf c:\src\openvpn\tap-win32\i386\oemvista.inf..; OUTPUT -> file:///c:/WINDDK/3790/tools/chkinf/htm/c%23+src+openvpn+tap-win32+i386+__OemWin2k.htm....; INSTALL/REMOVE DRIVER..; tapinstall install OemVista.inf tapoas..; tapinstall update OemVista.inf tapoas..; tapinstall remove tapoas....;*******************************************************..; Note to Developers:..;..; If you are bundling the TAP-Windows driver with your app,..; you should try

C:\Windows\System32\DriverStore\Temp\{3501cea1-1def-284d-aeaa-53ba66ad3796}\SET98AB.tmp

Download File

Process:	C:\Windows\System32\drvinst.exe
File Type:	data
Category:	dropped
Size (bytes):	10711
Entropy (8bit):	7.2254581318251425
Encrypted:	false
SSDEEP:	192:PqDhDNF748XJCO39JnxrEwJqKkhYCxXA6qnaj/rHr:OXPJxXxkh3xXhlzX
MD5:	225E7BA0E5E2D46813E5C858A4D0D5B0
SHA1:	5DD49014764F634164520583FD0CEC87AB1A1625
SHA-256:	B0BAF5CB84FA4ACB34B77A6231052061DA6B8676D216833724B7A602622161FB
SHA-512:	9C77ADF7E71ACA94489DFEB536F796A017B7C05771962274BAE2C614E2AE6799CCEB36CC58AC470184C37F52DEAC75988BB14E6A329F432C6D7CEDBCA18272A8
Malicious:	false
Preview:	0.)....H........).0.)....1.0...`.H.e......0..M..+.....7.....>0..:0...+.....7..........dG.'$....g..191023085812Z0...+.....7.....0..T0.... .}..ID.U..;.t.`.U..h.z.F.......K1..0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.:.1.0...0...0<..+.....7...1.0,...F.i.l.e........o.e.m.v.i.s.t.a...i.n.f...0U..+.....7...1G0E0...+.....7.......010...`.H.e....... .}..ID.U..;.t.`.U..h.z.F.......K0....._Ne...=.....N.._-%1..0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.:.1.0...0...0<..+.....7...1.0,...F.i.l.e........o.e.m.v.i.s.t.a...i.n.f...0.....D.......L..S.4..b.1..0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.:.1.0...0...0:..+.....7...1,0...F.i.l.e........t.a.p.0.9.0.1...s.y.s...0.... .?;..{.x....H..4...k).VB.......1..0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.:.1.0...0...0:..+.....7...1,0*...F.i.l.e........t.a.p.0.9.0.1...s.y.s...0]..+.....7...1O0M0...+.....7...0...........010...`.H.e....... .?;..{.x....H..4...k).VB...........0...0....+.

C:\Windows\System32\DriverStore\Temp\{3501cea1-1def-284d-aeaa-53ba66ad3796}\SET98BB.tmp

Download File

Process:	C:\Windows\System32\drvinst.exe
File Type:	PE32+ executable (native) x86-64, for MS Windows
Category:	dropped
Size (bytes):	39920
Entropy (8bit):	6.333649052940754
Encrypted:	false
SSDEEP:	768:bCxLEO/+ApBG35KBOXZZoZmTD11a+uiExMFYQjdJxh63NOe:tCI46F1a+jExMFFjzv69
MD5:	059E578D456043A8C3B76EC365B375F3
SHA1:	42189B6A1B8C736397113BFC2283F5E1E1A44E8E
SHA-256:	A0170CF78105CE757E0549D79E4AE7C412240E8B81D262A24D76A047F181F881
SHA-512:	99E6B6AF018D0E3509D9DBE00301A7D5D6645A2070A8144ACFF04842F8BBACCD81E7651578D08F47639CD2B7D00EB64ACDDFA8725BCE9A073580B7FCF7964E6A
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........~..[...[...[....w..Z....w..^...[...m....w.._....w..^.../t..Q.../t..Z.../t..Z...Rich[...........................PE..d......].........."......Z.....................@....................................P.....`A....................................................<.......X....p..H....x...#...........R..8............................S...............P...............................text...W>.......@.................. ..h.rdata..\|....P.......D..............@..H.data........`.......P..............@....pdata..H....p.......R..............@..HPAGE.................V.............. ..`INIT.................d.............. ..b.rsrc...X............p..............@..B.reloc...............v..............@..B................................................................................................................................................................................

C:\Windows\System32\DriverStore\Temp\{3501cea1-1def-284d-aeaa-53ba66ad3796}\oemvista.inf (copy)

Download File

Process:	C:\Windows\System32\drvinst.exe
File Type:	Windows setup INFormation
Category:	dropped
Size (bytes):	7537
Entropy (8bit):	5.046488463217706
Encrypted:	false
SSDEEP:	192:wr8tW9yCTi3K4vlQd22bjR+iAUC7bdP+io3DcNSj6jvKFkinuEQTXvzLd4Z:LWlGMdkxzo3DcNSj6jvKFkinuEQTXvzq
MD5:	50D29CA2E3DDB8A696923420EC2AC4FA
SHA1:	D85F4E65FE10F13DED1780DDBD074EDFC75F2D25
SHA-256:	817DFF7F4944A255A0A33B8D74EB60A755D8D268CC7AFD46FCE41E102E0A004B
SHA-512:	03778A9CDDD23639C88E24BB5D0446DA3A400BB6B3321FB35887CD23D88D0F7AD3FE911642CC7F8D16D29CD9E42106851B0028379E8DBCB3C6721C238FC4A0D3
Malicious:	false
Preview:	; ***************************************************************************..; Copyright (C) 2002-2014 OpenVPN Technologies, Inc. ..; This program is free software; you can redistribute it and/or modify ..; it under the terms of the GNU General Public License version 2 ..; as published by the Free Software Foundation. ..; *************************************************************************....; SYNTAX CHECKER..; cd \WINDDK\3790\tools\chkinf..; chkinf c:\src\openvpn\tap-win32\i386\oemvista.inf..; OUTPUT -> file:///c:/WINDDK/3790/tools/chkinf/htm/c%23+src+openvpn+tap-win32+i386+__OemWin2k.htm....; INSTALL/REMOVE DRIVER..; tapinstall install OemVista.inf tapoas..; tapinstall update OemVista.inf tapoas..; tapinstall remove tapoas....;*******************************************************..; Note to Developers:..;..; If you are bundling the TAP-Windows driver with your app,..; you should try

C:\Windows\System32\DriverStore\Temp\{3501cea1-1def-284d-aeaa-53ba66ad3796}\tap0901.cat (copy)

Download File

Process:	C:\Windows\System32\drvinst.exe
File Type:	data
Category:	dropped
Size (bytes):	10711
Entropy (8bit):	7.2254581318251425
Encrypted:	false
SSDEEP:	192:PqDhDNF748XJCO39JnxrEwJqKkhYCxXA6qnaj/rHr:OXPJxXxkh3xXhlzX
MD5:	225E7BA0E5E2D46813E5C858A4D0D5B0
SHA1:	5DD49014764F634164520583FD0CEC87AB1A1625
SHA-256:	B0BAF5CB84FA4ACB34B77A6231052061DA6B8676D216833724B7A602622161FB
SHA-512:	9C77ADF7E71ACA94489DFEB536F796A017B7C05771962274BAE2C614E2AE6799CCEB36CC58AC470184C37F52DEAC75988BB14E6A329F432C6D7CEDBCA18272A8
Malicious:	false
Preview:	0.)....H........).0.)....1.0...`.H.e......0..M..+.....7.....>0..:0...+.....7..........dG.'$....g..191023085812Z0...+.....7.....0..T0.... .}..ID.U..;.t.`.U..h.z.F.......K1..0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.:.1.0...0...0<..+.....7...1.0,...F.i.l.e........o.e.m.v.i.s.t.a...i.n.f...0U..+.....7...1G0E0...+.....7.......010...`.H.e....... .}..ID.U..;.t.`.U..h.z.F.......K0....._Ne...=.....N.._-%1..0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.:.1.0...0...0<..+.....7...1.0,...F.i.l.e........o.e.m.v.i.s.t.a...i.n.f...0.....D.......L..S.4..b.1..0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.:.1.0...0...0:..+.....7...1,0...F.i.l.e........t.a.p.0.9.0.1...s.y.s...0.... .?;..{.x....H..4...k).VB.......1..0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.:.1.0...0...0:..+.....7...1,0*...F.i.l.e........t.a.p.0.9.0.1...s.y.s...0]..+.....7...1O0M0...+.....7...0...........010...`.H.e....... .?;..{.x....H..4...k).VB...........0...0....+.

C:\Windows\System32\DriverStore\Temp\{3501cea1-1def-284d-aeaa-53ba66ad3796}\tap0901.sys (copy)

Download File

Process:	C:\Windows\System32\drvinst.exe
File Type:	PE32+ executable (native) x86-64, for MS Windows
Category:	dropped
Size (bytes):	39920
Entropy (8bit):	6.333649052940754
Encrypted:	false
SSDEEP:	768:bCxLEO/+ApBG35KBOXZZoZmTD11a+uiExMFYQjdJxh63NOe:tCI46F1a+jExMFFjzv69
MD5:	059E578D456043A8C3B76EC365B375F3
SHA1:	42189B6A1B8C736397113BFC2283F5E1E1A44E8E
SHA-256:	A0170CF78105CE757E0549D79E4AE7C412240E8B81D262A24D76A047F181F881
SHA-512:	99E6B6AF018D0E3509D9DBE00301A7D5D6645A2070A8144ACFF04842F8BBACCD81E7651578D08F47639CD2B7D00EB64ACDDFA8725BCE9A073580B7FCF7964E6A
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........~..[...[...[....w..Z....w..^...[...m....w.._....w..^.../t..Q.../t..Z.../t..Z...Rich[...........................PE..d......].........."......Z.....................@....................................P.....`A....................................................<.......X....p..H....x...#...........R..8............................S...............P...............................text...W>.......@.................. ..h.rdata..\|....P.......D..............@..H.data........`.......P..............@....pdata..H....p.......R..............@..HPAGE.................V.............. ..`INIT.................d.............. ..b.rsrc...X............p..............@..B.reloc...............v..............@..B................................................................................................................................................................................

C:\Windows\System32\catroot2\dberr.txt

Download File

Process:	C:\Windows\System32\drvinst.exe
File Type:	ASCII text, with CRLF line terminators
Category:	modified
Size (bytes):	3475
Entropy (8bit):	5.365338168673359
Encrypted:	false
SSDEEP:	96:QO00eO00erMwUgWUg0B1kE3ZhpJp8ZpkRepk3YpgpNN:QO00eO00erMwmkB1kAv
MD5:	C62C0D54B65581B27C052572D9C54CCD
SHA1:	3C314F8D1DD9DDFCEA383C730317DAC7CC461322
SHA-256:	2C3B67034457A4C188802FFD0D39F05B425417E306027061DEC2FA8118F72581
SHA-512:	261B5BAF63FCED8457B11091F3636F6F93CBF9DFBBD8669ED7EA4E33A3A5D6CF012DA81DD6F26E2A9F69DDC0B7C3FF97D8EF05EDD5173B2B7457D1963CF6D613
Malicious:	false
Preview:	CatalogDB: 08:57:12 03/10/2023: catdbsvc.cpp at line #6041 encountered JET error -1409..CatalogDB: 08:57:12 03/10/2023: catdbsvc.cpp at line #6699 encountered JET error -1409..CatalogDB: 08:57:12 03/10/2023: catdbsvc.cpp at line #4398 encountered JET error -1409..CatalogDB: 08:57:12 03/10/2023: catdbsvc.cpp at line #6041 encountered JET error -1409..CatalogDB: 08:57:12 03/10/2023: catdbsvc.cpp at line #6699 encountered JET error -1409..CatalogDB: 08:57:12 03/10/2023: catdbsvc.cpp at line #4398 encountered JET error -1409..CatalogDB: 08:57:12 03/10/2023: catdbsvc.cpp at line #2083 encountered JET error -1409..CatalogDB: 08:57:12 03/10/2023: catdbsvc.cpp at line #2459 encountered JET error -1409..CatalogDB: 08:57:12 03/10/2023: SyncAllDBs Corruption or Schema Change..CatalogDB: 08:57:12 03/10/2023: catdbsvc.cpp at line #891 encountered JET error -1409..CatalogDB: 08:57:12 03/10/2023: catdbsvc.cpp at line #1307 encountered JET error -1601..CatalogDB: 08:57:12 03/10/2023: SyncDB:: Sync sta

C:\Windows\System32\drivers\SET9DE9.tmp

Download File

Process:	C:\Windows\System32\drvinst.exe
File Type:	PE32+ executable (native) x86-64, for MS Windows
Category:	dropped
Size (bytes):	39920
Entropy (8bit):	6.333649052940754
Encrypted:	false
SSDEEP:	768:bCxLEO/+ApBG35KBOXZZoZmTD11a+uiExMFYQjdJxh63NOe:tCI46F1a+jExMFFjzv69
MD5:	059E578D456043A8C3B76EC365B375F3
SHA1:	42189B6A1B8C736397113BFC2283F5E1E1A44E8E
SHA-256:	A0170CF78105CE757E0549D79E4AE7C412240E8B81D262A24D76A047F181F881
SHA-512:	99E6B6AF018D0E3509D9DBE00301A7D5D6645A2070A8144ACFF04842F8BBACCD81E7651578D08F47639CD2B7D00EB64ACDDFA8725BCE9A073580B7FCF7964E6A
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........~..[...[...[....w..Z....w..^...[...m....w.._....w..^.../t..Q.../t..Z.../t..Z...Rich[...........................PE..d......].........."......Z.....................@....................................P.....`A....................................................<.......X....p..H....x...#...........R..8............................S...............P...............................text...W>.......@.................. ..h.rdata..\|....P.......D..............@..H.data........`.......P..............@....pdata..H....p.......R..............@..HPAGE.................V.............. ..`INIT.................d.............. ..b.rsrc...X............p..............@..B.reloc...............v..............@..B................................................................................................................................................................................

C:\Windows\System32\drivers\fastestvpndriver.sys

Download File

Process:	C:\Windows\System32\xcopy.exe
File Type:	PE32+ executable (native) x86-64, for MS Windows
Category:	dropped
Size (bytes):	104424
Entropy (8bit):	6.366713641084616
Encrypted:	false
SSDEEP:	1536:Y79hJ78bsmPOC5lhtb5FGNk4wZO+cWK4orE3HazVvon6BK2s6th:YpL78XPOCN1GeOUKdebIKfS
MD5:	95FD4F27F82A9E4D6E2A53AF7A9096E6
SHA1:	5F772C89901841AF1814C858359AC5FEB9BE3C24
SHA-256:	98CD2F27906E4FD7FA7FBE0EC747BADEF710BCA736A1AC5EE883756F2185818C
SHA-512:	6B2E2BA90B33F6658C903203317299057C83545D46549D468CDAA1D6F7BCE887310411B9BF6EEA9D19C214A2041BB5E14FD9395CC4E2FE9FC31AB03B88A75019
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......>.d.z...z...z.....~...z.........}.....}...Y@..s....A..{....A..{...Richz...........................PE..d... [.\.........."..........L.................@....................................C.....`.................................................8p..P.......H....`.......R...E..........`#..8............................(..p............ ..`............................text...d........................... ..h.rdata....... ......................@..H.data...@....@.......$..............@....pdata.......`.......,..............@..HINIT.........p.......:.............. ....rsrc...H............J..............@..B.reloc...............P..............@..B................................................................................................................................................................................................................................

C:\Windows\System32\drivers\tap0901.sys (copy)

Download File

Process:	C:\Windows\System32\drvinst.exe
File Type:	PE32+ executable (native) x86-64, for MS Windows
Category:	dropped
Size (bytes):	39920
Entropy (8bit):	6.333649052940754
Encrypted:	false
SSDEEP:	768:bCxLEO/+ApBG35KBOXZZoZmTD11a+uiExMFYQjdJxh63NOe:tCI46F1a+jExMFFjzv69
MD5:	059E578D456043A8C3B76EC365B375F3
SHA1:	42189B6A1B8C736397113BFC2283F5E1E1A44E8E
SHA-256:	A0170CF78105CE757E0549D79E4AE7C412240E8B81D262A24D76A047F181F881
SHA-512:	99E6B6AF018D0E3509D9DBE00301A7D5D6645A2070A8144ACFF04842F8BBACCD81E7651578D08F47639CD2B7D00EB64ACDDFA8725BCE9A073580B7FCF7964E6A
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........~..[...[...[....w..Z....w..^...[...m....w.._....w..^.../t..Q.../t..Z.../t..Z...Rich[...........................PE..d......].........."......Z.....................@....................................P.....`A....................................................<.......X....p..H....x...#...........R..8............................S...............P...............................text...W>.......@.................. ..h.rdata..\|....P.......D..............@..H.data........`.......P..............@....pdata..H....p.......R..............@..HPAGE.................V.............. ..`INIT.................d.............. ..b.rsrc...X............p..............@..B.reloc...............v..............@..B................................................................................................................................................................................

C:\Windows\appcompat\Programs\Amcache.hve

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	1835008
Entropy (8bit):	4.421845928266742
Encrypted:	false
SSDEEP:	6144:DSvfpi6ceLP/9skLmb0OTCWSPHaJG8nAgeMZMMhA2fX4WABlEnNp0uhiTw:OvloTCW+EZMM6DFyb03w
MD5:	3A3B3E3B66C8510FC3C2F8670EE728C7
SHA1:	CE2DC17217ACC2B9D887925D10D1BBA862975116
SHA-256:	7CAA29D6931326E5D6607A55EDB339E7B3447FDE1B008EB3E5162A04CE407174
SHA-512:	F7B72849988B0DB0F22896186D2D6881A8D137CBDBF38796C8A92DEFD9C0E563ABBD9ABECACC5E97EB49F4D72FFA46EA0254E14719AA7708AE2D52BA22772251
Malicious:	false
Preview:	regf>...>....\.Z.................... ...........\.A.p.p.C.o.m.p.a.t.\.P.r.o.g.r.a.m.s.\.A.m.c.a.c.h.e...h.v.e....c...b...#.......c...b...#...........c...b...#......rmtm..an..................................................................................................................................................................................................................................................................................................................................................U........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

\Device\ConDrv

Download File

Process:	C:\Program Files\FastestVPN\subinacl.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	133
Entropy (8bit):	4.004784065185313
Encrypted:	false
SSDEEP:	3:E8Hu/FvfVFcLaNKB4z/F/eAFFXx26LX/FFVbQAtbR91q:E2u/F8La3FGgy6L1bVDq
MD5:	CE8AE87D7F83FA032F2A60AB0B8F0FE4
SHA1:	203E8416D17D3A9E03509009A8F20F94C51C0381
SHA-256:	F3617B3A17F48864D33A4C32D4F9AE862B23E07F35504C8D4DBE79AC589D395D
SHA-512:	091E97EA19CCF4D6870F8EA861DCCC0F87E4928AC39C64A2AA1085C94EAE5F6707919A18FB3A56EE94F7483950F34128E7E8D321129F810C0847F3493F269682
Malicious:	false
Preview:	.Elapsed Time: 00 00:00:00.Done: 1, Modified 1, Failed 0, Syntax errors 0.Last Done : FastestVPNService.

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.993161668226584
TrID:	Win32 Executable (generic) a (10002005/4) 98.45% Inno Setup installer (109748/4) 1.08% Win32 EXE PECompact compressed (generic) (41571/9) 0.41% Win16/32 Executable Delphi generic (2074/23) 0.02% Generic Win/DOS Executable (2004/3) 0.02%
File name:	PVUfopbGfc.exe
File size:	21'250'384 bytes
MD5:	249ed615e8b43896fffd3cb3755c7a0a
SHA1:	1b28a72f6746ad76f7b25ab767ce7b775282fbeb
SHA256:	402aacbb8dc07d96733eee2292f709d89d65efbe82d55e0dd4b7764cdde287b5
SHA512:	6a08ab47a7bc99175b547bf74715f9ff95de4c4517cb734c7f1e0588de77edb2220bb229e4f253accdfe89a7ca13a956a7188feeb5f01d5587baee85da1cbbd7
SSDEEP:	393216:B6EKDC4ast7NVuy0G/ZDJG4x6gm+T8fIXno94qqgQYpS9R0W/LVuq1Z:kEKDCFe7MQJG4sgm+Tdoq6QY09Cu
TLSH:	31273323B2C7E03EF1592B7245B3906864F76E51A522BD538AF4A46CCF354621E3F70A
File Content Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7.......................................................................................................................................

File Icon


Icon Hash:	701e0760791c0641

Static PE Info

General

Entrypoint:	0x4a83bc
Entrypoint Section:	.itext
Digitally signed:	true
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Time Stamp:	0x666711EF [Mon Jun 10 14:47:11 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	1
File Version Major:	6
File Version Minor:	1
Subsystem Version Major:	6
Subsystem Version Minor:	1
Import Hash:	40ab50289f7ef5fae60801f88d4541fc

Authenticode Signature

Signature Valid:	true
Signature Issuer:	CN=SSL.com EV Code Signing Intermediate CA RSA R3, O=SSL Corp, L=Houston, S=Texas, C=US
Signature Validation Error:	The operation completed successfully
Error Number:	0
Not Before, Not After	15/01/2024 21:45:41 14/01/2025 21:45:41
Subject Chain	OID.1.3.6.1.4.1.311.60.2.1.3=CA, OID.2.5.4.15=Private Organization, CN=Acira Consulting Inc., SERIALNUMBER=987024-5, O=Acira Consulting Inc., L=Mississauga, S=Ontario, C=CA
Version:	3
Thumbprint MD5:	4C9BC68042EB932BDCEC05026258C237
Thumbprint SHA-1:	A70AB688FF0A7C3A22B030FBFFA8B56DC31F650A
Thumbprint SHA-256:	49EB14C9EFDE16BD0546A80F058C7D10871ADACFD3B550A4F7007080377DA3BA
Serial:	748A88467D46DF98B5246AFC4F5EEC64

Entrypoint Preview

Instruction
push ebp
mov ebp, esp
add esp, FFFFFFA4h
push ebx
push esi
push edi
xor eax, eax
mov dword ptr [ebp-3Ch], eax
mov dword ptr [ebp-40h], eax
mov dword ptr [ebp-5Ch], eax
mov dword ptr [ebp-30h], eax
mov dword ptr [ebp-38h], eax
mov dword ptr [ebp-34h], eax
mov dword ptr [ebp-2Ch], eax
mov dword ptr [ebp-28h], eax
mov dword ptr [ebp-14h], eax
mov eax, 004A2EBCh
call 00007FDAD5160065h
xor eax, eax
push ebp
push 004A8AC1h
push dword ptr fs:[eax]
mov dword ptr fs:[eax], esp
xor edx, edx
push ebp
push 004A8A7Bh
push dword ptr fs:[edx]
mov dword ptr fs:[edx], esp
mov eax, dword ptr [004B0634h]
call 00007FDAD51F19EBh
call 00007FDAD51F153Eh
lea edx, dword ptr [ebp-14h]
xor eax, eax
call 00007FDAD51EC218h
mov edx, dword ptr [ebp-14h]
mov eax, 004B41F4h
call 00007FDAD515A113h
push 00000002h
push 00000000h
push 00000001h
mov ecx, dword ptr [004B41F4h]
mov dl, 01h
mov eax, dword ptr [0049CD14h]
call 00007FDAD51ED543h
mov dword ptr [004B41F8h], eax
xor edx, edx
push ebp
push 004A8A27h
push dword ptr fs:[edx]
mov dword ptr fs:[edx], esp
call 00007FDAD51F1A73h
mov dword ptr [004B4200h], eax
mov eax, dword ptr [004B4200h]
cmp dword ptr [eax+0Ch], 01h
jne 00007FDAD51F875Ah
mov eax, dword ptr [004B4200h]
mov edx, 00000028h
call 00007FDAD51EDE38h
mov edx, dword ptr [004B4200h]

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0xb7000	0x71	.edata
IMAGE_DIRECTORY_ENTRY_IMPORT	0xb5000	0xfec	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xba000	0x7088	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x1441b00	0x2650
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0xb9000	0x18	.rdata
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0xb52d4	0x25c	.idata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0xb6000	0x1a4	.didata
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0xa568c	0xa5800	b889d302f6fc48a904de33d8d947ae80	False	0.3620185045317221	data	6.377190161826806	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.itext	0xa7000	0x1b64	0x1c00	588dd0a8ab499300d3701cbd11b017d9	False	0.548828125	data	6.109264411030635	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.data	0xa9000	0x3838	0x3a00	5c0c76e77aef52ebc6702430837ccb6e	False	0.35338092672413796	data	4.95916338709992	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.bss	0xad000	0x7258	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0xb5000	0xfec	0x1000	627340dff539ef99048969aa4824fb2d	False	0.380615234375	data	5.020404933181373	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.didata	0xb6000	0x1a4	0x200	fd11c1109737963cc6cb7258063abfd6	False	0.34765625	data	2.729290535217263	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.edata	0xb7000	0x71	0x200	7de8ca0c7a61668a728fd3a88dc0942d	False	0.1796875	data	1.305578535725827	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.tls	0xb8000	0x18	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rdata	0xb9000	0x5d	0x200	d84006640084dc9f74a07c2ff9c7d656	False	0.189453125	data	1.3892750148744617	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.rsrc	0xba000	0x7088	0x7200	65ba6bd3dcb2346eab195c2e7d1302ff	False	0.2584635416666667	data	4.423029369973584	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_ICON	0xba498	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1088	English	United States	0.3980496453900709
RT_ICON	0xba900	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4224	English	United States	0.274155722326454
RT_ICON	0xbb9a8	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9600	English	United States	0.16514522821576763
RT_STRING	0xbdf50	0x3f8	data			0.3198818897637795
RT_STRING	0xbe348	0x2dc	data			0.36475409836065575
RT_STRING	0xbe624	0x430	data			0.40578358208955223
RT_STRING	0xbea54	0x44c	data			0.38636363636363635
RT_STRING	0xbeea0	0x2d4	data			0.39226519337016574
RT_STRING	0xbf174	0xb8	data			0.6467391304347826
RT_STRING	0xbf22c	0x9c	data			0.6410256410256411
RT_STRING	0xbf2c8	0x374	data			0.4230769230769231
RT_STRING	0xbf63c	0x398	data			0.3358695652173913
RT_STRING	0xbf9d4	0x368	data			0.3795871559633027
RT_STRING	0xbfd3c	0x2a4	data			0.4275147928994083
RT_RCDATA	0xbffe0	0x10	data			1.5
RT_RCDATA	0xbfff0	0x310	data			0.6173469387755102
RT_RCDATA	0xc0300	0x2c	data			1.1363636363636365
RT_GROUP_ICON	0xc032c	0x30	data	English	United States	0.9166666666666666
RT_VERSION	0xc035c	0x584	data	English	United States	0.25
RT_MANIFEST	0xc08e0	0x7a8	XML 1.0 document, ASCII text, with CRLF line terminators	English	United States	0.3377551020408163

Imports

DLL	Import
kernel32.dll	GetACP, GetExitCodeProcess, CloseHandle, LocalFree, SizeofResource, VirtualProtect, QueryPerformanceFrequency, VirtualFree, GetFullPathNameW, GetProcessHeap, ExitProcess, HeapAlloc, GetCPInfoExW, RtlUnwind, GetCPInfo, GetStdHandle, GetModuleHandleW, FreeLibrary, HeapDestroy, ReadFile, CreateProcessW, GetLastError, GetModuleFileNameW, SetLastError, FindResourceW, CreateThread, CompareStringW, LoadLibraryA, ResetEvent, GetVolumeInformationW, GetVersion, GetDriveTypeW, RaiseException, FormatMessageW, SwitchToThread, GetExitCodeThread, GetCurrentThread, LoadLibraryExW, LockResource, GetCurrentThreadId, UnhandledExceptionFilter, VirtualQuery, VirtualQueryEx, Sleep, EnterCriticalSection, SetFilePointer, LoadResource, SuspendThread, GetTickCount, GetFileSize, GetStartupInfoW, GetFileAttributesW, InitializeCriticalSection, GetSystemWindowsDirectoryW, GetThreadPriority, SetThreadPriority, GetCurrentProcess, VirtualAlloc, GetCommandLineW, GetSystemInfo, LeaveCriticalSection, GetProcAddress, ResumeThread, GetVersionExW, VerifyVersionInfoW, HeapCreate, GetWindowsDirectoryW, LCMapStringW, VerSetConditionMask, GetDiskFreeSpaceW, FindFirstFileW, GetUserDefaultUILanguage, lstrlenW, QueryPerformanceCounter, SetEndOfFile, HeapFree, WideCharToMultiByte, FindClose, MultiByteToWideChar, LoadLibraryW, SetEvent, CreateFileW, GetLocaleInfoW, GetSystemDirectoryW, DeleteFileW, GetLocalTime, GetEnvironmentVariableW, WaitForSingleObject, WriteFile, ExitThread, DeleteCriticalSection, TlsGetValue, GetDateFormatW, SetErrorMode, IsValidLocale, TlsSetValue, CreateDirectoryW, GetSystemDefaultUILanguage, EnumCalendarInfoW, LocalAlloc, GetUserDefaultLangID, RemoveDirectoryW, CreateEventW, SetThreadLocale, GetThreadLocale
comctl32.dll	InitCommonControls
user32.dll	CreateWindowExW, TranslateMessage, CharLowerBuffW, CallWindowProcW, CharUpperW, PeekMessageW, GetSystemMetrics, SetWindowLongW, MessageBoxW, DestroyWindow, CharUpperBuffW, CharNextW, MsgWaitForMultipleObjects, LoadStringW, ExitWindowsEx, DispatchMessageW
oleaut32.dll	SysAllocStringLen, SafeArrayPtrOfIndex, VariantCopy, SafeArrayGetLBound, SafeArrayGetUBound, VariantInit, VariantClear, SysFreeString, SysReAllocStringLen, VariantChangeType, SafeArrayCreate
advapi32.dll	ConvertStringSecurityDescriptorToSecurityDescriptorW, OpenThreadToken, AdjustTokenPrivileges, LookupPrivilegeValueW, RegOpenKeyExW, OpenProcessToken, FreeSid, AllocateAndInitializeSid, EqualSid, RegQueryValueExW, GetTokenInformation, ConvertSidToStringSidW, RegCloseKey

Exports

Name	Ordinal	Address
__dbk_fcall_wrapper	2	0x40fc10
dbkFCallWrapperAddr	1	0x4b063c

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 3, 2024 10:29:53.674474955 CEST	49734	443	192.168.2.5	104.22.21.170
Oct 3, 2024 10:29:53.674525976 CEST	443	49734	104.22.21.170	192.168.2.5
Oct 3, 2024 10:29:53.674599886 CEST	49734	443	192.168.2.5	104.22.21.170
Oct 3, 2024 10:29:53.683070898 CEST	49734	443	192.168.2.5	104.22.21.170
Oct 3, 2024 10:29:53.683105946 CEST	443	49734	104.22.21.170	192.168.2.5
Oct 3, 2024 10:29:54.171114922 CEST	443	49734	104.22.21.170	192.168.2.5
Oct 3, 2024 10:29:54.171288013 CEST	49734	443	192.168.2.5	104.22.21.170
Oct 3, 2024 10:29:54.249731064 CEST	49734	443	192.168.2.5	104.22.21.170
Oct 3, 2024 10:29:54.249766111 CEST	443	49734	104.22.21.170	192.168.2.5
Oct 3, 2024 10:29:54.250065088 CEST	443	49734	104.22.21.170	192.168.2.5
Oct 3, 2024 10:29:54.290530920 CEST	49734	443	192.168.2.5	104.22.21.170
Oct 3, 2024 10:29:54.411041975 CEST	49734	443	192.168.2.5	104.22.21.170
Oct 3, 2024 10:29:54.455404997 CEST	443	49734	104.22.21.170	192.168.2.5
Oct 3, 2024 10:29:54.512015104 CEST	443	49734	104.22.21.170	192.168.2.5
Oct 3, 2024 10:29:54.553369045 CEST	49734	443	192.168.2.5	104.22.21.170
Oct 3, 2024 10:29:54.555679083 CEST	49734	443	192.168.2.5	104.22.21.170
Oct 3, 2024 10:29:54.555713892 CEST	443	49734	104.22.21.170	192.168.2.5
Oct 3, 2024 10:29:55.052865028 CEST	443	49734	104.22.21.170	192.168.2.5
Oct 3, 2024 10:29:55.053128004 CEST	443	49734	104.22.21.170	192.168.2.5
Oct 3, 2024 10:29:55.053165913 CEST	443	49734	104.22.21.170	192.168.2.5
Oct 3, 2024 10:29:55.053196907 CEST	443	49734	104.22.21.170	192.168.2.5
Oct 3, 2024 10:29:55.053196907 CEST	49734	443	192.168.2.5	104.22.21.170
Oct 3, 2024 10:29:55.053220034 CEST	443	49734	104.22.21.170	192.168.2.5
Oct 3, 2024 10:29:55.053236961 CEST	49734	443	192.168.2.5	104.22.21.170
Oct 3, 2024 10:29:55.053666115 CEST	443	49734	104.22.21.170	192.168.2.5
Oct 3, 2024 10:29:55.053718090 CEST	49734	443	192.168.2.5	104.22.21.170
Oct 3, 2024 10:29:55.053725004 CEST	443	49734	104.22.21.170	192.168.2.5
Oct 3, 2024 10:29:55.053939104 CEST	443	49734	104.22.21.170	192.168.2.5
Oct 3, 2024 10:29:55.053988934 CEST	49734	443	192.168.2.5	104.22.21.170
Oct 3, 2024 10:29:55.053996086 CEST	443	49734	104.22.21.170	192.168.2.5
Oct 3, 2024 10:29:55.057722092 CEST	443	49734	104.22.21.170	192.168.2.5
Oct 3, 2024 10:29:55.057760954 CEST	443	49734	104.22.21.170	192.168.2.5
Oct 3, 2024 10:29:55.057780981 CEST	49734	443	192.168.2.5	104.22.21.170
Oct 3, 2024 10:29:55.057790041 CEST	443	49734	104.22.21.170	192.168.2.5
Oct 3, 2024 10:29:55.057837963 CEST	49734	443	192.168.2.5	104.22.21.170
Oct 3, 2024 10:29:55.145478964 CEST	443	49734	104.22.21.170	192.168.2.5
Oct 3, 2024 10:29:55.145612001 CEST	443	49734	104.22.21.170	192.168.2.5
Oct 3, 2024 10:29:55.145663023 CEST	49734	443	192.168.2.5	104.22.21.170
Oct 3, 2024 10:29:55.145698071 CEST	443	49734	104.22.21.170	192.168.2.5
Oct 3, 2024 10:29:55.145896912 CEST	443	49734	104.22.21.170	192.168.2.5
Oct 3, 2024 10:29:55.145924091 CEST	443	49734	104.22.21.170	192.168.2.5
Oct 3, 2024 10:29:55.145941019 CEST	49734	443	192.168.2.5	104.22.21.170
Oct 3, 2024 10:29:55.145956039 CEST	443	49734	104.22.21.170	192.168.2.5
Oct 3, 2024 10:29:55.146132946 CEST	49734	443	192.168.2.5	104.22.21.170
Oct 3, 2024 10:29:55.146236897 CEST	443	49734	104.22.21.170	192.168.2.5
Oct 3, 2024 10:29:55.146447897 CEST	443	49734	104.22.21.170	192.168.2.5
Oct 3, 2024 10:29:55.146497011 CEST	49734	443	192.168.2.5	104.22.21.170
Oct 3, 2024 10:29:55.146503925 CEST	443	49734	104.22.21.170	192.168.2.5
Oct 3, 2024 10:29:55.146516085 CEST	443	49734	104.22.21.170	192.168.2.5
Oct 3, 2024 10:29:55.146554947 CEST	49734	443	192.168.2.5	104.22.21.170
Oct 3, 2024 10:29:55.146569967 CEST	443	49734	104.22.21.170	192.168.2.5
Oct 3, 2024 10:29:55.147104979 CEST	443	49734	104.22.21.170	192.168.2.5
Oct 3, 2024 10:29:55.147161007 CEST	49734	443	192.168.2.5	104.22.21.170
Oct 3, 2024 10:29:55.147177935 CEST	443	49734	104.22.21.170	192.168.2.5
Oct 3, 2024 10:29:55.147376060 CEST	443	49734	104.22.21.170	192.168.2.5
Oct 3, 2024 10:29:55.147411108 CEST	443	49734	104.22.21.170	192.168.2.5
Oct 3, 2024 10:29:55.147459030 CEST	49734	443	192.168.2.5	104.22.21.170
Oct 3, 2024 10:29:55.147473097 CEST	443	49734	104.22.21.170	192.168.2.5
Oct 3, 2024 10:29:55.147517920 CEST	49734	443	192.168.2.5	104.22.21.170
Oct 3, 2024 10:29:55.147772074 CEST	443	49734	104.22.21.170	192.168.2.5
Oct 3, 2024 10:29:55.147809029 CEST	443	49734	104.22.21.170	192.168.2.5
Oct 3, 2024 10:29:55.147857904 CEST	49734	443	192.168.2.5	104.22.21.170
Oct 3, 2024 10:29:55.147870064 CEST	443	49734	104.22.21.170	192.168.2.5
Oct 3, 2024 10:29:55.148266077 CEST	443	49734	104.22.21.170	192.168.2.5
Oct 3, 2024 10:29:55.148296118 CEST	443	49734	104.22.21.170	192.168.2.5
Oct 3, 2024 10:29:55.148339033 CEST	49734	443	192.168.2.5	104.22.21.170
Oct 3, 2024 10:29:55.148355007 CEST	443	49734	104.22.21.170	192.168.2.5
Oct 3, 2024 10:29:55.148396969 CEST	49734	443	192.168.2.5	104.22.21.170
Oct 3, 2024 10:29:55.148756981 CEST	443	49734	104.22.21.170	192.168.2.5
Oct 3, 2024 10:29:55.189857960 CEST	49734	443	192.168.2.5	104.22.21.170
Oct 3, 2024 10:29:55.189883947 CEST	443	49734	104.22.21.170	192.168.2.5
Oct 3, 2024 10:29:55.237859011 CEST	49734	443	192.168.2.5	104.22.21.170
Oct 3, 2024 10:29:55.238476038 CEST	443	49734	104.22.21.170	192.168.2.5
Oct 3, 2024 10:29:55.238697052 CEST	443	49734	104.22.21.170	192.168.2.5
Oct 3, 2024 10:29:55.238729954 CEST	443	49734	104.22.21.170	192.168.2.5
Oct 3, 2024 10:29:55.238780022 CEST	49734	443	192.168.2.5	104.22.21.170
Oct 3, 2024 10:29:55.238799095 CEST	443	49734	104.22.21.170	192.168.2.5
Oct 3, 2024 10:29:55.238838911 CEST	49734	443	192.168.2.5	104.22.21.170
Oct 3, 2024 10:29:55.239221096 CEST	443	49734	104.22.21.170	192.168.2.5
Oct 3, 2024 10:29:55.239231110 CEST	443	49734	104.22.21.170	192.168.2.5
Oct 3, 2024 10:29:55.239280939 CEST	49734	443	192.168.2.5	104.22.21.170
Oct 3, 2024 10:29:55.239573956 CEST	443	49734	104.22.21.170	192.168.2.5
Oct 3, 2024 10:29:55.239581108 CEST	443	49734	104.22.21.170	192.168.2.5
Oct 3, 2024 10:29:55.239624977 CEST	49734	443	192.168.2.5	104.22.21.170
Oct 3, 2024 10:29:55.239629030 CEST	443	49734	104.22.21.170	192.168.2.5
Oct 3, 2024 10:29:55.239687920 CEST	49734	443	192.168.2.5	104.22.21.170
Oct 3, 2024 10:29:55.239697933 CEST	443	49734	104.22.21.170	192.168.2.5
Oct 3, 2024 10:29:55.239742994 CEST	49734	443	192.168.2.5	104.22.21.170
Oct 3, 2024 10:29:55.240509987 CEST	443	49734	104.22.21.170	192.168.2.5
Oct 3, 2024 10:29:55.240540028 CEST	443	49734	104.22.21.170	192.168.2.5
Oct 3, 2024 10:29:55.240585089 CEST	49734	443	192.168.2.5	104.22.21.170
Oct 3, 2024 10:29:55.240595102 CEST	443	49734	104.22.21.170	192.168.2.5
Oct 3, 2024 10:29:55.240629911 CEST	49734	443	192.168.2.5	104.22.21.170
Oct 3, 2024 10:29:55.240648031 CEST	49734	443	192.168.2.5	104.22.21.170
Oct 3, 2024 10:29:55.241369009 CEST	443	49734	104.22.21.170	192.168.2.5
Oct 3, 2024 10:29:55.241391897 CEST	443	49734	104.22.21.170	192.168.2.5
Oct 3, 2024 10:29:55.241460085 CEST	49734	443	192.168.2.5	104.22.21.170
Oct 3, 2024 10:29:55.241477966 CEST	443	49734	104.22.21.170	192.168.2.5
Oct 3, 2024 10:29:55.241492987 CEST	49734	443	192.168.2.5	104.22.21.170
Oct 3, 2024 10:29:55.241537094 CEST	49734	443	192.168.2.5	104.22.21.170
Oct 3, 2024 10:29:55.242002010 CEST	443	49734	104.22.21.170	192.168.2.5
Oct 3, 2024 10:29:55.242062092 CEST	49734	443	192.168.2.5	104.22.21.170
Oct 3, 2024 10:29:55.242980957 CEST	443	49734	104.22.21.170	192.168.2.5
Oct 3, 2024 10:29:55.243017912 CEST	443	49734	104.22.21.170	192.168.2.5
Oct 3, 2024 10:29:55.243066072 CEST	49734	443	192.168.2.5	104.22.21.170
Oct 3, 2024 10:29:55.243078947 CEST	443	49734	104.22.21.170	192.168.2.5
Oct 3, 2024 10:29:55.243097067 CEST	49734	443	192.168.2.5	104.22.21.170
Oct 3, 2024 10:29:55.243890047 CEST	443	49734	104.22.21.170	192.168.2.5
Oct 3, 2024 10:29:55.243923903 CEST	443	49734	104.22.21.170	192.168.2.5
Oct 3, 2024 10:29:55.243949890 CEST	49734	443	192.168.2.5	104.22.21.170
Oct 3, 2024 10:29:55.243952036 CEST	443	49734	104.22.21.170	192.168.2.5
Oct 3, 2024 10:29:55.243963957 CEST	443	49734	104.22.21.170	192.168.2.5
Oct 3, 2024 10:29:55.244007111 CEST	49734	443	192.168.2.5	104.22.21.170
Oct 3, 2024 10:29:55.244030952 CEST	49734	443	192.168.2.5	104.22.21.170
Oct 3, 2024 10:29:55.244765997 CEST	443	49734	104.22.21.170	192.168.2.5
Oct 3, 2024 10:29:55.244833946 CEST	49734	443	192.168.2.5	104.22.21.170
Oct 3, 2024 10:29:55.331114054 CEST	443	49734	104.22.21.170	192.168.2.5
Oct 3, 2024 10:29:55.331201077 CEST	49734	443	192.168.2.5	104.22.21.170
Oct 3, 2024 10:29:55.331336021 CEST	443	49734	104.22.21.170	192.168.2.5
Oct 3, 2024 10:29:55.331404924 CEST	49734	443	192.168.2.5	104.22.21.170
Oct 3, 2024 10:29:55.331970930 CEST	443	49734	104.22.21.170	192.168.2.5
Oct 3, 2024 10:29:55.332004070 CEST	443	49734	104.22.21.170	192.168.2.5
Oct 3, 2024 10:29:55.332032919 CEST	49734	443	192.168.2.5	104.22.21.170
Oct 3, 2024 10:29:55.332045078 CEST	443	49734	104.22.21.170	192.168.2.5
Oct 3, 2024 10:29:55.332062006 CEST	49734	443	192.168.2.5	104.22.21.170
Oct 3, 2024 10:29:55.332094908 CEST	49734	443	192.168.2.5	104.22.21.170
Oct 3, 2024 10:29:55.332845926 CEST	443	49734	104.22.21.170	192.168.2.5
Oct 3, 2024 10:29:55.332881927 CEST	443	49734	104.22.21.170	192.168.2.5
Oct 3, 2024 10:29:55.332910061 CEST	49734	443	192.168.2.5	104.22.21.170
Oct 3, 2024 10:29:55.332917929 CEST	443	49734	104.22.21.170	192.168.2.5
Oct 3, 2024 10:29:55.332951069 CEST	49734	443	192.168.2.5	104.22.21.170
Oct 3, 2024 10:29:55.332967997 CEST	49734	443	192.168.2.5	104.22.21.170
Oct 3, 2024 10:29:55.333638906 CEST	443	49734	104.22.21.170	192.168.2.5
Oct 3, 2024 10:29:55.333707094 CEST	49734	443	192.168.2.5	104.22.21.170
Oct 3, 2024 10:29:55.333765984 CEST	443	49734	104.22.21.170	192.168.2.5
Oct 3, 2024 10:29:55.333869934 CEST	49734	443	192.168.2.5	104.22.21.170
Oct 3, 2024 10:29:55.334642887 CEST	443	49734	104.22.21.170	192.168.2.5
Oct 3, 2024 10:29:55.334676027 CEST	443	49734	104.22.21.170	192.168.2.5
Oct 3, 2024 10:29:55.334701061 CEST	49734	443	192.168.2.5	104.22.21.170
Oct 3, 2024 10:29:55.334708929 CEST	443	49734	104.22.21.170	192.168.2.5
Oct 3, 2024 10:29:55.334738016 CEST	49734	443	192.168.2.5	104.22.21.170
Oct 3, 2024 10:29:55.334754944 CEST	49734	443	192.168.2.5	104.22.21.170
Oct 3, 2024 10:29:55.335582972 CEST	443	49734	104.22.21.170	192.168.2.5
Oct 3, 2024 10:29:55.335635900 CEST	443	49734	104.22.21.170	192.168.2.5
Oct 3, 2024 10:29:55.335664988 CEST	49734	443	192.168.2.5	104.22.21.170
Oct 3, 2024 10:29:55.335669994 CEST	443	49734	104.22.21.170	192.168.2.5
Oct 3, 2024 10:29:55.335700989 CEST	49734	443	192.168.2.5	104.22.21.170
Oct 3, 2024 10:29:55.335721016 CEST	49734	443	192.168.2.5	104.22.21.170
Oct 3, 2024 10:29:55.336442947 CEST	443	49734	104.22.21.170	192.168.2.5
Oct 3, 2024 10:29:55.336476088 CEST	443	49734	104.22.21.170	192.168.2.5
Oct 3, 2024 10:29:55.336505890 CEST	49734	443	192.168.2.5	104.22.21.170
Oct 3, 2024 10:29:55.336512089 CEST	443	49734	104.22.21.170	192.168.2.5
Oct 3, 2024 10:29:55.336544037 CEST	49734	443	192.168.2.5	104.22.21.170
Oct 3, 2024 10:29:55.336563110 CEST	49734	443	192.168.2.5	104.22.21.170
Oct 3, 2024 10:29:55.337382078 CEST	443	49734	104.22.21.170	192.168.2.5
Oct 3, 2024 10:29:55.337416887 CEST	443	49734	104.22.21.170	192.168.2.5
Oct 3, 2024 10:29:55.337455034 CEST	49734	443	192.168.2.5	104.22.21.170
Oct 3, 2024 10:29:55.337460995 CEST	443	49734	104.22.21.170	192.168.2.5
Oct 3, 2024 10:29:55.337491035 CEST	49734	443	192.168.2.5	104.22.21.170
Oct 3, 2024 10:29:55.337507963 CEST	49734	443	192.168.2.5	104.22.21.170
Oct 3, 2024 10:29:55.338336945 CEST	443	49734	104.22.21.170	192.168.2.5
Oct 3, 2024 10:29:55.338367939 CEST	443	49734	104.22.21.170	192.168.2.5
Oct 3, 2024 10:29:55.338392019 CEST	49734	443	192.168.2.5	104.22.21.170
Oct 3, 2024 10:29:55.338397980 CEST	443	49734	104.22.21.170	192.168.2.5
Oct 3, 2024 10:29:55.338426113 CEST	49734	443	192.168.2.5	104.22.21.170
Oct 3, 2024 10:29:55.338443995 CEST	49734	443	192.168.2.5	104.22.21.170
Oct 3, 2024 10:29:55.339015961 CEST	443	49734	104.22.21.170	192.168.2.5
Oct 3, 2024 10:29:55.339073896 CEST	49734	443	192.168.2.5	104.22.21.170
Oct 3, 2024 10:29:55.423629045 CEST	443	49734	104.22.21.170	192.168.2.5
Oct 3, 2024 10:29:55.423718929 CEST	49734	443	192.168.2.5	104.22.21.170
Oct 3, 2024 10:29:55.423762083 CEST	443	49734	104.22.21.170	192.168.2.5
Oct 3, 2024 10:29:55.423825026 CEST	49734	443	192.168.2.5	104.22.21.170
Oct 3, 2024 10:29:55.424063921 CEST	443	49734	104.22.21.170	192.168.2.5
Oct 3, 2024 10:29:55.424117088 CEST	49734	443	192.168.2.5	104.22.21.170
Oct 3, 2024 10:29:55.424725056 CEST	443	49734	104.22.21.170	192.168.2.5
Oct 3, 2024 10:29:55.424771070 CEST	443	49734	104.22.21.170	192.168.2.5
Oct 3, 2024 10:29:55.424782038 CEST	49734	443	192.168.2.5	104.22.21.170
Oct 3, 2024 10:29:55.424793959 CEST	443	49734	104.22.21.170	192.168.2.5
Oct 3, 2024 10:29:55.424829960 CEST	49734	443	192.168.2.5	104.22.21.170
Oct 3, 2024 10:29:55.425491095 CEST	443	49734	104.22.21.170	192.168.2.5
Oct 3, 2024 10:29:55.425528049 CEST	443	49734	104.22.21.170	192.168.2.5
Oct 3, 2024 10:29:55.425556898 CEST	49734	443	192.168.2.5	104.22.21.170
Oct 3, 2024 10:29:55.425569057 CEST	443	49734	104.22.21.170	192.168.2.5
Oct 3, 2024 10:29:55.425591946 CEST	49734	443	192.168.2.5	104.22.21.170
Oct 3, 2024 10:29:55.427464962 CEST	443	49734	104.22.21.170	192.168.2.5
Oct 3, 2024 10:29:55.427504063 CEST	443	49734	104.22.21.170	192.168.2.5
Oct 3, 2024 10:29:55.427535057 CEST	49734	443	192.168.2.5	104.22.21.170
Oct 3, 2024 10:29:55.427552938 CEST	443	49734	104.22.21.170	192.168.2.5
Oct 3, 2024 10:29:55.427567959 CEST	49734	443	192.168.2.5	104.22.21.170
Oct 3, 2024 10:29:55.428241968 CEST	49734	443	192.168.2.5	104.22.21.170
Oct 3, 2024 10:29:55.428402901 CEST	443	49734	104.22.21.170	192.168.2.5
Oct 3, 2024 10:29:55.428428888 CEST	443	49734	104.22.21.170	192.168.2.5
Oct 3, 2024 10:29:55.428459883 CEST	49734	443	192.168.2.5	104.22.21.170
Oct 3, 2024 10:29:55.428467989 CEST	443	49734	104.22.21.170	192.168.2.5
Oct 3, 2024 10:29:55.428498983 CEST	49734	443	192.168.2.5	104.22.21.170
Oct 3, 2024 10:29:55.428515911 CEST	49734	443	192.168.2.5	104.22.21.170
Oct 3, 2024 10:29:55.430087090 CEST	443	49734	104.22.21.170	192.168.2.5
Oct 3, 2024 10:29:55.430121899 CEST	443	49734	104.22.21.170	192.168.2.5
Oct 3, 2024 10:29:55.430150986 CEST	49734	443	192.168.2.5	104.22.21.170
Oct 3, 2024 10:29:55.430166960 CEST	443	49734	104.22.21.170	192.168.2.5
Oct 3, 2024 10:29:55.430191994 CEST	49734	443	192.168.2.5	104.22.21.170
Oct 3, 2024 10:29:55.431703091 CEST	443	49734	104.22.21.170	192.168.2.5
Oct 3, 2024 10:29:55.431726933 CEST	443	49734	104.22.21.170	192.168.2.5
Oct 3, 2024 10:29:55.431772947 CEST	49734	443	192.168.2.5	104.22.21.170
Oct 3, 2024 10:29:55.431786060 CEST	443	49734	104.22.21.170	192.168.2.5
Oct 3, 2024 10:29:55.431843996 CEST	49734	443	192.168.2.5	104.22.21.170
Oct 3, 2024 10:29:55.433598042 CEST	443	49734	104.22.21.170	192.168.2.5
Oct 3, 2024 10:29:55.433624983 CEST	443	49734	104.22.21.170	192.168.2.5
Oct 3, 2024 10:29:55.433679104 CEST	49734	443	192.168.2.5	104.22.21.170
Oct 3, 2024 10:29:55.433691025 CEST	443	49734	104.22.21.170	192.168.2.5
Oct 3, 2024 10:29:55.433703899 CEST	49734	443	192.168.2.5	104.22.21.170
Oct 3, 2024 10:29:55.434492111 CEST	443	49734	104.22.21.170	192.168.2.5
Oct 3, 2024 10:29:55.434514046 CEST	443	49734	104.22.21.170	192.168.2.5
Oct 3, 2024 10:29:55.434547901 CEST	49734	443	192.168.2.5	104.22.21.170
Oct 3, 2024 10:29:55.434561968 CEST	443	49734	104.22.21.170	192.168.2.5
Oct 3, 2024 10:29:55.434582949 CEST	49734	443	192.168.2.5	104.22.21.170
Oct 3, 2024 10:29:55.489845037 CEST	49734	443	192.168.2.5	104.22.21.170
Oct 3, 2024 10:29:55.516868114 CEST	443	49734	104.22.21.170	192.168.2.5
Oct 3, 2024 10:29:55.516892910 CEST	443	49734	104.22.21.170	192.168.2.5
Oct 3, 2024 10:29:55.516954899 CEST	49734	443	192.168.2.5	104.22.21.170
Oct 3, 2024 10:29:55.516972065 CEST	443	49734	104.22.21.170	192.168.2.5
Oct 3, 2024 10:29:55.517004967 CEST	49734	443	192.168.2.5	104.22.21.170
Oct 3, 2024 10:29:55.517026901 CEST	49734	443	192.168.2.5	104.22.21.170
Oct 3, 2024 10:29:55.518034935 CEST	443	49734	104.22.21.170	192.168.2.5
Oct 3, 2024 10:29:55.518053055 CEST	443	49734	104.22.21.170	192.168.2.5
Oct 3, 2024 10:29:55.518135071 CEST	49734	443	192.168.2.5	104.22.21.170
Oct 3, 2024 10:29:55.518155098 CEST	443	49734	104.22.21.170	192.168.2.5
Oct 3, 2024 10:29:55.518196106 CEST	49734	443	192.168.2.5	104.22.21.170
Oct 3, 2024 10:29:55.519733906 CEST	443	49734	104.22.21.170	192.168.2.5
Oct 3, 2024 10:29:55.519754887 CEST	443	49734	104.22.21.170	192.168.2.5
Oct 3, 2024 10:29:55.519820929 CEST	49734	443	192.168.2.5	104.22.21.170
Oct 3, 2024 10:29:55.519843102 CEST	443	49734	104.22.21.170	192.168.2.5
Oct 3, 2024 10:29:55.519860029 CEST	49734	443	192.168.2.5	104.22.21.170
Oct 3, 2024 10:29:55.520004034 CEST	49734	443	192.168.2.5	104.22.21.170
Oct 3, 2024 10:29:55.521491051 CEST	443	49734	104.22.21.170	192.168.2.5
Oct 3, 2024 10:29:55.521507978 CEST	443	49734	104.22.21.170	192.168.2.5
Oct 3, 2024 10:29:55.521558046 CEST	49734	443	192.168.2.5	104.22.21.170
Oct 3, 2024 10:29:55.521574974 CEST	443	49734	104.22.21.170	192.168.2.5
Oct 3, 2024 10:29:55.521590948 CEST	49734	443	192.168.2.5	104.22.21.170
Oct 3, 2024 10:29:55.521621943 CEST	49734	443	192.168.2.5	104.22.21.170
Oct 3, 2024 10:29:55.523221970 CEST	443	49734	104.22.21.170	192.168.2.5
Oct 3, 2024 10:29:55.523283958 CEST	443	49734	104.22.21.170	192.168.2.5
Oct 3, 2024 10:29:55.523287058 CEST	49734	443	192.168.2.5	104.22.21.170
Oct 3, 2024 10:29:55.523296118 CEST	443	49734	104.22.21.170	192.168.2.5
Oct 3, 2024 10:29:55.523339987 CEST	49734	443	192.168.2.5	104.22.21.170
Oct 3, 2024 10:29:55.524005890 CEST	443	49734	104.22.21.170	192.168.2.5
Oct 3, 2024 10:29:55.524025917 CEST	443	49734	104.22.21.170	192.168.2.5
Oct 3, 2024 10:29:55.524090052 CEST	49734	443	192.168.2.5	104.22.21.170
Oct 3, 2024 10:29:55.524101019 CEST	443	49734	104.22.21.170	192.168.2.5
Oct 3, 2024 10:29:55.524142981 CEST	49734	443	192.168.2.5	104.22.21.170
Oct 3, 2024 10:29:55.525774002 CEST	443	49734	104.22.21.170	192.168.2.5
Oct 3, 2024 10:29:55.525789976 CEST	443	49734	104.22.21.170	192.168.2.5
Oct 3, 2024 10:29:55.525846958 CEST	49734	443	192.168.2.5	104.22.21.170
Oct 3, 2024 10:29:55.525867939 CEST	443	49734	104.22.21.170	192.168.2.5
Oct 3, 2024 10:29:55.525908947 CEST	49734	443	192.168.2.5	104.22.21.170
Oct 3, 2024 10:29:55.526702881 CEST	443	49734	104.22.21.170	192.168.2.5
Oct 3, 2024 10:29:55.526719093 CEST	443	49734	104.22.21.170	192.168.2.5
Oct 3, 2024 10:29:55.526838064 CEST	49734	443	192.168.2.5	104.22.21.170
Oct 3, 2024 10:29:55.526845932 CEST	443	49734	104.22.21.170	192.168.2.5
Oct 3, 2024 10:29:55.526949883 CEST	49734	443	192.168.2.5	104.22.21.170
Oct 3, 2024 10:29:55.609452009 CEST	443	49734	104.22.21.170	192.168.2.5
Oct 3, 2024 10:29:55.609477997 CEST	443	49734	104.22.21.170	192.168.2.5
Oct 3, 2024 10:29:55.609586000 CEST	49734	443	192.168.2.5	104.22.21.170
Oct 3, 2024 10:29:55.609610081 CEST	443	49734	104.22.21.170	192.168.2.5
Oct 3, 2024 10:29:55.609647989 CEST	49734	443	192.168.2.5	104.22.21.170
Oct 3, 2024 10:29:55.610739946 CEST	443	49734	104.22.21.170	192.168.2.5
Oct 3, 2024 10:29:55.610759974 CEST	443	49734	104.22.21.170	192.168.2.5
Oct 3, 2024 10:29:55.610831976 CEST	49734	443	192.168.2.5	104.22.21.170
Oct 3, 2024 10:29:55.610836983 CEST	443	49734	104.22.21.170	192.168.2.5
Oct 3, 2024 10:29:55.610866070 CEST	49734	443	192.168.2.5	104.22.21.170
Oct 3, 2024 10:29:55.610886097 CEST	49734	443	192.168.2.5	104.22.21.170
Oct 3, 2024 10:29:55.611669064 CEST	443	49734	104.22.21.170	192.168.2.5
Oct 3, 2024 10:29:55.611686945 CEST	443	49734	104.22.21.170	192.168.2.5
Oct 3, 2024 10:29:55.611753941 CEST	49734	443	192.168.2.5	104.22.21.170
Oct 3, 2024 10:29:55.611759901 CEST	443	49734	104.22.21.170	192.168.2.5
Oct 3, 2024 10:29:55.611825943 CEST	49734	443	192.168.2.5	104.22.21.170
Oct 3, 2024 10:29:55.613567114 CEST	443	49734	104.22.21.170	192.168.2.5
Oct 3, 2024 10:29:55.613584042 CEST	443	49734	104.22.21.170	192.168.2.5
Oct 3, 2024 10:29:55.613646030 CEST	49734	443	192.168.2.5	104.22.21.170
Oct 3, 2024 10:29:55.613653898 CEST	443	49734	104.22.21.170	192.168.2.5
Oct 3, 2024 10:29:55.613713026 CEST	49734	443	192.168.2.5	104.22.21.170
Oct 3, 2024 10:29:55.614582062 CEST	443	49734	104.22.21.170	192.168.2.5
Oct 3, 2024 10:29:55.614600897 CEST	443	49734	104.22.21.170	192.168.2.5
Oct 3, 2024 10:29:55.614661932 CEST	49734	443	192.168.2.5	104.22.21.170
Oct 3, 2024 10:29:55.614667892 CEST	443	49734	104.22.21.170	192.168.2.5
Oct 3, 2024 10:29:55.614708900 CEST	49734	443	192.168.2.5	104.22.21.170
Oct 3, 2024 10:29:55.615544081 CEST	443	49734	104.22.21.170	192.168.2.5
Oct 3, 2024 10:29:55.615561962 CEST	443	49734	104.22.21.170	192.168.2.5
Oct 3, 2024 10:29:55.615617037 CEST	49734	443	192.168.2.5	104.22.21.170
Oct 3, 2024 10:29:55.615623951 CEST	443	49734	104.22.21.170	192.168.2.5
Oct 3, 2024 10:29:55.615662098 CEST	49734	443	192.168.2.5	104.22.21.170
Oct 3, 2024 10:29:55.617290974 CEST	443	49734	104.22.21.170	192.168.2.5
Oct 3, 2024 10:29:55.617311954 CEST	443	49734	104.22.21.170	192.168.2.5
Oct 3, 2024 10:29:55.617342949 CEST	49734	443	192.168.2.5	104.22.21.170
Oct 3, 2024 10:29:55.617350101 CEST	443	49734	104.22.21.170	192.168.2.5
Oct 3, 2024 10:29:55.617378950 CEST	49734	443	192.168.2.5	104.22.21.170
Oct 3, 2024 10:29:55.617420912 CEST	49734	443	192.168.2.5	104.22.21.170
Oct 3, 2024 10:29:55.618170023 CEST	443	49734	104.22.21.170	192.168.2.5
Oct 3, 2024 10:29:55.618185997 CEST	443	49734	104.22.21.170	192.168.2.5
Oct 3, 2024 10:29:55.618240118 CEST	49734	443	192.168.2.5	104.22.21.170
Oct 3, 2024 10:29:55.618247032 CEST	443	49734	104.22.21.170	192.168.2.5
Oct 3, 2024 10:29:55.618295908 CEST	49734	443	192.168.2.5	104.22.21.170
Oct 3, 2024 10:29:55.701817989 CEST	443	49734	104.22.21.170	192.168.2.5
Oct 3, 2024 10:29:55.701847076 CEST	443	49734	104.22.21.170	192.168.2.5
Oct 3, 2024 10:29:55.701915026 CEST	49734	443	192.168.2.5	104.22.21.170
Oct 3, 2024 10:29:55.701941013 CEST	443	49734	104.22.21.170	192.168.2.5
Oct 3, 2024 10:29:55.701994896 CEST	49734	443	192.168.2.5	104.22.21.170
Oct 3, 2024 10:29:55.702959061 CEST	443	49734	104.22.21.170	192.168.2.5
Oct 3, 2024 10:29:55.702976942 CEST	443	49734	104.22.21.170	192.168.2.5
Oct 3, 2024 10:29:55.703037024 CEST	49734	443	192.168.2.5	104.22.21.170
Oct 3, 2024 10:29:55.703042984 CEST	443	49734	104.22.21.170	192.168.2.5
Oct 3, 2024 10:29:55.703088999 CEST	49734	443	192.168.2.5	104.22.21.170
Oct 3, 2024 10:29:55.703836918 CEST	443	49734	104.22.21.170	192.168.2.5
Oct 3, 2024 10:29:55.703857899 CEST	443	49734	104.22.21.170	192.168.2.5
Oct 3, 2024 10:29:55.703934908 CEST	49734	443	192.168.2.5	104.22.21.170
Oct 3, 2024 10:29:55.703941107 CEST	443	49734	104.22.21.170	192.168.2.5
Oct 3, 2024 10:29:55.703982115 CEST	49734	443	192.168.2.5	104.22.21.170
Oct 3, 2024 10:29:55.705552101 CEST	443	49734	104.22.21.170	192.168.2.5
Oct 3, 2024 10:29:55.705570936 CEST	443	49734	104.22.21.170	192.168.2.5
Oct 3, 2024 10:29:55.705641031 CEST	49734	443	192.168.2.5	104.22.21.170
Oct 3, 2024 10:29:55.705648899 CEST	443	49734	104.22.21.170	192.168.2.5
Oct 3, 2024 10:29:55.705677032 CEST	49734	443	192.168.2.5	104.22.21.170
Oct 3, 2024 10:29:55.705696106 CEST	49734	443	192.168.2.5	104.22.21.170
Oct 3, 2024 10:29:55.706516981 CEST	443	49734	104.22.21.170	192.168.2.5
Oct 3, 2024 10:29:55.706535101 CEST	443	49734	104.22.21.170	192.168.2.5
Oct 3, 2024 10:29:55.706598997 CEST	49734	443	192.168.2.5	104.22.21.170
Oct 3, 2024 10:29:55.706605911 CEST	443	49734	104.22.21.170	192.168.2.5
Oct 3, 2024 10:29:55.706654072 CEST	49734	443	192.168.2.5	104.22.21.170
Oct 3, 2024 10:29:55.707515955 CEST	443	49734	104.22.21.170	192.168.2.5
Oct 3, 2024 10:29:55.707534075 CEST	443	49734	104.22.21.170	192.168.2.5
Oct 3, 2024 10:29:55.707566977 CEST	49734	443	192.168.2.5	104.22.21.170
Oct 3, 2024 10:29:55.707575083 CEST	443	49734	104.22.21.170	192.168.2.5
Oct 3, 2024 10:29:55.707602024 CEST	49734	443	192.168.2.5	104.22.21.170
Oct 3, 2024 10:29:55.707628012 CEST	49734	443	192.168.2.5	104.22.21.170
Oct 3, 2024 10:29:55.708522081 CEST	443	49734	104.22.21.170	192.168.2.5
Oct 3, 2024 10:29:55.708539009 CEST	443	49734	104.22.21.170	192.168.2.5
Oct 3, 2024 10:29:55.708614111 CEST	49734	443	192.168.2.5	104.22.21.170
Oct 3, 2024 10:29:55.708620071 CEST	443	49734	104.22.21.170	192.168.2.5
Oct 3, 2024 10:29:55.708690882 CEST	49734	443	192.168.2.5	104.22.21.170
Oct 3, 2024 10:29:55.709316969 CEST	443	49734	104.22.21.170	192.168.2.5
Oct 3, 2024 10:29:55.709335089 CEST	443	49734	104.22.21.170	192.168.2.5
Oct 3, 2024 10:29:55.709366083 CEST	443	49734	104.22.21.170	192.168.2.5
Oct 3, 2024 10:29:55.709398985 CEST	49734	443	192.168.2.5	104.22.21.170
Oct 3, 2024 10:29:55.709405899 CEST	443	49734	104.22.21.170	192.168.2.5
Oct 3, 2024 10:29:55.709434986 CEST	49734	443	192.168.2.5	104.22.21.170
Oct 3, 2024 10:29:55.761671066 CEST	49734	443	192.168.2.5	104.22.21.170
Oct 3, 2024 10:29:55.794562101 CEST	443	49734	104.22.21.170	192.168.2.5
Oct 3, 2024 10:29:55.794584990 CEST	443	49734	104.22.21.170	192.168.2.5
Oct 3, 2024 10:29:55.794702053 CEST	49734	443	192.168.2.5	104.22.21.170
Oct 3, 2024 10:29:55.794735909 CEST	443	49734	104.22.21.170	192.168.2.5
Oct 3, 2024 10:29:55.794785976 CEST	49734	443	192.168.2.5	104.22.21.170
Oct 3, 2024 10:29:55.795511961 CEST	443	49734	104.22.21.170	192.168.2.5
Oct 3, 2024 10:29:55.795527935 CEST	443	49734	104.22.21.170	192.168.2.5
Oct 3, 2024 10:29:55.795572996 CEST	49734	443	192.168.2.5	104.22.21.170
Oct 3, 2024 10:29:55.795581102 CEST	443	49734	104.22.21.170	192.168.2.5
Oct 3, 2024 10:29:55.795612097 CEST	49734	443	192.168.2.5	104.22.21.170
Oct 3, 2024 10:29:55.795629025 CEST	49734	443	192.168.2.5	104.22.21.170
Oct 3, 2024 10:29:55.796402931 CEST	443	49734	104.22.21.170	192.168.2.5
Oct 3, 2024 10:29:55.796416998 CEST	443	49734	104.22.21.170	192.168.2.5
Oct 3, 2024 10:29:55.796472073 CEST	49734	443	192.168.2.5	104.22.21.170
Oct 3, 2024 10:29:55.796479940 CEST	443	49734	104.22.21.170	192.168.2.5
Oct 3, 2024 10:29:55.796515942 CEST	49734	443	192.168.2.5	104.22.21.170
Oct 3, 2024 10:29:55.796533108 CEST	49734	443	192.168.2.5	104.22.21.170
Oct 3, 2024 10:29:55.797611952 CEST	443	49734	104.22.21.170	192.168.2.5
Oct 3, 2024 10:29:55.797627926 CEST	443	49734	104.22.21.170	192.168.2.5
Oct 3, 2024 10:29:55.797682047 CEST	49734	443	192.168.2.5	104.22.21.170
Oct 3, 2024 10:29:55.797689915 CEST	443	49734	104.22.21.170	192.168.2.5
Oct 3, 2024 10:29:55.797728062 CEST	49734	443	192.168.2.5	104.22.21.170
Oct 3, 2024 10:29:55.798551083 CEST	443	49734	104.22.21.170	192.168.2.5
Oct 3, 2024 10:29:55.798567057 CEST	443	49734	104.22.21.170	192.168.2.5
Oct 3, 2024 10:29:55.798630953 CEST	49734	443	192.168.2.5	104.22.21.170
Oct 3, 2024 10:29:55.798639059 CEST	443	49734	104.22.21.170	192.168.2.5
Oct 3, 2024 10:29:55.798671007 CEST	49734	443	192.168.2.5	104.22.21.170
Oct 3, 2024 10:29:55.798683882 CEST	49734	443	192.168.2.5	104.22.21.170
Oct 3, 2024 10:29:55.799489021 CEST	443	49734	104.22.21.170	192.168.2.5
Oct 3, 2024 10:29:55.799505949 CEST	443	49734	104.22.21.170	192.168.2.5
Oct 3, 2024 10:29:55.799582958 CEST	49734	443	192.168.2.5	104.22.21.170
Oct 3, 2024 10:29:55.799591064 CEST	443	49734	104.22.21.170	192.168.2.5
Oct 3, 2024 10:29:55.799642086 CEST	49734	443	192.168.2.5	104.22.21.170
Oct 3, 2024 10:29:55.800394058 CEST	443	49734	104.22.21.170	192.168.2.5
Oct 3, 2024 10:29:55.800409079 CEST	443	49734	104.22.21.170	192.168.2.5
Oct 3, 2024 10:29:55.800463915 CEST	49734	443	192.168.2.5	104.22.21.170
Oct 3, 2024 10:29:55.800471067 CEST	443	49734	104.22.21.170	192.168.2.5
Oct 3, 2024 10:29:55.800713062 CEST	49734	443	192.168.2.5	104.22.21.170
Oct 3, 2024 10:29:55.801338911 CEST	443	49734	104.22.21.170	192.168.2.5
Oct 3, 2024 10:29:55.801356077 CEST	443	49734	104.22.21.170	192.168.2.5
Oct 3, 2024 10:29:55.801419020 CEST	49734	443	192.168.2.5	104.22.21.170
Oct 3, 2024 10:29:55.801426888 CEST	443	49734	104.22.21.170	192.168.2.5
Oct 3, 2024 10:29:55.801481009 CEST	49734	443	192.168.2.5	104.22.21.170
Oct 3, 2024 10:29:55.887198925 CEST	443	49734	104.22.21.170	192.168.2.5
Oct 3, 2024 10:29:55.887223959 CEST	443	49734	104.22.21.170	192.168.2.5
Oct 3, 2024 10:29:55.887340069 CEST	49734	443	192.168.2.5	104.22.21.170
Oct 3, 2024 10:29:55.887363911 CEST	443	49734	104.22.21.170	192.168.2.5
Oct 3, 2024 10:29:55.887408972 CEST	49734	443	192.168.2.5	104.22.21.170
Oct 3, 2024 10:29:55.887938976 CEST	443	49734	104.22.21.170	192.168.2.5
Oct 3, 2024 10:29:55.887959003 CEST	443	49734	104.22.21.170	192.168.2.5
Oct 3, 2024 10:29:55.888016939 CEST	49734	443	192.168.2.5	104.22.21.170
Oct 3, 2024 10:29:55.888024092 CEST	443	49734	104.22.21.170	192.168.2.5
Oct 3, 2024 10:29:55.888056993 CEST	49734	443	192.168.2.5	104.22.21.170
Oct 3, 2024 10:29:55.888923883 CEST	443	49734	104.22.21.170	192.168.2.5
Oct 3, 2024 10:29:55.888946056 CEST	443	49734	104.22.21.170	192.168.2.5
Oct 3, 2024 10:29:55.889014959 CEST	49734	443	192.168.2.5	104.22.21.170
Oct 3, 2024 10:29:55.889019966 CEST	443	49734	104.22.21.170	192.168.2.5
Oct 3, 2024 10:29:55.889055967 CEST	49734	443	192.168.2.5	104.22.21.170
Oct 3, 2024 10:29:55.889482975 CEST	443	49734	104.22.21.170	192.168.2.5
Oct 3, 2024 10:29:55.889498949 CEST	443	49734	104.22.21.170	192.168.2.5
Oct 3, 2024 10:29:55.889580965 CEST	49734	443	192.168.2.5	104.22.21.170
Oct 3, 2024 10:29:55.889586926 CEST	443	49734	104.22.21.170	192.168.2.5
Oct 3, 2024 10:29:55.889628887 CEST	49734	443	192.168.2.5	104.22.21.170
Oct 3, 2024 10:29:55.890335083 CEST	443	49734	104.22.21.170	192.168.2.5
Oct 3, 2024 10:29:55.890352011 CEST	443	49734	104.22.21.170	192.168.2.5
Oct 3, 2024 10:29:55.890425920 CEST	49734	443	192.168.2.5	104.22.21.170
Oct 3, 2024 10:29:55.890431881 CEST	443	49734	104.22.21.170	192.168.2.5
Oct 3, 2024 10:29:55.890469074 CEST	49734	443	192.168.2.5	104.22.21.170
Oct 3, 2024 10:29:55.891298056 CEST	443	49734	104.22.21.170	192.168.2.5
Oct 3, 2024 10:29:55.891313076 CEST	443	49734	104.22.21.170	192.168.2.5
Oct 3, 2024 10:29:55.891359091 CEST	49734	443	192.168.2.5	104.22.21.170
Oct 3, 2024 10:29:55.891365051 CEST	443	49734	104.22.21.170	192.168.2.5
Oct 3, 2024 10:29:55.891395092 CEST	49734	443	192.168.2.5	104.22.21.170
Oct 3, 2024 10:29:55.891413927 CEST	49734	443	192.168.2.5	104.22.21.170
Oct 3, 2024 10:29:55.892262936 CEST	443	49734	104.22.21.170	192.168.2.5
Oct 3, 2024 10:29:55.892285109 CEST	443	49734	104.22.21.170	192.168.2.5
Oct 3, 2024 10:29:55.892340899 CEST	49734	443	192.168.2.5	104.22.21.170
Oct 3, 2024 10:29:55.892347097 CEST	443	49734	104.22.21.170	192.168.2.5
Oct 3, 2024 10:29:55.892385006 CEST	49734	443	192.168.2.5	104.22.21.170
Oct 3, 2024 10:29:55.893116951 CEST	443	49734	104.22.21.170	192.168.2.5
Oct 3, 2024 10:29:55.893132925 CEST	443	49734	104.22.21.170	192.168.2.5
Oct 3, 2024 10:29:55.893194914 CEST	49734	443	192.168.2.5	104.22.21.170
Oct 3, 2024 10:29:55.893202066 CEST	443	49734	104.22.21.170	192.168.2.5
Oct 3, 2024 10:29:55.893240929 CEST	49734	443	192.168.2.5	104.22.21.170
Oct 3, 2024 10:29:55.893630981 CEST	49734	443	192.168.2.5	104.22.21.170
Oct 3, 2024 10:29:55.979845047 CEST	443	49734	104.22.21.170	192.168.2.5
Oct 3, 2024 10:29:55.979865074 CEST	443	49734	104.22.21.170	192.168.2.5
Oct 3, 2024 10:29:55.979943991 CEST	49734	443	192.168.2.5	104.22.21.170
Oct 3, 2024 10:29:55.979963064 CEST	443	49734	104.22.21.170	192.168.2.5
Oct 3, 2024 10:29:55.980004072 CEST	49734	443	192.168.2.5	104.22.21.170
Oct 3, 2024 10:29:55.980572939 CEST	443	49734	104.22.21.170	192.168.2.5
Oct 3, 2024 10:29:55.980590105 CEST	443	49734	104.22.21.170	192.168.2.5
Oct 3, 2024 10:29:55.980645895 CEST	49734	443	192.168.2.5	104.22.21.170
Oct 3, 2024 10:29:55.980652094 CEST	443	49734	104.22.21.170	192.168.2.5
Oct 3, 2024 10:29:55.980686903 CEST	49734	443	192.168.2.5	104.22.21.170
Oct 3, 2024 10:29:55.981669903 CEST	443	49734	104.22.21.170	192.168.2.5
Oct 3, 2024 10:29:55.981684923 CEST	443	49734	104.22.21.170	192.168.2.5
Oct 3, 2024 10:29:55.981759071 CEST	49734	443	192.168.2.5	104.22.21.170
Oct 3, 2024 10:29:55.981765032 CEST	443	49734	104.22.21.170	192.168.2.5
Oct 3, 2024 10:29:55.981812000 CEST	49734	443	192.168.2.5	104.22.21.170
Oct 3, 2024 10:29:55.982223988 CEST	443	49734	104.22.21.170	192.168.2.5
Oct 3, 2024 10:29:55.982240915 CEST	443	49734	104.22.21.170	192.168.2.5
Oct 3, 2024 10:29:55.982275963 CEST	49734	443	192.168.2.5	104.22.21.170
Oct 3, 2024 10:29:55.982281923 CEST	443	49734	104.22.21.170	192.168.2.5
Oct 3, 2024 10:29:55.982323885 CEST	49734	443	192.168.2.5	104.22.21.170
Oct 3, 2024 10:29:55.982956886 CEST	443	49734	104.22.21.170	192.168.2.5
Oct 3, 2024 10:29:55.982970953 CEST	443	49734	104.22.21.170	192.168.2.5
Oct 3, 2024 10:29:55.983028889 CEST	49734	443	192.168.2.5	104.22.21.170
Oct 3, 2024 10:29:55.983035088 CEST	443	49734	104.22.21.170	192.168.2.5
Oct 3, 2024 10:29:55.983072042 CEST	49734	443	192.168.2.5	104.22.21.170
Oct 3, 2024 10:29:55.983894110 CEST	443	49734	104.22.21.170	192.168.2.5
Oct 3, 2024 10:29:55.983912945 CEST	443	49734	104.22.21.170	192.168.2.5
Oct 3, 2024 10:29:55.983942986 CEST	443	49734	104.22.21.170	192.168.2.5
Oct 3, 2024 10:29:55.983951092 CEST	49734	443	192.168.2.5	104.22.21.170
Oct 3, 2024 10:29:55.983957052 CEST	443	49734	104.22.21.170	192.168.2.5
Oct 3, 2024 10:29:55.983993053 CEST	49734	443	192.168.2.5	104.22.21.170
Oct 3, 2024 10:29:55.983999014 CEST	443	49734	104.22.21.170	192.168.2.5
Oct 3, 2024 10:29:55.984038115 CEST	443	49734	104.22.21.170	192.168.2.5
Oct 3, 2024 10:29:55.984174013 CEST	49734	443	192.168.2.5	104.22.21.170
Oct 3, 2024 10:29:55.988214016 CEST	49734	443	192.168.2.5	104.22.21.170

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 3, 2024 10:29:53.628762960 CEST	49675	53	192.168.2.5	1.1.1.1
Oct 3, 2024 10:29:53.638720036 CEST	53	49675	1.1.1.1	192.168.2.5

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Oct 3, 2024 10:29:53.628762960 CEST	192.168.2.5	1.1.1.1	0x379a	Standard query (0)	api.fastestvpn.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Oct 3, 2024 10:29:44.884237051 CEST	1.1.1.1	192.168.2.5	0x15de	No error (0)	fp2e7a.wpc.2be4.phicdn.net	fp2e7a.wpc.phicdn.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 3, 2024 10:29:44.884237051 CEST	1.1.1.1	192.168.2.5	0x15de	No error (0)	fp2e7a.wpc.phicdn.net		192.229.221.95	A (IP address)	IN (0x0001)	false
Oct 3, 2024 10:29:53.638720036 CEST	1.1.1.1	192.168.2.5	0x379a	No error (0)	api.fastestvpn.com		104.22.21.170	A (IP address)	IN (0x0001)	false
Oct 3, 2024 10:29:53.638720036 CEST	1.1.1.1	192.168.2.5	0x379a	No error (0)	api.fastestvpn.com		172.67.39.187	A (IP address)	IN (0x0001)	false
Oct 3, 2024 10:29:53.638720036 CEST	1.1.1.1	192.168.2.5	0x379a	No error (0)	api.fastestvpn.com		104.22.20.170	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

api.fastestvpn.com

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49734	104.22.21.170	443	6020	C:\Program Files\FastestVPN\FastestVPN.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-03 08:29:54 UTC	258	OUT	POST /v2/authenticate HTTP/1.1 xplatform: windows xplatformtoken: _1032024043022 Content-Type: application/json; charset=UTF-8 Host: api.fastestvpn.com Content-Length: 104 Expect: 100-continue Accept-Encoding: gzip, deflate Connection: Keep-Alive
2024-10-03 08:29:54 UTC	25	IN	HTTP/1.1 100 Continue
2024-10-03 08:29:54 UTC	104	OUT	Data Raw: 7b 22 65 6d 61 69 6c 22 3a 6e 75 6c 6c 2c 22 70 61 73 73 77 6f 72 64 22 3a 6e 75 6c 6c 2c 22 70 6c 61 74 66 6f 72 6d 22 3a 22 77 69 6e 64 6f 77 73 22 2c 22 76 65 72 73 69 6f 6e 22 3a 22 57 69 6e 64 6f 77 73 20 31 30 20 45 6e 74 65 72 70 72 69 73 65 5f 32 32 48 32 5f 31 39 30 34 35 22 2c 22 64 65 76 22 3a 31 7d Data Ascii: {"email":null,"password":null,"platform":"windows","version":"Windows 10 Enterprise_22H2_19045","dev":1}
2024-10-03 08:29:55 UTC	1369	IN	HTTP/1.1 200 OK Date: Thu, 03 Oct 2024 08:29:55 GMT Content-Type: application/json Transfer-Encoding: chunked Connection: close Cache-Control: no-cache, private x-ratelimit-limit: 30 x-ratelimit-remaining: 29 access-control-allow-origin: * CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 8ccb912f6edf8c83-EWR 7e50 {"servers":[{"name":"Servers","servers":[{"id":3,"continent":"Europe","country":"France","state":"Paris","city":"Paris","name":"France","server_name":"Paris","is_fav":false,"dns":"fr.jumptoserver.com","iso":"FR","country_sort":1000,"lt":"48.8714","lg":"2.32141","ip":"146.70.40.99","address":"60 Rue de Rivoli, 75004 Paris, France","port":4443,"protocol":"UDP","ipsec":"","remote_id":null,"is_trial":false,"active":true,"flag":"https:\/\/fastestvpn.com\/flags\/fr.png","is_favourited":false,"connection_count":62,"wg_key":"658QxufMbjOTmB61Z7f+c7Rjg7oqWLnepTalqBERjF0=","enable":1,"streaming":"0","dvpn":"0","is_p2p":"0"},{"id":4,"continent":"Europe","country":"France","state":"Paris","city":"Paris","name":"France","server_name":"Paris","is_fav":false,"dns":"fr.jumptoserver.com","iso":"FR","country_sort":1000,"lt":"48.8714","lg":"2.32141","ip":"146.70.40.99","address":"60 Rue de Rivoli, 75004 Paris, France","port":4443,"protocol":"TCP","ipsec":"","remote_id":null,"is_trial":false,"active":true,"flag":"https:\/\/fastes [TRUNCATED]
2024-10-03 08:29:55 UTC	1369	IN	Data Raw: 61 67 73 5c 2f 66 72 2e 70 6e 67 22 2c 22 69 73 5f 66 61 76 6f 75 72 69 74 65 64 22 3a 66 61 6c 73 65 2c 22 63 6f 6e 6e 65 63 74 69 6f 6e 5f 63 6f 75 6e 74 22 3a 34 36 2c 22 77 67 5f 6b 65 79 22 3a 22 36 35 38 51 78 75 66 4d 62 6a 4f 54 6d 42 36 31 5a 37 66 2b 63 37 52 6a 67 37 6f 71 57 4c 6e 65 70 54 61 6c 71 42 45 52 6a 46 30 3d 22 2c 22 65 6e 61 62 6c 65 22 3a 31 2c 22 73 74 72 65 61 6d 69 6e 67 22 3a 22 30 22 2c 22 64 76 70 6e 22 3a 22 30 22 2c 22 69 73 5f 70 32 70 22 3a 22 30 22 7d 2c 7b 22 69 64 22 3a 35 2c 22 63 6f 6e 74 69 6e 65 6e 74 22 3a 22 45 75 72 6f 70 65 22 2c 22 63 6f 75 6e 74 72 79 22 3a 22 46 72 61 6e 63 65 22 2c 22 73 74 61 74 65 22 3a 22 50 61 72 69 73 22 2c 22 63 69 74 79 22 3a 22 50 61 72 69 73 22 2c 22 6e 61 6d 65 22 3a 22 46 72 61 Data Ascii: ags\/fr.png","is_favourited":false,"connection_count":46,"wg_key":"658QxufMbjOTmB61Z7f+c7Rjg7oqWLnepTalqBERjF0=","enable":1,"streaming":"0","dvpn":"0","is_p2p":"0"},{"id":5,"continent":"Europe","country":"France","state":"Paris","city":"Paris","name":"Fra
2024-10-03 08:29:55 UTC	1369	IN	Data Raw: 2c 22 63 6f 75 6e 74 72 79 22 3a 22 4e 65 74 68 65 72 6c 61 6e 64 73 22 2c 22 73 74 61 74 65 22 3a 22 4e 6f 6f 72 64 2d 48 6f 6c 6c 61 6e 64 22 2c 22 63 69 74 79 22 3a 6e 75 6c 6c 2c 22 6e 61 6d 65 22 3a 22 4e 65 74 68 65 72 6c 61 6e 64 73 20 31 22 2c 22 73 65 72 76 65 72 5f 6e 61 6d 65 22 3a 22 41 6d 73 74 65 72 64 61 6d 22 2c 22 69 73 5f 66 61 76 22 3a 66 61 6c 73 65 2c 22 64 6e 73 22 3a 22 6e 6c 2d 30 31 2e 6a 75 6d 70 74 6f 73 65 72 76 65 72 2e 63 6f 6d 22 2c 22 69 73 6f 22 3a 22 4e 4c 22 2c 22 63 6f 75 6e 74 72 79 5f 73 6f 72 74 22 3a 31 30 30 30 2c 22 6c 74 22 3a 22 35 31 2e 38 34 32 35 22 2c 22 6c 67 22 3a 22 35 2e 38 35 32 37 38 22 2c 22 69 70 22 3a 22 31 30 38 2e 31 38 31 2e 31 32 33 2e 37 34 22 2c 22 61 64 64 72 65 73 73 22 3a 22 41 6e 64 72 69 Data Ascii: ,"country":"Netherlands","state":"Noord-Holland","city":null,"name":"Netherlands 1","server_name":"Amsterdam","is_fav":false,"dns":"nl-01.jumptoserver.com","iso":"NL","country_sort":1000,"lt":"51.8425","lg":"5.85278","ip":"108.181.123.74","address":"Andri
2024-10-03 08:29:55 UTC	1369	IN	Data Raw: 6e 61 6d 65 22 3a 22 41 6d 73 74 65 72 64 61 6d 22 2c 22 69 73 5f 66 61 76 22 3a 66 61 6c 73 65 2c 22 64 6e 73 22 3a 22 6e 6c 2d 30 31 2e 6a 75 6d 70 74 6f 73 65 72 76 65 72 2e 63 6f 6d 22 2c 22 69 73 6f 22 3a 22 4e 4c 22 2c 22 63 6f 75 6e 74 72 79 5f 73 6f 72 74 22 3a 31 30 30 30 2c 22 6c 74 22 3a 22 35 31 2e 38 34 32 35 22 2c 22 6c 67 22 3a 22 35 2e 38 35 32 37 38 22 2c 22 69 70 22 3a 22 31 30 38 2e 31 38 31 2e 31 32 33 2e 37 34 22 2c 22 61 64 64 72 65 73 73 22 3a 22 53 70 75 69 73 74 72 61 61 74 20 31 33 34 61 66 64 2e 47 65 73 63 68 2e 2c 20 31 30 31 32 20 56 42 20 41 6d 73 74 65 72 64 61 6d 2c 20 4e 65 74 68 65 72 6c 61 6e 64 73 22 2c 22 70 6f 72 74 22 3a 34 34 34 33 2c 22 70 72 6f 74 6f 63 6f 6c 22 3a 22 55 44 50 22 2c 22 69 70 73 65 63 22 3a 22 22 Data Ascii: name":"Amsterdam","is_fav":false,"dns":"nl-01.jumptoserver.com","iso":"NL","country_sort":1000,"lt":"51.8425","lg":"5.85278","ip":"108.181.123.74","address":"Spuistraat 134afd.Gesch., 1012 VB Amsterdam, Netherlands","port":4443,"protocol":"UDP","ipsec":""
2024-10-03 08:29:55 UTC	1369	IN	Data Raw: 22 3a 22 39 35 2e 31 37 34 2e 36 34 2e 31 32 32 22 2c 22 61 64 64 72 65 73 73 22 3a 22 56 69 61 6c 65 20 64 65 6c 6c 61 20 56 65 6e 65 7a 69 61 20 47 69 75 6c 69 61 2c 20 31 30 2c 20 30 30 31 37 37 20 52 6f 6d 61 20 52 4d 2c 20 49 74 61 6c 79 22 2c 22 70 6f 72 74 22 3a 34 34 34 33 2c 22 70 72 6f 74 6f 63 6f 6c 22 3a 22 50 50 54 50 22 2c 22 69 70 73 65 63 22 3a 22 22 2c 22 72 65 6d 6f 74 65 5f 69 64 22 3a 6e 75 6c 6c 2c 22 69 73 5f 74 72 69 61 6c 22 3a 66 61 6c 73 65 2c 22 61 63 74 69 76 65 22 3a 74 72 75 65 2c 22 66 6c 61 67 22 3a 22 68 74 74 70 73 3a 5c 2f 5c 2f 66 61 73 74 65 73 74 76 70 6e 2e 63 6f 6d 5c 2f 66 6c 61 67 73 5c 2f 69 74 2e 70 6e 67 22 2c 22 69 73 5f 66 61 76 6f 75 72 69 74 65 64 22 3a 66 61 6c 73 65 2c 22 63 6f 6e 6e 65 63 74 69 6f 6e 5f Data Ascii: ":"95.174.64.122","address":"Viale della Venezia Giulia, 10, 00177 Roma RM, Italy","port":4443,"protocol":"PPTP","ipsec":"","remote_id":null,"is_trial":false,"active":true,"flag":"https:\/\/fastestvpn.com\/flags\/it.png","is_favourited":false,"connection_
2024-10-03 08:29:55 UTC	1369	IN	Data Raw: 5f 74 72 69 61 6c 22 3a 66 61 6c 73 65 2c 22 61 63 74 69 76 65 22 3a 74 72 75 65 2c 22 66 6c 61 67 22 3a 22 68 74 74 70 73 3a 5c 2f 5c 2f 66 61 73 74 65 73 74 76 70 6e 2e 63 6f 6d 5c 2f 66 6c 61 67 73 5c 2f 69 74 2e 70 6e 67 22 2c 22 69 73 5f 66 61 76 6f 75 72 69 74 65 64 22 3a 66 61 6c 73 65 2c 22 63 6f 6e 6e 65 63 74 69 6f 6e 5f 63 6f 75 6e 74 22 3a 36 36 2c 22 77 67 5f 6b 65 79 22 3a 22 36 35 38 51 78 75 66 4d 62 6a 4f 54 6d 42 36 31 5a 37 66 2b 63 37 52 6a 67 37 6f 71 57 4c 6e 65 70 54 61 6c 71 42 45 52 6a 46 30 3d 22 2c 22 65 6e 61 62 6c 65 22 3a 31 2c 22 73 74 72 65 61 6d 69 6e 67 22 3a 22 30 22 2c 22 64 76 70 6e 22 3a 22 30 22 2c 22 69 73 5f 70 32 70 22 3a 22 30 22 7d 2c 7b 22 69 64 22 3a 31 37 2c 22 63 6f 6e 74 69 6e 65 6e 74 22 3a 22 45 75 72 6f Data Ascii: _trial":false,"active":true,"flag":"https:\/\/fastestvpn.com\/flags\/it.png","is_favourited":false,"connection_count":66,"wg_key":"658QxufMbjOTmB61Z7f+c7Rjg7oqWLnepTalqBERjF0=","enable":1,"streaming":"0","dvpn":"0","is_p2p":"0"},{"id":17,"continent":"Euro
2024-10-03 08:29:55 UTC	1369	IN	Data Raw: 6c 71 42 45 52 6a 46 30 3d 22 2c 22 65 6e 61 62 6c 65 22 3a 31 2c 22 73 74 72 65 61 6d 69 6e 67 22 3a 22 30 22 2c 22 64 76 70 6e 22 3a 22 30 22 2c 22 69 73 5f 70 32 70 22 3a 22 30 22 7d 2c 7b 22 69 64 22 3a 31 39 2c 22 63 6f 6e 74 69 6e 65 6e 74 22 3a 22 45 75 72 6f 70 65 22 2c 22 63 6f 75 6e 74 72 79 22 3a 22 49 74 61 6c 79 22 2c 22 73 74 61 74 65 22 3a 22 4c 6f 6d 62 61 72 64 79 22 2c 22 63 69 74 79 22 3a 22 6d 69 6c 61 6e 22 2c 22 6e 61 6d 65 22 3a 22 49 74 61 6c 79 22 2c 22 73 65 72 76 65 72 5f 6e 61 6d 65 22 3a 22 4d 69 6c 61 6e 22 2c 22 69 73 5f 66 61 76 22 3a 66 61 6c 73 65 2c 22 64 6e 73 22 3a 22 69 74 2d 30 31 2e 6a 75 6d 70 74 6f 73 65 72 76 65 72 2e 63 6f 6d 22 2c 22 69 73 6f 22 3a 22 49 54 22 2c 22 63 6f 75 6e 74 72 79 5f 73 6f 72 74 22 3a 31 Data Ascii: lqBERjF0=","enable":1,"streaming":"0","dvpn":"0","is_p2p":"0"},{"id":19,"continent":"Europe","country":"Italy","state":"Lombardy","city":"milan","name":"Italy","server_name":"Milan","is_fav":false,"dns":"it-01.jumptoserver.com","iso":"IT","country_sort":1
2024-10-03 08:29:55 UTC	1369	IN	Data Raw: 22 2c 22 73 65 72 76 65 72 5f 6e 61 6d 65 22 3a 22 48 65 73 70 65 72 61 6e 67 65 22 2c 22 69 73 5f 66 61 76 22 3a 66 61 6c 73 65 2c 22 64 6e 73 22 3a 22 6c 75 78 31 2e 6a 75 6d 70 74 6f 73 65 72 76 65 72 2e 63 6f 6d 22 2c 22 69 73 6f 22 3a 22 4c 55 22 2c 22 63 6f 75 6e 74 72 79 5f 73 6f 72 74 22 3a 31 30 30 30 2c 22 6c 74 22 3a 22 34 39 2e 36 31 31 33 22 2c 22 6c 67 22 3a 22 36 2e 31 32 39 34 22 2c 22 69 70 22 3a 22 35 2e 32 35 33 2e 32 30 34 2e 34 33 22 2c 22 61 64 64 72 65 73 73 22 3a 22 31 20 52 75 65 20 50 61 75 6c 20 45 79 73 63 68 65 6e 2c 20 37 33 31 37 20 4d 5c 75 30 30 66 63 6c 6c 65 6e 64 6f 72 66 2c 20 4c 75 78 65 6d 62 6f 75 72 67 22 2c 22 70 6f 72 74 22 3a 34 34 34 33 2c 22 70 72 6f 74 6f 63 6f 6c 22 3a 22 49 4b 45 56 32 22 2c 22 69 70 73 65 Data Ascii: ","server_name":"Hesperange","is_fav":false,"dns":"lux1.jumptoserver.com","iso":"LU","country_sort":1000,"lt":"49.6113","lg":"6.1294","ip":"5.253.204.43","address":"1 Rue Paul Eyschen, 7317 M\u00fcllendorf, Luxembourg","port":4443,"protocol":"IKEV2","ipse
2024-10-03 08:29:55 UTC	1369	IN	Data Raw: 31 32 39 34 22 2c 22 69 70 22 3a 22 35 2e 32 35 33 2e 32 30 34 2e 34 33 22 2c 22 61 64 64 72 65 73 73 22 3a 22 31 20 52 75 65 20 50 61 75 6c 20 45 79 73 63 68 65 6e 2c 20 37 33 31 37 20 4d 5c 75 30 30 66 63 6c 6c 65 6e 64 6f 72 66 2c 20 4c 75 78 65 6d 62 6f 75 72 67 22 2c 22 70 6f 72 74 22 3a 34 34 34 33 2c 22 70 72 6f 74 6f 63 6f 6c 22 3a 22 55 44 50 22 2c 22 69 70 73 65 63 22 3a 22 22 2c 22 72 65 6d 6f 74 65 5f 69 64 22 3a 6e 75 6c 6c 2c 22 69 73 5f 74 72 69 61 6c 22 3a 66 61 6c 73 65 2c 22 61 63 74 69 76 65 22 3a 74 72 75 65 2c 22 66 6c 61 67 22 3a 22 68 74 74 70 73 3a 5c 2f 5c 2f 66 61 73 74 65 73 74 76 70 6e 2e 63 6f 6d 5c 2f 66 6c 61 67 73 5c 2f 6c 75 2e 70 6e 67 22 2c 22 69 73 5f 66 61 76 6f 75 72 69 74 65 64 22 3a 66 61 6c 73 65 2c 22 63 6f 6e 6e Data Ascii: 1294","ip":"5.253.204.43","address":"1 Rue Paul Eyschen, 7317 M\u00fcllendorf, Luxembourg","port":4443,"protocol":"UDP","ipsec":"","remote_id":null,"is_trial":false,"active":true,"flag":"https:\/\/fastestvpn.com\/flags\/lu.png","is_favourited":false,"conn
2024-10-03 08:29:55 UTC	1369	IN	Data Raw: 74 72 69 61 6c 22 3a 66 61 6c 73 65 2c 22 61 63 74 69 76 65 22 3a 74 72 75 65 2c 22 66 6c 61 67 22 3a 22 68 74 74 70 73 3a 5c 2f 5c 2f 66 61 73 74 65 73 74 76 70 6e 2e 63 6f 6d 5c 2f 66 6c 61 67 73 5c 2f 72 6f 2e 70 6e 67 22 2c 22 69 73 5f 66 61 76 6f 75 72 69 74 65 64 22 3a 66 61 6c 73 65 2c 22 63 6f 6e 6e 65 63 74 69 6f 6e 5f 63 6f 75 6e 74 22 3a 34 34 2c 22 77 67 5f 6b 65 79 22 3a 22 36 35 38 51 78 75 66 4d 62 6a 4f 54 6d 42 36 31 5a 37 66 2b 63 37 52 6a 67 37 6f 71 57 4c 6e 65 70 54 61 6c 71 42 45 52 6a 46 30 3d 22 2c 22 65 6e 61 62 6c 65 22 3a 31 2c 22 73 74 72 65 61 6d 69 6e 67 22 3a 22 30 22 2c 22 64 76 70 6e 22 3a 22 30 22 2c 22 69 73 5f 70 32 70 22 3a 22 30 22 7d 2c 7b 22 69 64 22 3a 33 36 2c 22 63 6f 6e 74 69 6e 65 6e 74 22 3a 22 45 75 72 6f 70 Data Ascii: trial":false,"active":true,"flag":"https:\/\/fastestvpn.com\/flags\/ro.png","is_favourited":false,"connection_count":44,"wg_key":"658QxufMbjOTmB61Z7f+c7Rjg7oqWLnepTalqBERjF0=","enable":1,"streaming":"0","dvpn":"0","is_p2p":"0"},{"id":36,"continent":"Europ

Target ID:	0
Start time:	04:28:57
Start date:	03/10/2024
Path:	C:\Users\user\Desktop\PVUfopbGfc.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\PVUfopbGfc.exe"
Imagebase:	0x400000
File size:	21'250'384 bytes
MD5 hash:	249ED615E8B43896FFFD3CB3755C7A0A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	04:28:57
Start date:	03/10/2024
Path:	C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\is-QNOJK.tmp\PVUfopbGfc.tmp" /SL5="$1046E,20382094,735744,C:\Users\user\Desktop\PVUfopbGfc.exe"
Imagebase:	0x400000
File size:	3'045'888 bytes
MD5 hash:	259E3EE4646FC251C3513EEF2683479F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Yara matches:	Rule: JoeSecurity_UACBypassusingCMSTP, Description: Yara detected UAC Bypass using CMSTP, Source: 00000001.00000003.2675219520.00000000054B0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	04:29:27
Start date:	03/10/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\system32\cmd.exe" /C ""C:\Program Files\FastestVPN\Resources\driver\install_tap.bat""
Imagebase:	0x7ff664950000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	04:29:27
Start date:	03/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	04:29:27
Start date:	03/10/2024
Path:	C:\Windows\System32\reg.exe
Wow64 process (32bit):	false
Commandline:	reg Query "HKLM\Hardware\Description\System\CentralProcessor\0"
Imagebase:	0x7ff6d0160000
File size:	77'312 bytes
MD5 hash:	227F63E1D9008B36BDBCC4B397780BE4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	04:29:27
Start date:	03/10/2024
Path:	C:\Windows\System32\find.exe
Wow64 process (32bit):	false
Commandline:	find /i "x86"
Imagebase:	0x7ff78ee60000
File size:	17'920 bytes
MD5 hash:	4BF76A28D31FC73AA9FC970B22D056AF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	04:29:27
Start date:	03/10/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c ver
Imagebase:	0x7ff664950000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	04:29:27
Start date:	03/10/2024
Path:	C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exe
Wow64 process (32bit):	false
Commandline:	tapinstall.exe remove tap0901
Imagebase:	0x7ff70a9e0000
File size:	507'728 bytes
MD5 hash:	E313336C82EB265542664CC7A360C5FF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	04:29:28
Start date:	03/10/2024
Path:	C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exe
Wow64 process (32bit):	false
Commandline:	tapinstall.exe install OemVista.inf tap0901
Imagebase:	0x7ff70a9e0000
File size:	507'728 bytes
MD5 hash:	E313336C82EB265542664CC7A360C5FF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	04:29:29
Start date:	03/10/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\svchost.exe -k DcomLaunch -p -s DeviceInstall
Imagebase:	0x7ff7e52b0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	13
Start time:	04:29:29
Start date:	03/10/2024
Path:	C:\Windows\System32\drvinst.exe
Wow64 process (32bit):	false
Commandline:	DrvInst.exe "4" "0" "C:\Users\user\AppData\Local\Temp\{d561b4bd-4963-934e-b2b1-0e0727e36250}\oemvista.inf" "9" "4d14a44ff" "0000000000000160" "WinSta0\Default" "0000000000000158" "208" "c:\program files\fastestvpn\resources\driver\windows10\amd64"
Imagebase:	0x7ff6d64d0000
File size:	337'920 bytes
MD5 hash:	294990C88B9D1FE0A54A1FA8BF4324D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	04:29:30
Start date:	03/10/2024
Path:	C:\Windows\System32\drvinst.exe
Wow64 process (32bit):	false
Commandline:	DrvInst.exe "2" "211" "ROOT\NET\0000" "C:\Windows\INF\oem4.inf" "oem4.inf:3beb73aff103cc24:tap0901.ndi:9.24.2.601:tap0901," "4d14a44ff" "0000000000000180"
Imagebase:	0x7ff7bd6a0000
File size:	337'920 bytes
MD5 hash:	294990C88B9D1FE0A54A1FA8BF4324D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	15
Start time:	04:29:31
Start date:	03/10/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s NetSetupSvc
Imagebase:	0x7ff7e52b0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	16
Start time:	04:29:33
Start date:	03/10/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\system32\cmd.exe" /C ""C:\Program Files\FastestVPN\Resources\sp\install_sp.bat""
Imagebase:	0x7ff664950000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	17
Start time:	04:29:33
Start date:	03/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	18
Start time:	04:29:33
Start date:	03/10/2024
Path:	C:\Windows\System32\sc.exe
Wow64 process (32bit):	false
Commandline:	sc stop fastestvpndriver
Imagebase:	0x7ff746bb0000
File size:	72'192 bytes
MD5 hash:	3FB5CF71F7E7EB49790CB0E663434D80
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	19
Start time:	04:29:33
Start date:	03/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	20
Start time:	04:29:33
Start date:	03/10/2024
Path:	C:\Windows\System32\reg.exe
Wow64 process (32bit):	false
Commandline:	reg Query "HKLM\Hardware\Description\System\CentralProcessor\0"
Imagebase:	0x7ff6d0160000
File size:	77'312 bytes
MD5 hash:	227F63E1D9008B36BDBCC4B397780BE4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	21
Start time:	04:29:33
Start date:	03/10/2024
Path:	C:\Windows\System32\find.exe
Wow64 process (32bit):	false
Commandline:	find /i "x86"
Imagebase:	0x7ff78ee60000
File size:	17'920 bytes
MD5 hash:	4BF76A28D31FC73AA9FC970B22D056AF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	22
Start time:	04:29:33
Start date:	03/10/2024
Path:	C:\Windows\System32\reg.exe
Wow64 process (32bit):	false
Commandline:	reg QUERY "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion"
Imagebase:	0x7ff6d0160000
File size:	77'312 bytes
MD5 hash:	227F63E1D9008B36BDBCC4B397780BE4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	23
Start time:	04:29:33
Start date:	03/10/2024
Path:	C:\Windows\System32\find.exe
Wow64 process (32bit):	false
Commandline:	find /i "Windows 7"
Imagebase:	0x7ff78ee60000
File size:	17'920 bytes
MD5 hash:	4BF76A28D31FC73AA9FC970B22D056AF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	24
Start time:	04:29:33
Start date:	03/10/2024
Path:	C:\Windows\System32\xcopy.exe
Wow64 process (32bit):	false
Commandline:	xcopy /y driver\windows8\amd64\fastestvpndriver.sys C:\Windows\system32\drivers
Imagebase:	0x7ff7dd650000
File size:	50'688 bytes
MD5 hash:	39FBFD3AF58238C6F9D4D408C9251FF5
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	25
Start time:	04:29:34
Start date:	03/10/2024
Path:	C:\Program Files\FastestVPN\Resources\sp\release\nfregdrv.exe
Wow64 process (32bit):	true
Commandline:	release\nfregdrv.exe -u fastestvpndriver
Imagebase:	0x400000
File size:	61'064 bytes
MD5 hash:	9333F583E2D32A47276DCEC7C2391FD2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	26
Start time:	04:29:34
Start date:	03/10/2024
Path:	C:\Program Files\FastestVPN\Resources\sp\release\nfregdrv.exe
Wow64 process (32bit):	true
Commandline:	release\nfregdrv.exe fastestvpndriver
Imagebase:	0x400000
File size:	61'064 bytes
MD5 hash:	9333F583E2D32A47276DCEC7C2391FD2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	27
Start time:	04:29:34
Start date:	03/10/2024
Path:	C:\Windows\System32\sc.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\system32\sc.exe" stop FastestVPNService
Imagebase:	0x7ff746bb0000
File size:	72'192 bytes
MD5 hash:	3FB5CF71F7E7EB49790CB0E663434D80
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	28
Start time:	04:29:34
Start date:	03/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	29
Start time:	04:29:34
Start date:	03/10/2024
Path:	C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe" --uninstall
Imagebase:	0xe20000
File size:	25'768 bytes
MD5 hash:	22D4E4267DFE093E5E23C2F3D7741AA4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	30
Start time:	04:29:35
Start date:	03/10/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k WerSvcGroup
Imagebase:	0x7ff7e52b0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	31
Start time:	04:29:36
Start date:	03/10/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 6276 -ip 6276
Imagebase:	0x9c0000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	32
Start time:	04:29:36
Start date:	03/10/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 6276 -s 1076
Imagebase:	0x9c0000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	33
Start time:	04:29:37
Start date:	03/10/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc
Imagebase:	0x7ff7e52b0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	34
Start time:	04:29:39
Start date:	03/10/2024
Path:	C:\Program Files\FastestVPN\FastestVPN.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files\FastestVPN\FastestVPN.exe" -autorun
Imagebase:	0x8f0000
File size:	2'059'432 bytes
MD5 hash:	01CF6EF766C41BB2C99A2CCCDECC69C1
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	35
Start time:	04:29:41
Start date:	03/10/2024
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	"powershell" -windowstyle hidden get-wmiobject Win32_ComputerSystemProduct \| Select-Object -ExpandProperty UUID
Imagebase:	0xc0000
File size:	433'152 bytes
MD5 hash:	C32CA4ACFCC635EC1EA6ED8A34DF5FAC
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	37
Start time:	04:29:41
Start date:	03/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	38
Start time:	04:29:41
Start date:	03/10/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff7e52b0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	40
Start time:	04:29:52
Start date:	03/10/2024
Path:	C:\Windows\System32\sc.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\system32\sc.exe" delete FastestVPNService
Imagebase:	0x7ff746bb0000
File size:	72'192 bytes
MD5 hash:	3FB5CF71F7E7EB49790CB0E663434D80
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	41
Start time:	04:29:52
Start date:	03/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	42
Start time:	04:29:52
Start date:	03/10/2024
Path:	C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe" --install
Imagebase:	0x480000
File size:	25'768 bytes
MD5 hash:	22D4E4267DFE093E5E23C2F3D7741AA4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	43
Start time:	04:29:54
Start date:	03/10/2024
Path:	C:\Program Files\FastestVPN\subinacl.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files\FastestVPN\subinacl.exe" /service FastestVPNService /GRANT=everyone=TO
Imagebase:	0x1000000
File size:	301'224 bytes
MD5 hash:	4798226EE22C513302EE57D3AA94398B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	44
Start time:	04:29:54
Start date:	03/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	45
Start time:	04:29:55
Start date:	03/10/2024
Path:	C:\Windows\System32\sc.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\system32\sc.exe" start FastestVPNService
Imagebase:	0x7ff746bb0000
File size:	72'192 bytes
MD5 hash:	3FB5CF71F7E7EB49790CB0E663434D80
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	46
Start time:	04:29:55
Start date:	03/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	47
Start time:	04:29:55
Start date:	03/10/2024
Path:	C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe"
Imagebase:	0xc10000
File size:	25'768 bytes
MD5 hash:	22D4E4267DFE093E5E23C2F3D7741AA4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	48
Start time:	04:29:55
Start date:	03/10/2024
Path:	C:\Program Files\FastestVPN\Resources\ComDebug.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\FastestVPN\Resources\ComDebug.exe"
Imagebase:	0x7ff6623b0000
File size:	256'912 bytes
MD5 hash:	850A43E323656B86AE665D8B4FD71369
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	49
Start time:	04:29:57
Start date:	03/10/2024
Path:	C:\Windows\System32\dllhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}
Imagebase:	0x7ff669820000
File size:	21'312 bytes
MD5 hash:	08EB78E5BE019DF044C26B14703BD1FA
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	50
Start time:	04:30:00
Start date:	03/10/2024
Path:	C:\Windows\SysWOW64\netsh.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\netsh.exe
Imagebase:	0x1080000
File size:	82'432 bytes
MD5 hash:	4E89A1A088BE715D6C946E55AB07C7DF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	51
Start time:	04:30:00
Start date:	03/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	52
Start time:	04:30:00
Start date:	03/10/2024
Path:	C:\Program Files\FastestVPN\FastestVPN.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files\FastestVPN\FastestVPN.exe"
Imagebase:	0x200000
File size:	2'059'432 bytes
MD5 hash:	01CF6EF766C41BB2C99A2CCCDECC69C1
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	53
Start time:	04:30:11
Start date:	03/10/2024
Path:	C:\Users\user\AppData\Local\Temp\Launcher.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\Launcher.exe
Imagebase:	0x3a0000
File size:	77'928 bytes
MD5 hash:	F43C6B629BAAAAEE1E7FE095A8821631
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	1.5%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	24.8%
Total number of Nodes:	214
Total number of Limit Nodes:	4

Executed Functions

Function 00007FF70A9E41D0 Relevance: 18.3, APIs: 12, Instructions: 338
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetupDiClassGuidsFromNameExW.SETUPAPI ref: 00007FF70A9E42C8
GetLastError.KERNEL32 ref: 00007FF70A9E42D2
SetupDiDestroyDeviceInfoList.SETUPAPI ref: 00007FF70A9E4300
CharNextW.USER32 ref: 00007FF70A9E43C2
CharNextW.USER32 ref: 00007FF70A9E43D6
SetupDiCreateDeviceInfoListExW.SETUPAPI ref: 00007FF70A9E445C
SetupDiGetClassDevsExW.SETUPAPI ref: 00007FF70A9E44A3
SetupDiOpenDeviceInfoW.SETUPAPI ref: 00007FF70A9E44F9
SetupDiGetDeviceInfoListDetailW.SETUPAPI ref: 00007FF70A9E4524
SetupDiEnumDeviceInfo.SETUPAPI ref: 00007FF70A9E455C
CM_Get_Device_ID_ExW.SETUPAPI ref: 00007FF70A9E45C8
SetupDiEnumDeviceInfo.SETUPAPI ref: 00007FF70A9E4702

Part of subcall function 00007FF70A9E4820: SetupDiGetDeviceRegistryPropertyW.SETUPAPI(?,?,?,?,?,?,00007FF70A9E4624), ref: 00007FF70A9E487F
Part of subcall function 00007FF70A9E4820: GetLastError.KERNEL32(?,?,?,?,?,?,00007FF70A9E4624), ref: 00007FF70A9E4894
Part of subcall function 00007FF70A9E4820: SetupDiGetDeviceRegistryPropertyW.SETUPAPI(?,?,?,?,?,?,?,?,?,00007FF70A9E4624), ref: 00007FF70A9E4906

Part of subcall function 00007FF70A9E50E0: CharNextW.USER32 ref: 00007FF70A9E517A

Memory Dump Source

Source File: 0000000A.00000002.2345199746.00007FF70A9E1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF70A9E0000, based on PE: true

Associated: 0000000A.00000002.2345173222.00007FF70A9E0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2345236578.00007FF70AA34000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2345264921.00007FF70AA47000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2345286816.00007FF70AA4A000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff70a9e0000_tapinstall.jbxd

Similarity

API ID: Setup$Device$Info$CharListNext$ClassEnumErrorLastPropertyRegistry$CreateDestroyDetailDevice_DevsFromGet_GuidsNameOpen
String ID:
API String ID: 1969824741-0
Opcode ID: e3fc275db21e76c52ccaa19e33234cd324650c93cf9cefaf585751d13ce00979
Instruction ID: 1a3f711d9bca4edab79e6bfa7d1a67e80329c2d97249104459b84cc09a9c6564
Opcode Fuzzy Hash: e3fc275db21e76c52ccaa19e33234cd324650c93cf9cefaf585751d13ce00979
Instruction Fuzzy Hash: 44E19F33B2CA8286FB20EF15E9402AAA3A0FF94B9CF844175DA4D87B95DF3DD5418710

Function 00007FF70A9E52E0 Relevance: 16.0, APIs: 8, Strings: 1, Instructions: 230
shutdownCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CharNextW.USER32 ref: 00007FF70A9E5339
CharNextW.USER32 ref: 00007FF70A9E5482
GetCurrentProcess.KERNEL32 ref: 00007FF70A9E55CD
OpenProcessToken.ADVAPI32 ref: 00007FF70A9E55E0
LookupPrivilegeValueW.ADVAPI32 ref: 00007FF70A9E55F8
AdjustTokenPrivileges.ADVAPI32 ref: 00007FF70A9E5637
CloseHandle.KERNEL32 ref: 00007FF70A9E5642
InitiateSystemShutdownExW.ADVAPI32 ref: 00007FF70A9E5662

Strings

SeShutdownPrivilege, xrefs: 00007FF70A9E55F1

Memory Dump Source

Source File: 0000000A.00000002.2345199746.00007FF70A9E1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF70A9E0000, based on PE: true

Associated: 0000000A.00000002.2345173222.00007FF70A9E0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2345236578.00007FF70AA34000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2345264921.00007FF70AA47000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2345286816.00007FF70AA4A000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff70a9e0000_tapinstall.jbxd

Similarity

API ID: CharNextProcessToken$AdjustCloseCurrentHandleInitiateLookupOpenPrivilegePrivilegesShutdownSystemValue
String ID: SeShutdownPrivilege
API String ID: 155161866-3733053543
Opcode ID: 690a37cff1ebd05a7ace56d9b70eff1ddf708b3d2d7106c5651630866a9856b2
Instruction ID: c1317b78ae604da6bf74996fc8effe1b3af72fce66036b3d771b53dbde23abc7
Opcode Fuzzy Hash: 690a37cff1ebd05a7ace56d9b70eff1ddf708b3d2d7106c5651630866a9856b2
Instruction Fuzzy Hash: B691D423B1C68242FB50EB19E804779A790FF94B8DF954075EA4E83796EF3CE4468320

Function 00007FF70A9E4820 Relevance: 4.6, APIs: 3, Instructions: 78
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetupDiGetDeviceRegistryPropertyW.SETUPAPI(?,?,?,?,?,?,00007FF70A9E4624), ref: 00007FF70A9E487F
GetLastError.KERNEL32(?,?,?,?,?,?,00007FF70A9E4624), ref: 00007FF70A9E4894
SetupDiGetDeviceRegistryPropertyW.SETUPAPI(?,?,?,?,?,?,?,?,?,00007FF70A9E4624), ref: 00007FF70A9E4906

Memory Dump Source

Source File: 0000000A.00000002.2345199746.00007FF70A9E1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF70A9E0000, based on PE: true

Associated: 0000000A.00000002.2345173222.00007FF70A9E0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2345236578.00007FF70AA34000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2345264921.00007FF70AA47000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2345286816.00007FF70AA4A000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff70a9e0000_tapinstall.jbxd

Similarity

API ID: DevicePropertyRegistrySetup$ErrorLast
String ID:
API String ID: 2536536880-0
Opcode ID: b08a90b2f0a11205ef17a48f86861e3f30d8e072d4f5542cce9f06ad5cb14e1f
Instruction ID: 51896516a60243bcf7cbca3060553d67b195ce275a6294692458e43cec6bd590
Opcode Fuzzy Hash: b08a90b2f0a11205ef17a48f86861e3f30d8e072d4f5542cce9f06ad5cb14e1f
Instruction Fuzzy Hash: FC31D423B1C78182FA20DB11F84026EA2A0FFD9F94F844275EA9D83B96DF3CD4018B50

Function 00007FF70A9E789C Relevance: 9.1, APIs: 6, Instructions: 103
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__security_init_cookie.LIBCMT ref: 00007FF70A9E78A0

Part of subcall function 00007FF70A9E8414: GetSystemTimeAsFileTime.KERNEL32 ref: 00007FF70A9E8440
Part of subcall function 00007FF70A9E8414: GetCurrentThreadId.KERNEL32 ref: 00007FF70A9E844E
Part of subcall function 00007FF70A9E8414: GetCurrentProcessId.KERNEL32 ref: 00007FF70A9E845A
Part of subcall function 00007FF70A9E8414: QueryPerformanceCounter.KERNEL32 ref: 00007FF70A9E846A

Part of subcall function 00007FF70A9E8124: __vcrt_initialize.LIBVCRUNTIME ref: 00007FF70A9E8146

__scrt_acquire_startup_lock.LIBCMT ref: 00007FF70A9E78D9
__scrt_release_startup_lock.LIBCMT ref: 00007FF70A9E7947
__scrt_is_managed_app.LIBCMT ref: 00007FF70A9E79BE
__scrt_fastfail.LIBCMT ref: 00007FF70A9E7A0C
__scrt_fastfail.LIBCMT ref: 00007FF70A9E7A17

Memory Dump Source

Source File: 0000000A.00000002.2345199746.00007FF70A9E1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF70A9E0000, based on PE: true

Associated: 0000000A.00000002.2345173222.00007FF70A9E0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2345236578.00007FF70AA34000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2345264921.00007FF70AA47000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2345286816.00007FF70AA4A000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff70a9e0000_tapinstall.jbxd

Similarity

API ID: CurrentTime__scrt_fastfail$CounterFilePerformanceProcessQuerySystemThread__scrt_acquire_startup_lock__scrt_is_managed_app__scrt_release_startup_lock__security_init_cookie__vcrt_initialize
String ID:
API String ID: 1566696921-0
Opcode ID: 5dc8b7a00be0a8ea12488835e6aaa7bc2ada64c6aaa8309da5ac7729ad6df155
Instruction ID: 08aa0f883f17796cfaf77d6a61e93d254a2b663c290464ef5a7d3ea6d79aaac1
Opcode Fuzzy Hash: 5dc8b7a00be0a8ea12488835e6aaa7bc2ada64c6aaa8309da5ac7729ad6df155
Instruction Fuzzy Hash: 77414A63F1C14342FA14FBA4DC116B99291AF65788FC085B8E64E8B3D3DF2CA8428271

Function 00007FF70AA2716C Relevance: 7.7, APIs: 5, Instructions: 203
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF70AA271AD
GetConsoleMode.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00007FF70AA2712B,?,?,?,00007FF70AA277D2), ref: 00007FF70AA2726C
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00007FF70AA2712B,?,?,?,00007FF70AA277D2), ref: 00007FF70AA272EC

Memory Dump Source

Source File: 0000000A.00000002.2345199746.00007FF70A9E1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF70A9E0000, based on PE: true

Associated: 0000000A.00000002.2345173222.00007FF70A9E0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2345236578.00007FF70AA34000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2345264921.00007FF70AA47000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2345286816.00007FF70AA4A000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff70a9e0000_tapinstall.jbxd

Similarity

API ID: ConsoleErrorLastMode_invalid_parameter_noinfo
String ID:
API String ID: 2210144848-0
Opcode ID: 5b577d0101186b3dee45c0514d8567f2aff468ee3d1ca196f04eb6bda83befe3
Instruction ID: fb9cbe6ebee12f9dac33cb38a492dd5686cb20073a0b84bf4915c5aae8ab8ebc
Opcode Fuzzy Hash: 5b577d0101186b3dee45c0514d8567f2aff468ee3d1ca196f04eb6bda83befe3
Instruction Fuzzy Hash: 37818EA3A1861285F761AB69DC80ABDA7A1BF44784FC00175DE0E63BD5DF38A566C330

Function 00007FF70A9E28B0 Relevance: 4.6, APIs: 3, Instructions: 94
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadStringW.USER32 ref: 00007FF70A9E2900
LoadStringW.USER32 ref: 00007FF70A9E2920
LoadStringW.USER32 ref: 00007FF70A9E2943

Part of subcall function 00007FF70A9E4770: FormatMessageW.KERNEL32(?,?,?,?,?,?,?,?,00000000,?,00007FF70A9E10DD), ref: 00007FF70A9E47B7
Part of subcall function 00007FF70A9E4770: LocalFree.KERNEL32(?,?,?,?,?,?,?,?,00000000,?,00007FF70A9E10DD), ref: 00007FF70A9E480B

Memory Dump Source

Source File: 0000000A.00000002.2345199746.00007FF70A9E1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF70A9E0000, based on PE: true

Associated: 0000000A.00000002.2345173222.00007FF70A9E0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2345236578.00007FF70AA34000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2345264921.00007FF70AA47000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2345286816.00007FF70AA4A000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff70a9e0000_tapinstall.jbxd

Similarity

API ID: LoadString$FormatFreeLocalMessage
String ID:
API String ID: 725706356-0
Opcode ID: d1c2bf7ba6e30959b680a2a26bbfb6c667ed2b04af53c45da1eed3ab1d55b066
Instruction ID: ed55803003f206a915d500c26c4a586aa64b316aead68be90cf763a08a77e689
Opcode Fuzzy Hash: d1c2bf7ba6e30959b680a2a26bbfb6c667ed2b04af53c45da1eed3ab1d55b066
Instruction Fuzzy Hash: 15417F73B1C68286FB70EB11E8407AAB2A4FF94748F904075DA4D93B96DF2DD855CB20

Function 00007FF70AA11608 Relevance: 4.5, APIs: 3, Instructions: 19
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32(?,?,?,00007FF70AA11607), ref: 00007FF70AA11631
TerminateProcess.KERNEL32(?,?,?,00007FF70AA11607), ref: 00007FF70AA1163C
ExitProcess.KERNEL32 ref: 00007FF70AA1164B

Memory Dump Source

Source File: 0000000A.00000002.2345199746.00007FF70A9E1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF70A9E0000, based on PE: true

Associated: 0000000A.00000002.2345173222.00007FF70A9E0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2345236578.00007FF70AA34000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2345264921.00007FF70AA47000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2345286816.00007FF70AA4A000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff70a9e0000_tapinstall.jbxd

Similarity

API ID: Process$CurrentExitTerminate
String ID:
API String ID: 1703294689-0
Opcode ID: 08b53547627d342cef18f15c3e291c34f31992f781596ea9132903bd88c460e4
Instruction ID: b59e12b8ee2b84cefa3237deb460c3f7de8f1504f0073a8d3bb11dd03795b349
Opcode Fuzzy Hash: 08b53547627d342cef18f15c3e291c34f31992f781596ea9132903bd88c460e4
Instruction Fuzzy Hash: 0BE048A7F0430143FA547770EC95E7992526F48742F9446BCDA1E423D2CF3DE44A8321

Function 00007FF70AA18634 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 19
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

try_get_function.LIBVCRUNTIME ref: 00007FF70AA18657

Strings

AppPolicyGetProcessTerminationMethod, xrefs: 00007FF70AA18650

Memory Dump Source

Source File: 0000000A.00000002.2345199746.00007FF70A9E1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF70A9E0000, based on PE: true

Associated: 0000000A.00000002.2345173222.00007FF70A9E0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2345236578.00007FF70AA34000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2345264921.00007FF70AA47000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2345286816.00007FF70AA4A000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff70a9e0000_tapinstall.jbxd

Similarity

API ID: try_get_function
String ID: AppPolicyGetProcessTerminationMethod
API String ID: 2742660187-2031265017
Opcode ID: 09745aa082c0f9a3d57ff4a42a6b74f56dafb84feddb837b008a725231bf0058
Instruction ID: 944c2e6789b0c6bacf5557d998528d248e3109eaacdc8fcaa564118b468dd824
Opcode Fuzzy Hash: 09745aa082c0f9a3d57ff4a42a6b74f56dafb84feddb837b008a725231bf0058
Instruction Fuzzy Hash: 84E04FD3E04606A1FA05E791EC409B092119F4C3B0EC803B2ED3C0A3E09F3C9996C760

Function 00007FF70AA26CE0 Relevance: 3.1, APIs: 2, Instructions: 74
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteFile.KERNELBASE ref: 00007FF70AA26D93
GetLastError.KERNEL32 ref: 00007FF70AA26DAF

Memory Dump Source

Source File: 0000000A.00000002.2345199746.00007FF70A9E1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF70A9E0000, based on PE: true

Associated: 0000000A.00000002.2345173222.00007FF70A9E0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2345236578.00007FF70AA34000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2345264921.00007FF70AA47000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2345286816.00007FF70AA4A000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff70a9e0000_tapinstall.jbxd

Similarity

API ID: ErrorFileLastWrite
String ID:
API String ID: 442123175-0
Opcode ID: db3742f2bb6f116d389edc3337e853886a6bb6baf124e39b63c995694271e509
Instruction ID: 54b66c02cd90fbb909f901ca0e0805b35d137f6208ced77b7931389c5b4bc2b9
Opcode Fuzzy Hash: db3742f2bb6f116d389edc3337e853886a6bb6baf124e39b63c995694271e509
Instruction Fuzzy Hash: 8F31C2B3A19A8586EB10AF19E8406E9B760FF58780F844072EA4D83795DF3CD562C710

Function 00007FF70AA19EA4 Relevance: 3.1, APIs: 2, Instructions: 73
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetStdHandle.KERNEL32 ref: 00007FF70AA19F1D
GetFileType.KERNELBASE ref: 00007FF70AA19F33

Memory Dump Source

Source File: 0000000A.00000002.2345199746.00007FF70A9E1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF70A9E0000, based on PE: true

Associated: 0000000A.00000002.2345173222.00007FF70A9E0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2345236578.00007FF70AA34000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2345264921.00007FF70AA47000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2345286816.00007FF70AA4A000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff70a9e0000_tapinstall.jbxd

Similarity

API ID: FileHandleType
String ID:
API String ID: 3000768030-0
Opcode ID: 2a7858ea0a20d78d229f8241a9e12833e585a3072b3a1a0811a3e501217574ad
Instruction ID: c3fac8ad94b50b667ac10796ffa52a88003e40704dc21a465f092ada7567c847
Opcode Fuzzy Hash: 2a7858ea0a20d78d229f8241a9e12833e585a3072b3a1a0811a3e501217574ad
Instruction Fuzzy Hash: 7031A363A18B46A1F7649B15CDA057AA750FF45BA0FA40379EB6E073E0CF38E452C391

Function 00007FF70A9E4770 Relevance: 3.1, APIs: 2, Instructions: 51
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FormatMessageW.KERNEL32(?,?,?,?,?,?,?,?,00000000,?,00007FF70A9E10DD), ref: 00007FF70A9E47B7
LocalFree.KERNEL32(?,?,?,?,?,?,?,?,00000000,?,00007FF70A9E10DD), ref: 00007FF70A9E480B

Memory Dump Source

Source File: 0000000A.00000002.2345199746.00007FF70A9E1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF70A9E0000, based on PE: true

Associated: 0000000A.00000002.2345173222.00007FF70A9E0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2345236578.00007FF70AA34000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2345264921.00007FF70AA47000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2345286816.00007FF70AA4A000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff70a9e0000_tapinstall.jbxd

Similarity

API ID: FormatFreeLocalMessage
String ID:
API String ID: 1427518018-0
Opcode ID: faddade6f339ff3cc93d48928193cad67dc264e1d8a9395bb651df8655175f89
Instruction ID: 6a50a1e3d2507cbf467f72a45cbdb5ac61e751163942ebcfd8e6ffebbc7bc4ac
Opcode Fuzzy Hash: faddade6f339ff3cc93d48928193cad67dc264e1d8a9395bb651df8655175f89
Instruction Fuzzy Hash: E1117673B29B4481EB51EF11E84412AB3A5FF99B84F968036DA5D87750EF3EC891C360

Function 00007FF70A9E8124 Relevance: 3.0, APIs: 2, Instructions: 23
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__vcrt_initialize.LIBVCRUNTIME ref: 00007FF70A9E8146

Part of subcall function 00007FF70A9E9184: __vcrt_initialize_winapi_thunks.LIBVCRUNTIME ref: 00007FF70A9E918D
Part of subcall function 00007FF70A9E9184: __vcrt_initialize_locks.LIBVCRUNTIME ref: 00007FF70A9E9192

__vcrt_uninitialize.LIBVCRUNTIME ref: 00007FF70A9E815E

Memory Dump Source

Source File: 0000000A.00000002.2345199746.00007FF70A9E1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF70A9E0000, based on PE: true

Associated: 0000000A.00000002.2345173222.00007FF70A9E0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2345236578.00007FF70AA34000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2345264921.00007FF70AA47000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2345286816.00007FF70AA4A000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff70a9e0000_tapinstall.jbxd

Similarity

API ID: __vcrt_initialize__vcrt_initialize_locks__vcrt_initialize_winapi_thunks__vcrt_uninitialize
String ID:
API String ID: 1882725809-0
Opcode ID: 8f237d6502b14b0254a4c674743dae8b4da91eb28c515f3ea25adcbd20d46fa1
Instruction ID: c23fb62aeaad73e35998da468b43ba47b4f06fc0b5a7ed7aa5df38ef71a16d00
Opcode Fuzzy Hash: 8f237d6502b14b0254a4c674743dae8b4da91eb28c515f3ea25adcbd20d46fa1
Instruction Fuzzy Hash: C1E01A82F2D24255FE64B7B5EC826B9D6800F7A389FC444F9E89DC22C38F0D644A6670

Function 00007FF70AA27080 Relevance: 1.6, APIs: 1, Instructions: 67
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 0000000A.00000002.2345199746.00007FF70A9E1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF70A9E0000, based on PE: true

Associated: 0000000A.00000002.2345173222.00007FF70A9E0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2345236578.00007FF70AA34000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2345264921.00007FF70AA47000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2345286816.00007FF70AA4A000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff70a9e0000_tapinstall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 77c9f455ae7dbfbf764ac100925fa24616ef860103a1a996772a9699631fd484
Instruction ID: dfb364f1ee4c71508f7a996d7e5e6dce330482ced0c291286ff4fdec5e18f042
Opcode Fuzzy Hash: 77c9f455ae7dbfbf764ac100925fa24616ef860103a1a996772a9699631fd484
Instruction Fuzzy Hash: 7721DEA3A0824266F7017F29DC81B79A650AF44BA0F9402B8E91C573E2DF7CE4538720

Function 00007FF70AA1154C Relevance: 1.6, APIs: 1, Instructions: 53
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNEL32 ref: 00007FF70AA1156B

Part of subcall function 00007FF70AA116E4: GetModuleHandleExW.KERNEL32 ref: 00007FF70AA11700
Part of subcall function 00007FF70AA116E4: GetProcAddress.KERNEL32 ref: 00007FF70AA11716
Part of subcall function 00007FF70AA116E4: FreeLibrary.KERNEL32 ref: 00007FF70AA11733

Memory Dump Source

Source File: 0000000A.00000002.2345199746.00007FF70A9E1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF70A9E0000, based on PE: true

Associated: 0000000A.00000002.2345173222.00007FF70A9E0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2345236578.00007FF70AA34000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2345264921.00007FF70AA47000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2345286816.00007FF70AA4A000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff70a9e0000_tapinstall.jbxd

Similarity

API ID: HandleModule$AddressFreeLibraryProc
String ID:
API String ID: 3947729631-0
Opcode ID: 9b5487346ef9f63116b54207664187879175fdd5b6014f44a2d1d5806b6a0d0e
Instruction ID: 0f82d28252e3f611442773aefe7521ebad581f8c27ad7905b634d0b009c7e043
Opcode Fuzzy Hash: 9b5487346ef9f63116b54207664187879175fdd5b6014f44a2d1d5806b6a0d0e
Instruction Fuzzy Hash: 6B219D72E087019AFB51AF64C9806EC76A0EB4431CF84463EDB1D12BC6DF38C446CB94

Function 00007FF70AA1CE60 Relevance: 1.5, APIs: 1, Instructions: 47
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF70AA1CE8B

Memory Dump Source

Source File: 0000000A.00000002.2345199746.00007FF70A9E1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF70A9E0000, based on PE: true

Associated: 0000000A.00000002.2345173222.00007FF70A9E0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2345236578.00007FF70AA34000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2345264921.00007FF70AA47000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2345286816.00007FF70AA4A000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff70a9e0000_tapinstall.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 29ed8d9b04594f7865511f83e8ab8f204f57b5d6501f11963fc871f8f78e5789
Instruction ID: 735b184ae0d31176495f621a734ec7a671f5acd48d2bdc45f7d3f7d439bbfded
Opcode Fuzzy Hash: 29ed8d9b04594f7865511f83e8ab8f204f57b5d6501f11963fc871f8f78e5789
Instruction Fuzzy Hash: 85118BB394C64292F310AF14E880D3AE3A4EF80750F9500B5E65D97BD6DF3CE8228760

Function 00007FF70A9F6C8C Relevance: 1.5, APIs: 1, Instructions: 28COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF70A9F6CAE

Memory Dump Source

Source File: 0000000A.00000002.2345199746.00007FF70A9E1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF70A9E0000, based on PE: true

Associated: 0000000A.00000002.2345173222.00007FF70A9E0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2345236578.00007FF70AA34000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2345264921.00007FF70AA47000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2345286816.00007FF70AA4A000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff70a9e0000_tapinstall.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: b1701a4419845fdea9b25c0b889f21a2cfcb31a46c6b6b47c9f4c5ea8d08c04c
Instruction ID: c9ba475867d32c0acbf9e25f00b8236286ae53c97f3cfa5dc0fbf01caedf4e2d
Opcode Fuzzy Hash: b1701a4419845fdea9b25c0b889f21a2cfcb31a46c6b6b47c9f4c5ea8d08c04c
Instruction Fuzzy Hash: CBF019B3A14B4298FB01AFA0DC410EC76B4FF14398F904A76EB9C42698EF38D155C2A0

Function 00007FF70AA17978 Relevance: 1.3, APIs: 1, Instructions: 36memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

HeapAlloc.KERNEL32(?,?,00000000,00007FF70AA177C1,?,?,00000000,00007FF70AA16B85,?,?,?,?,00007FF70A9F6CA8), ref: 00007FF70AA179CD

Memory Dump Source

Source File: 0000000A.00000002.2345199746.00007FF70A9E1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF70A9E0000, based on PE: true

Associated: 0000000A.00000002.2345173222.00007FF70A9E0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2345236578.00007FF70AA34000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2345264921.00007FF70AA47000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2345286816.00007FF70AA4A000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff70a9e0000_tapinstall.jbxd

Similarity

API ID: AllocHeap
String ID:
API String ID: 4292702814-0
Opcode ID: 3983c4821dd1e57c8f0338e38868bd111ba754eec4fe96f30a7891404f0fea4d
Instruction ID: 177e4e08aea3cc6b365f7782519c032af8fbc0f33123f7507a71ae1d7ee15446
Opcode Fuzzy Hash: 3983c4821dd1e57c8f0338e38868bd111ba754eec4fe96f30a7891404f0fea4d
Instruction Fuzzy Hash: 3FF0AF82B0920764FE95B661DC50AB5D6849F88780FCC64B1C80D863C1FF2DE89B4630

Non-executed Functions

Function 00007FF70A9EB1FC Relevance: 172.4, APIs: 82, Strings: 16, Instructions: 883COMMONLIBRARYCODE

Download Yara Rule

APIs

DName::operator+.LIBVCRUNTIME ref: 00007FF70A9EB29B
DName::doPchar.LIBVCRUNTIME ref: 00007FF70A9EB373
DName::operator+.LIBVCRUNTIME ref: 00007FF70A9EB384
DName::operator+.LIBVCRUNTIME ref: 00007FF70A9EB3CC
DName::operator+.LIBVCRUNTIME ref: 00007FF70A9EB3ED
DName::operator+=.LIBVCRUNTIME ref: 00007FF70A9EB3FA
DName::doPchar.LIBVCRUNTIME ref: 00007FF70A9EB473
DName::operator+.LIBVCRUNTIME ref: 00007FF70A9EB486

Strings

`template static data member destructor helper', xrefs: 00007FF70A9EBCF1
`local static destructor helper', xrefs: 00007FF70A9EBCAD
{flat}, xrefs: 00007FF70A9EB421
}' , xrefs: 00007FF70A9EB48B, 00007FF70A9EB973
virtual , xrefs: 00007FF70A9EBE5D
static , xrefs: 00007FF70A9EBE00
`adjustor{, xrefs: 00007FF70A9EB962
`vtordisp{, xrefs: 00007FF70A9EB920
[thunk]:, xrefs: 00007FF70A9EBF5F
private: , xrefs: 00007FF70A9EBEC1
`template static data member constructor helper', xrefs: 00007FF70A9EBCD1
extern "C" , xrefs: 00007FF70A9EBF9A
public: , xrefs: 00007FF70A9EBF0D
{for , xrefs: 00007FF70A9EBBED
protected: , xrefs: 00007FF70A9EBEEB
`vtordispex{, xrefs: 00007FF70A9EB869

Memory Dump Source

Source File: 0000000A.00000002.2345199746.00007FF70A9E1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF70A9E0000, based on PE: true

Associated: 0000000A.00000002.2345173222.00007FF70A9E0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2345236578.00007FF70AA34000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2345264921.00007FF70AA47000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2345286816.00007FF70AA4A000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff70a9e0000_tapinstall.jbxd

Similarity

API ID: Name::operator+$Name::doPchar$Name::operator+=
String ID: [thunk]:$`adjustor{$`local static destructor helper'$`template static data member constructor helper'$`template static data member destructor helper'$`vtordispex{$`vtordisp{$extern "C" $private: $protected: $public: $static $virtual ${flat}${for $}'
API String ID: 2654205828-3103905019
Opcode ID: 344dc4b9ba1a62ce6824673a4e2a2672d5d17c1497d6831b0eb881a8fb7f10fb
Instruction ID: 8038bc5a7301c0e8eba7c80bba3b0f1ac2021e2f0ce9df50331c7df0af2204eb
Opcode Fuzzy Hash: 344dc4b9ba1a62ce6824673a4e2a2672d5d17c1497d6831b0eb881a8fb7f10fb
Instruction Fuzzy Hash: 13825273B2C68296FB40EB24D8802A9B7A0FF94388F905075EA4DC7A9ADF7CD545C750

Function 00007FF70A9E7030 Relevance: 40.5, APIs: 19, Strings: 4, Instructions: 255registryCOMMON

Download Yara Rule

APIs

SetupDiGetDeviceInstallParamsW.SETUPAPI ref: 00007FF70A9E7092
SetupDiSetDeviceInstallParamsW.SETUPAPI ref: 00007FF70A9E70B3
SetupDiBuildDriverInfoList.SETUPAPI ref: 00007FF70A9E70C8
SetupDiEnumDriverInfoW.SETUPAPI ref: 00007FF70A9E70E9
SetupDiOpenDevRegKey.SETUPAPI ref: 00007FF70A9E711C
RegCloseKey.ADVAPI32 ref: 00007FF70A9E7441

Strings

InfSection, xrefs: 00007FF70A9E71E3
DriverDesc, xrefs: 00007FF70A9E722C
ProviderName, xrefs: 00007FF70A9E719A
InfPath, xrefs: 00007FF70A9E7151

Memory Dump Source

Source File: 0000000A.00000002.2345199746.00007FF70A9E1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF70A9E0000, based on PE: true

Associated: 0000000A.00000002.2345173222.00007FF70A9E0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2345236578.00007FF70AA34000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2345264921.00007FF70AA47000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2345286816.00007FF70AA4A000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff70a9e0000_tapinstall.jbxd

Similarity

API ID: Setup$DeviceDriverInfoInstallParams$BuildCloseEnumListOpen
String ID: DriverDesc$InfPath$InfSection$ProviderName
API String ID: 1704563315-109328823
Opcode ID: 470132caa0e5c2b1524e902dcaad2fd13110990853be0799e79165d4b753c384
Instruction ID: 23823f0aa8e5bc48ae567e220451c2b702db3ae758c3008c26a7f719b3c02eb0
Opcode Fuzzy Hash: 470132caa0e5c2b1524e902dcaad2fd13110990853be0799e79165d4b753c384
Instruction Fuzzy Hash: 07B1B233B1C78286FB609F61E8447AAB7A1FF94B89F800075EA4D82A94EF3CD505D711

Function 00007FF70A9E6C90 Relevance: 40.5, APIs: 17, Strings: 6, Instructions: 208libraryfileloaderCOMMON

Download Yara Rule

APIs

SetupOpenInfFileW.SETUPAPI(?,?,00000000,00000000,?,00007FF70A9E3786), ref: 00007FF70A9E6CD1
GetLastError.KERNEL32(?,?,00000000,00000000,?,00007FF70A9E3786), ref: 00007FF70A9E6CE0
SetupFindFirstLineW.SETUPAPI(?,?,00000000,00000000,?,00007FF70A9E3786), ref: 00007FF70A9E6D0C
SetupGetStringFieldW.SETUPAPI(?,?,00000000,00000000,?,00007FF70A9E3786), ref: 00007FF70A9E6D32
SetupFindFirstLineW.SETUPAPI(?,?,00000000,00000000,?,00007FF70A9E3786), ref: 00007FF70A9E6D89
SetupGetStringFieldW.SETUPAPI(?,?,00000000,00000000,?,00007FF70A9E3786), ref: 00007FF70A9E6DB3
CLSIDFromString.OLE32(?,?,00000000,00000000,?,00007FF70A9E3786), ref: 00007FF70A9E6DC9
SetupDiGetClassDescriptionExW.SETUPAPI(?,?,00000000,00000000,?,00007FF70A9E3786), ref: 00007FF70A9E6DF2
LoadLibraryW.KERNEL32(?,?,00000000,00000000,?,00007FF70A9E3786), ref: 00007FF70A9E6E3A
GetProcAddress.KERNEL32(?,?,00000000,00000000,?,00007FF70A9E3786), ref: 00007FF70A9E6E5E
GetLastError.KERNEL32 ref: 00007FF70A9E6EA1
GetLastError.KERNEL32 ref: 00007FF70A9E6EAE
SetupFindFirstLineW.SETUPAPI ref: 00007FF70A9E6F08

Strings

setupapi.dll, xrefs: 00007FF70A9E6E33
Version, xrefs: 00007FF70A9E6D05, 00007FF70A9E6D82, 00007FF70A9E6F01
Provider, xrefs: 00007FF70A9E6CFB
ClassGUID, xrefs: 00007FF70A9E6D7B
DriverVer, xrefs: 00007FF70A9E6EFA
SetupVerifyInfFile, xrefs: 00007FF70A9E6E4C

Memory Dump Source

Source File: 0000000A.00000002.2345199746.00007FF70A9E1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF70A9E0000, based on PE: true

Associated: 0000000A.00000002.2345173222.00007FF70A9E0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2345236578.00007FF70AA34000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2345264921.00007FF70AA47000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2345286816.00007FF70AA4A000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff70a9e0000_tapinstall.jbxd

Similarity

API ID: Setup$ErrorFindFirstLastLineString$Field$AddressClassDescriptionFileFromLibraryLoadOpenProc
String ID: ClassGUID$DriverVer$Provider$SetupVerifyInfFile$Version$setupapi.dll
API String ID: 2815445529-1638047923
Opcode ID: ccf9f4b43b9fad1fa27bc109124458a99df6b9793aee5966b8e4b19aae1b4082
Instruction ID: bb1b56e841cbc88cde02e80991b708fd821d7e4d56607c3a31c661c4abd6f988
Opcode Fuzzy Hash: ccf9f4b43b9fad1fa27bc109124458a99df6b9793aee5966b8e4b19aae1b4082
Instruction Fuzzy Hash: B4916063B2CA8242F710FB61EC106FAA251EF98B49FC04476E90E876D6DF3DE5558360

Function 00007FF70AA2A7C0 Relevance: 24.0, APIs: 9, Strings: 4, Instructions: 1207COMMONLIBRARYCODE

Download Yara Rule

APIs

fegetenv.LIBCMT ref: 00007FF70AA2A809
_invalid_parameter_noinfo.LIBCMT ref: 00007FF70AA2AE14
_invalid_parameter_noinfo.LIBCMT ref: 00007FF70AA2AFD7
_invalid_parameter_noinfo.LIBCMT ref: 00007FF70AA2B1DE
_invalid_parameter_noinfo.LIBCMT ref: 00007FF70AA2B4A2
_invalid_parameter_noinfo.LIBCMT ref: 00007FF70AA2B69D
memcpy_s.LIBCPMT ref: 00007FF70AA2B78B
memcpy_s.LIBCPMT ref: 00007FF70AA2B836
memcpy_s.LIBCPMT ref: 00007FF70AA2B8FF

Strings

1#QNAN, xrefs: 00007FF70AA2B9B7
1#SNAN, xrefs: 00007FF70AA2B9AE
1#INF, xrefs: 00007FF70AA2B9D3
1#IND, xrefs: 00007FF70AA2B9A5

Memory Dump Source

Source File: 0000000A.00000002.2345199746.00007FF70A9E1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF70A9E0000, based on PE: true

Associated: 0000000A.00000002.2345173222.00007FF70A9E0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2345236578.00007FF70AA34000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2345264921.00007FF70AA47000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2345286816.00007FF70AA4A000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff70a9e0000_tapinstall.jbxd

Similarity

API ID: _invalid_parameter_noinfo$memcpy_s$fegetenv
String ID: 1#IND$1#INF$1#QNAN$1#SNAN
API String ID: 808467561-2761157908
Opcode ID: 64e267bf78fb629f889f1a9ca02426a2b841f9d57b2607d640a5240c26589488
Instruction ID: a9566c981cdfd63ea31a2c89c38c7512b2504e4ce6f5c6546d8c2727d7696d89
Opcode Fuzzy Hash: 64e267bf78fb629f889f1a9ca02426a2b841f9d57b2607d640a5240c26589488
Instruction Fuzzy Hash: A4B2F9B3A181828BF7259E69C940BFDB7A1FF44388F905175DA0A67BC4DF38A552C710

Function 00007FF70A9E13E0 Relevance: 23.0, APIs: 12, Strings: 1, Instructions: 279COMMON

Download Yara Rule

APIs

SetupDiClassGuidsFromNameExW.SETUPAPI ref: 00007FF70A9E14AB
GetLastError.KERNEL32 ref: 00007FF70A9E14B5
SetupDiClassGuidsFromNameExW.SETUPAPI ref: 00007FF70A9E150B
SetupDiDestroyDeviceInfoList.SETUPAPI ref: 00007FF70A9E17E0

Strings

, xrefs: 00007FF70A9E159D

Memory Dump Source

Source File: 0000000A.00000002.2345199746.00007FF70A9E1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF70A9E0000, based on PE: true

Associated: 0000000A.00000002.2345173222.00007FF70A9E0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2345236578.00007FF70AA34000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2345264921.00007FF70AA47000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2345286816.00007FF70AA4A000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff70a9e0000_tapinstall.jbxd

Similarity

API ID: Setup$ClassFromGuidsName$DestroyDeviceErrorInfoLastList
String ID:
API String ID: 1066883911-3916222277
Opcode ID: 95c7f67f37713cc790260966e8adad9794b378fe7e5710a0f5457cdb6cacd70d
Instruction ID: b49f9d6b429ccb8afdd380f2c6e331d2b61fb5c5ead52509134e15408905580b
Opcode Fuzzy Hash: 95c7f67f37713cc790260966e8adad9794b378fe7e5710a0f5457cdb6cacd70d
Instruction Fuzzy Hash: E9B1A263B1864282FB20EB65EC406A9A3A0FF94BA8F944375DE5D837D5DF3CD5058710

Function 00007FF70AA283E4 Relevance: 16.9, APIs: 8, Strings: 1, Instructions: 1132COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF70AA28973
memcpy_s.LIBCPMT ref: 00007FF70AA29325
memcpy_s.LIBCPMT ref: 00007FF70AA293D1
memcpy_s.LIBCPMT ref: 00007FF70AA2949B

Strings

s, xrefs: 00007FF70AA29465

Memory Dump Source

Source File: 0000000A.00000002.2345199746.00007FF70A9E1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF70A9E0000, based on PE: true

Associated: 0000000A.00000002.2345173222.00007FF70A9E0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2345236578.00007FF70AA34000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2345264921.00007FF70AA47000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2345286816.00007FF70AA4A000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff70a9e0000_tapinstall.jbxd

Similarity

API ID: memcpy_s$_invalid_parameter_noinfo
String ID: s
API String ID: 2880407647-453955339
Opcode ID: 5bbfe94752329b1da8265bf6d51677381658838f21c0a74a2938933cdb4c1ac6
Instruction ID: 048d9269cf648584af0b863000b0d934e02ab15e65051397a5f2c3fe592aaf1b
Opcode Fuzzy Hash: 5bbfe94752329b1da8265bf6d51677381658838f21c0a74a2938933cdb4c1ac6
Instruction Fuzzy Hash: EBA2D6B3A081C18BF7359E29D940AE9B795FF58788F900175EB0A67BD4DB3CE5128B10

Function 00007FF70AA2A070 Relevance: 15.4, APIs: 10, Instructions: 368COMMON

Download Yara Rule

APIs

memcpy_s.LIBCPMT ref: 00007FF70AA2A18A
memcpy_s.LIBCPMT ref: 00007FF70AA2A258
memcpy_s.LIBCPMT ref: 00007FF70AA2A27D
memcpy_s.LIBCPMT ref: 00007FF70AA2A4FE
memcpy_s.LIBCPMT ref: 00007FF70AA2A54A
memcpy_s.LIBCPMT ref: 00007FF70AA2A579
memcpy_s.LIBCPMT ref: 00007FF70AA2A60C

Memory Dump Source

Source File: 0000000A.00000002.2345199746.00007FF70A9E1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF70A9E0000, based on PE: true

Associated: 0000000A.00000002.2345173222.00007FF70A9E0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2345236578.00007FF70AA34000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2345264921.00007FF70AA47000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2345286816.00007FF70AA4A000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff70a9e0000_tapinstall.jbxd

Similarity

API ID: memcpy_s
String ID:
API String ID: 1502251526-0
Opcode ID: ac952aa7c694147f99d3e4b40430f2bf787c9728cbc095bc21ac10cb0df3e7be
Instruction ID: f10af527b1d58923bdbc144600b9d1a8f8e857b9238ba6a28aa695bad060b75a
Opcode Fuzzy Hash: ac952aa7c694147f99d3e4b40430f2bf787c9728cbc095bc21ac10cb0df3e7be
Instruction Fuzzy Hash: DAE1C5B36082828BFB24DF19D844AE9B7A0FF49788F809175DB0957B84DB39D916CB50

Function 00007FF70AA1E0B0 Relevance: 14.4, APIs: 7, Strings: 1, Instructions: 434COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF70AA1E0E0

Part of subcall function 00007FF70AA16A20: IsProcessorFeaturePresent.KERNEL32(?,?,?,?,00007FF70AA169CD), ref: 00007FF70AA16A29
Part of subcall function 00007FF70AA16A20: GetCurrentProcess.KERNEL32(?,?,?,?,00007FF70AA169CD), ref: 00007FF70AA16A4E

_invalid_parameter_noinfo.LIBCMT ref: 00007FF70AA1E305

Strings

*?, xrefs: 00007FF70AA1E107

Memory Dump Source

Source File: 0000000A.00000002.2345199746.00007FF70A9E1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF70A9E0000, based on PE: true

Associated: 0000000A.00000002.2345173222.00007FF70A9E0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2345236578.00007FF70AA34000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2345264921.00007FF70AA47000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2345286816.00007FF70AA4A000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff70a9e0000_tapinstall.jbxd

Similarity

API ID: _invalid_parameter_noinfo$CurrentFeaturePresentProcessProcessor
String ID: *?
API String ID: 1697365638-2564092906
Opcode ID: 63c62522b583ab65492df3df2897c9d34e58fcc378565526384e87568434e7d9
Instruction ID: b9067d135c927d1461a1ecba112ea80e4942e02df57b6184479b6dcb6d115055
Opcode Fuzzy Hash: 63c62522b583ab65492df3df2897c9d34e58fcc378565526384e87568434e7d9
Instruction Fuzzy Hash: 3EF1F1A3B1869195FA20EB66DC009B9A7A1FF48BD4F844576EE5D07BC4EF3CD4468320

Function 00007FF70A9E4D80 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 43shutdownCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00007FF70A9E239F), ref: 00007FF70A9E4D93
OpenProcessToken.ADVAPI32(?,?,?,?,?,?,?,?,?,?,?,?,00007FF70A9E239F), ref: 00007FF70A9E4DA6
LookupPrivilegeValueW.ADVAPI32 ref: 00007FF70A9E4DBE
AdjustTokenPrivileges.ADVAPI32 ref: 00007FF70A9E4DFD
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00007FF70A9E239F), ref: 00007FF70A9E4E08
InitiateSystemShutdownExW.ADVAPI32 ref: 00007FF70A9E4E28

Strings

SeShutdownPrivilege, xrefs: 00007FF70A9E4DB7

Memory Dump Source

Source File: 0000000A.00000002.2345199746.00007FF70A9E1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF70A9E0000, based on PE: true

Associated: 0000000A.00000002.2345173222.00007FF70A9E0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2345236578.00007FF70AA34000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2345264921.00007FF70AA47000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2345286816.00007FF70AA4A000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff70a9e0000_tapinstall.jbxd

Similarity

API ID: ProcessToken$AdjustCloseCurrentHandleInitiateLookupOpenPrivilegePrivilegesShutdownSystemValue
String ID: SeShutdownPrivilege
API String ID: 2036077386-3733053543
Opcode ID: f561dac5e6c18281b4010f054e9054ffc8b813bd40337e654f72e59e3645770f
Instruction ID: 271adfe5816071153ec3a021cbf0da2a55b18bfc21b7ea2323db353ed65f302d
Opcode Fuzzy Hash: f561dac5e6c18281b4010f054e9054ffc8b813bd40337e654f72e59e3645770f
Instruction Fuzzy Hash: 6C111CB7A18A4283FB60EF61F855A6AB7A0FF89745F805075EA8E42A54CF7DD0058B10

Function 00007FF70AA29BC0 Relevance: 10.7, APIs: 7, Instructions: 246COMMON

Download Yara Rule

APIs

memcpy_s.LIBCPMT ref: 00007FF70AA29C17
memcpy_s.LIBCPMT ref: 00007FF70AA29CDE
memcpy_s.LIBCPMT ref: 00007FF70AA29D03
memcpy_s.LIBCPMT ref: 00007FF70AA29F5F

Memory Dump Source

Source File: 0000000A.00000002.2345199746.00007FF70A9E1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF70A9E0000, based on PE: true

Associated: 0000000A.00000002.2345173222.00007FF70A9E0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2345236578.00007FF70AA34000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2345264921.00007FF70AA47000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2345286816.00007FF70AA4A000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff70a9e0000_tapinstall.jbxd

Similarity

API ID: memcpy_s
String ID:
API String ID: 1502251526-0
Opcode ID: 367b353356dc7549a3a05ae401a0d7ae4e6ca703a61e1e2289ec1d18ee3772f9
Instruction ID: 1146e8ea884a886ec7c11aff07058db24f39e7921042ea1cc8381a9e3fd9476a
Opcode Fuzzy Hash: 367b353356dc7549a3a05ae401a0d7ae4e6ca703a61e1e2289ec1d18ee3772f9
Instruction Fuzzy Hash: 8BA194B3A042C28BF7799F19E840AFAB794FB65B88F805135DB4A57B84CB38D951C710

Function 00007FF70AA24960 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 234COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF70AA175E8: GetLastError.KERNEL32(?,?,?,00007FF70AA27232,?,?,?,?,?,?,?,?,?,?,?,00007FF70AA2712B), ref: 00007FF70AA175F7
Part of subcall function 00007FF70AA175E8: SetLastError.KERNEL32(?,?,?,00007FF70AA27232,?,?,?,?,?,?,?,?,?,?,?,00007FF70AA2712B), ref: 00007FF70AA17695

TranslateName.LIBCMT ref: 00007FF70AA249CD
TranslateName.LIBCMT ref: 00007FF70AA24A08
GetACP.KERNEL32(?,?,?,00000000,00000092,00007FF70AA127F8), ref: 00007FF70AA24A4D
IsValidCodePage.KERNEL32(?,?,?,00000000,00000092,00007FF70AA127F8), ref: 00007FF70AA24A75

Strings

utf8, xrefs: 00007FF70AA24B59

Memory Dump Source

Source File: 0000000A.00000002.2345199746.00007FF70A9E1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF70A9E0000, based on PE: true

Associated: 0000000A.00000002.2345173222.00007FF70A9E0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2345236578.00007FF70AA34000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2345264921.00007FF70AA47000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2345286816.00007FF70AA4A000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff70a9e0000_tapinstall.jbxd

Similarity

API ID: ErrorLastNameTranslate$CodePageValid
String ID: utf8
API String ID: 2136749100-905460609
Opcode ID: d9b8ad3760af016a63c72bc9a843d741a47231133edd535d7ed3e9ae3113bd32
Instruction ID: 9a5740a1dc00e4420563022b72de2b0538201e0ca57d90a97cced0517fdcf0e9
Opcode Fuzzy Hash: d9b8ad3760af016a63c72bc9a843d741a47231133edd535d7ed3e9ae3113bd32
Instruction Fuzzy Hash: C691BEB3A0874286FB24BF25D801AB9A2A4EF48B84F8441B1DA5D577C5DF3CE562C720

Function 00007FF70AA25478 Relevance: 10.7, APIs: 7, Instructions: 171COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF70AA175E8: GetLastError.KERNEL32(?,?,?,00007FF70AA27232,?,?,?,?,?,?,?,?,?,?,?,00007FF70AA2712B), ref: 00007FF70AA175F7
Part of subcall function 00007FF70AA175E8: SetLastError.KERNEL32(?,?,?,00007FF70AA27232,?,?,?,?,?,?,?,?,?,?,?,00007FF70AA2712B), ref: 00007FF70AA17695

EnumSystemLocalesW.KERNEL32(?,00000000,00000092,?,?,00000000,?,00007FF70AA127F1), ref: 00007FF70AA255CF
GetUserDefaultLCID.KERNEL32(?,00000000,00000092,?), ref: 00007FF70AA255E8
ProcessCodePage.LIBCMT ref: 00007FF70AA25612
IsValidCodePage.KERNEL32 ref: 00007FF70AA25624
IsValidLocale.KERNEL32 ref: 00007FF70AA2563A
GetLocaleInfoW.KERNEL32 ref: 00007FF70AA25696
GetLocaleInfoW.KERNEL32 ref: 00007FF70AA256B2

Memory Dump Source

Source File: 0000000A.00000002.2345199746.00007FF70A9E1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF70A9E0000, based on PE: true

Associated: 0000000A.00000002.2345173222.00007FF70A9E0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2345236578.00007FF70AA34000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2345264921.00007FF70AA47000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2345286816.00007FF70AA4A000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff70a9e0000_tapinstall.jbxd

Similarity

API ID: Locale$CodeErrorInfoLastPageValid$DefaultEnumLocalesProcessSystemUser
String ID:
API String ID: 3939093798-0
Opcode ID: 698639ebde3256074987202a2cc8b981a0ae2b2705bee52486481ff24fbfc6ce
Instruction ID: bb80a0423d07ed8681fda62fb270bea427659bb40e90a3bae518aaec666e553e
Opcode Fuzzy Hash: 698639ebde3256074987202a2cc8b981a0ae2b2705bee52486481ff24fbfc6ce
Instruction Fuzzy Hash: 3A718DA3F086438AFB14AB68DC10AB8A3A1BF48744F844479DA0D676D5DF3DE466C720

Function 00007FF70AA16788 Relevance: 9.1, APIs: 6, Instructions: 83COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlCaptureContext.KERNEL32 ref: 00007FF70AA16801
RtlLookupFunctionEntry.KERNEL32 ref: 00007FF70AA16819
RtlVirtualUnwind.KERNEL32 ref: 00007FF70AA16854
IsDebuggerPresent.KERNEL32 ref: 00007FF70AA1688D
SetUnhandledExceptionFilter.KERNEL32 ref: 00007FF70AA16897
UnhandledExceptionFilter.KERNEL32 ref: 00007FF70AA168A2

Memory Dump Source

Source File: 0000000A.00000002.2345199746.00007FF70A9E1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF70A9E0000, based on PE: true

Associated: 0000000A.00000002.2345173222.00007FF70A9E0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2345236578.00007FF70AA34000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2345264921.00007FF70AA47000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2345286816.00007FF70AA4A000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff70a9e0000_tapinstall.jbxd

Similarity

API ID: ExceptionFilterUnhandled$CaptureContextDebuggerEntryFunctionLookupPresentUnwindVirtual
String ID:
API String ID: 1239891234-0
Opcode ID: 33f4d05915216eab4ab632b90a56ad91ab0ee05a89d810f3c8b53b4161930c69
Instruction ID: 19516fc5d9129184933f495f907f055bf71be97be87616848e287808e5d7596a
Opcode Fuzzy Hash: 33f4d05915216eab4ab632b90a56ad91ab0ee05a89d810f3c8b53b4161930c69
Instruction Fuzzy Hash: CA319177A18B8186EB20DF64EC406AEB3A4FF88758F904135EA8D43B95DF38C1468B10

Function 00007FF70AA1ECAC Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 119fileCOMMON

Download Yara Rule

APIs

FindFirstFileExW.KERNEL32 ref: 00007FF70AA1ED6D
FindNextFileW.KERNEL32 ref: 00007FF70AA1EDDB
FindClose.KERNEL32 ref: 00007FF70AA1EE18

Strings

., xrefs: 00007FF70AA1ED9E
., xrefs: 00007FF70AA1EDAD

Memory Dump Source

Source File: 0000000A.00000002.2345199746.00007FF70A9E1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF70A9E0000, based on PE: true

Associated: 0000000A.00000002.2345173222.00007FF70A9E0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2345236578.00007FF70AA34000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2345264921.00007FF70AA47000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2345286816.00007FF70AA4A000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff70a9e0000_tapinstall.jbxd

Similarity

API ID: Find$File$CloseFirstNext
String ID: .$.
API String ID: 3541575487-3769392785
Opcode ID: 147d8d088a2ab65af6ce8502f9dfb33cdb0b941aabc59c27737b474ffebd2bbe
Instruction ID: bf4cdddf329ee7e84876b4429ea37c926c9c51d32dac84cd9b142bfb9bd059af
Opcode Fuzzy Hash: 147d8d088a2ab65af6ce8502f9dfb33cdb0b941aabc59c27737b474ffebd2bbe
Instruction Fuzzy Hash: F541B593B1859254FA70AB65EC04AB5E291EF84BE4F858572DD4D077C4EF7CD5438320

Function 00007FF70A9E3630 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 98fileCOMMON

Download Yara Rule

APIs

GetWindowsDirectoryW.KERNEL32 ref: 00007FF70A9E3674
FindFirstFileW.KERNEL32 ref: 00007FF70A9E371F

Strings

\INF\OEM*.INF, xrefs: 00007FF70A9E36D5

Memory Dump Source

Source File: 0000000A.00000002.2345199746.00007FF70A9E1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF70A9E0000, based on PE: true

Associated: 0000000A.00000002.2345173222.00007FF70A9E0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2345236578.00007FF70AA34000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2345264921.00007FF70AA47000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2345286816.00007FF70AA4A000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff70a9e0000_tapinstall.jbxd

Similarity

API ID: DirectoryFileFindFirstWindows
String ID: \INF\OEM*.INF
API String ID: 1585389207-2728984289
Opcode ID: 96e7f8943384205df238da4809613e295090238b8a99556eaef6c16c72f10844
Instruction ID: a74b043d92e0d560a5126edb30c9d6ec6de22dd5f7840e8e404c3d64ecff715f
Opcode Fuzzy Hash: 96e7f8943384205df238da4809613e295090238b8a99556eaef6c16c72f10844
Instruction Fuzzy Hash: B941A663B2C68282FE60EF20E8553BAA290EF95B54FD44171C64D877D6DF2DD4058360

Function 00007FF70AA266E8 Relevance: 7.8, APIs: 5, Instructions: 321fileCOMMON

Download Yara Rule

APIs

GetConsoleCP.KERNEL32 ref: 00007FF70AA26757
WriteFile.KERNEL32 ref: 00007FF70AA26A01
WriteFile.KERNEL32 ref: 00007FF70AA26A53
GetLastError.KERNEL32 ref: 00007FF70AA26B95
GetLastError.KERNEL32 ref: 00007FF70AA26BA7

Memory Dump Source

Source File: 0000000A.00000002.2345199746.00007FF70A9E1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF70A9E0000, based on PE: true

Associated: 0000000A.00000002.2345173222.00007FF70A9E0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2345236578.00007FF70AA34000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2345264921.00007FF70AA47000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2345286816.00007FF70AA4A000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff70a9e0000_tapinstall.jbxd

Similarity

API ID: ErrorFileLastWrite$Console
String ID:
API String ID: 786612050-0
Opcode ID: d3beed3413ee1199dba947ae966059d4b9df67c161722cedc9c5d103b3af1309
Instruction ID: d4bfb5d806a9e01e1ad5a521a6d0f21c425359d1fab80030ab417b3a215f6fac
Opcode Fuzzy Hash: d3beed3413ee1199dba947ae966059d4b9df67c161722cedc9c5d103b3af1309
Instruction Fuzzy Hash: 73D1EEB3B09A828AF700DB68D9445ADB7B1FB45788F944176CA4E57B89DF38D12AC310

Function 00007FF70AA18B44 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 35COMMON

Download Yara Rule

APIs

try_get_function.LIBVCRUNTIME ref: 00007FF70AA18B7D
GetLocaleInfoW.KERNEL32(?,?,?,?,?,00007FF70AA129CB), ref: 00007FF70AA18BAB

Strings

GetLocaleInfoEx, xrefs: 00007FF70AA18B60, 00007FF70AA18B71

Memory Dump Source

Source File: 0000000A.00000002.2345199746.00007FF70A9E1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF70A9E0000, based on PE: true

Associated: 0000000A.00000002.2345173222.00007FF70A9E0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2345236578.00007FF70AA34000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2345264921.00007FF70AA47000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2345286816.00007FF70AA4A000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff70a9e0000_tapinstall.jbxd

Similarity

API ID: InfoLocaletry_get_function
String ID: GetLocaleInfoEx
API String ID: 2200034068-2904428671
Opcode ID: 02750f415f3cd806410832db7a44b855064978a5e13e35f6515160912ac6add6
Instruction ID: bead05a347704b3914b1e5dd05759f76908ded35fe4e8c41baedd07c05132e74
Opcode Fuzzy Hash: 02750f415f3cd806410832db7a44b855064978a5e13e35f6515160912ac6add6
Instruction Fuzzy Hash: 680162A7F08B4292F700AB15FC408A9E661AF98BC0F984076EE5D17B95CF3CD5528350

Function 00007FF70AA296F0 Relevance: 4.8, APIs: 3, Instructions: 317COMMONLIBRARYCODE

Download Yara Rule

APIs

memcpy_s.LIBCPMT ref: 00007FF70AA29756
memcpy_s.LIBCPMT ref: 00007FF70AA29781

Memory Dump Source

Source File: 0000000A.00000002.2345199746.00007FF70A9E1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF70A9E0000, based on PE: true

Associated: 0000000A.00000002.2345173222.00007FF70A9E0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2345236578.00007FF70AA34000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2345264921.00007FF70AA47000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2345286816.00007FF70AA4A000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff70a9e0000_tapinstall.jbxd

Similarity

API ID: memcpy_s
String ID:
API String ID: 1502251526-0
Opcode ID: 8cea97ad10f18f43ea70dff6f68e6fc975f0f687338f3efd8ca2cf0a0ef5ac24
Instruction ID: 29c15eaf1b69eca67123ea6eab0128d9c4a3040929c832103ef98703b91133d3
Opcode Fuzzy Hash: 8cea97ad10f18f43ea70dff6f68e6fc975f0f687338f3efd8ca2cf0a0ef5ac24
Instruction Fuzzy Hash: C6C1C4B3B1828687E724DF19E544A6AF791FB94B84F848135DB4E53B84DB3DE812CB40

Function 00007FF70AA24ED0 Relevance: 4.7, APIs: 3, Instructions: 169COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF70AA175E8: GetLastError.KERNEL32(?,?,?,00007FF70AA27232,?,?,?,?,?,?,?,?,?,?,?,00007FF70AA2712B), ref: 00007FF70AA175F7
Part of subcall function 00007FF70AA175E8: SetLastError.KERNEL32(?,?,?,00007FF70AA27232,?,?,?,?,?,?,?,?,?,?,?,00007FF70AA2712B), ref: 00007FF70AA17695

GetLocaleInfoW.KERNEL32 ref: 00007FF70AA24F3C

Part of subcall function 00007FF70A9F676C: _invalid_parameter_noinfo.LIBCMT ref: 00007FF70A9F6789

GetLocaleInfoW.KERNEL32 ref: 00007FF70AA24F85

Part of subcall function 00007FF70A9F676C: _invalid_parameter_noinfo.LIBCMT ref: 00007FF70A9F67E2

GetLocaleInfoW.KERNEL32 ref: 00007FF70AA25050

Memory Dump Source

Source File: 0000000A.00000002.2345199746.00007FF70A9E1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF70A9E0000, based on PE: true

Associated: 0000000A.00000002.2345173222.00007FF70A9E0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2345236578.00007FF70AA34000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2345264921.00007FF70AA47000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2345286816.00007FF70AA4A000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff70a9e0000_tapinstall.jbxd

Similarity

API ID: InfoLocale$ErrorLast_invalid_parameter_noinfo
String ID:
API String ID: 3644580040-0
Opcode ID: e8c6a04a7efb30580b1de6acdcde22ad9448435ad199d966b2e32c4fa01e2337
Instruction ID: 8669f4d575d216c5e99a358e81f945af8b5faa6ce8ff1de3b46011844de54682
Opcode Fuzzy Hash: e8c6a04a7efb30580b1de6acdcde22ad9448435ad199d966b2e32c4fa01e2337
Instruction Fuzzy Hash: 506180B3A086438AF764AE19ED409A9B2A1FF84744F808175D74EA36D1DF3DE4628760

Function 00007FF70AA1BD18 Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 248COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF70AA1BD7C

Strings

gfffffff, xrefs: 00007FF70AA1C019

Memory Dump Source

Source File: 0000000A.00000002.2345199746.00007FF70A9E1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF70A9E0000, based on PE: true

Associated: 0000000A.00000002.2345173222.00007FF70A9E0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2345236578.00007FF70AA34000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2345264921.00007FF70AA47000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2345286816.00007FF70AA4A000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff70a9e0000_tapinstall.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: gfffffff
API String ID: 3215553584-1523873471
Opcode ID: 9a7811f407a379061f5ff88b26a0f4d0f292d93459f7b1a2d23494d512ae23e6
Instruction ID: de18fb507d36d059a6ac6656f7f104652b59d6ac6ed9137d86ace31c2da9b01f
Opcode Fuzzy Hash: 9a7811f407a379061f5ff88b26a0f4d0f292d93459f7b1a2d23494d512ae23e6
Instruction Fuzzy Hash: AA9143A3B097C596FB15EB29D800BADA7A4AF50B80F458072DA4D873D1EB3DE507C721

Function 00007FF70AA1C738 Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 207COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF70AA1C769

Part of subcall function 00007FF70AA16A20: IsProcessorFeaturePresent.KERNEL32(?,?,?,?,00007FF70AA169CD), ref: 00007FF70AA16A29
Part of subcall function 00007FF70AA16A20: GetCurrentProcess.KERNEL32(?,?,?,?,00007FF70AA169CD), ref: 00007FF70AA16A4E

Strings

-, xrefs: 00007FF70AA1C944

Memory Dump Source

Source File: 0000000A.00000002.2345199746.00007FF70A9E1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF70A9E0000, based on PE: true

Associated: 0000000A.00000002.2345173222.00007FF70A9E0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2345236578.00007FF70AA34000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2345264921.00007FF70AA47000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2345286816.00007FF70AA4A000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff70a9e0000_tapinstall.jbxd

Similarity

API ID: CurrentFeaturePresentProcessProcessor_invalid_parameter_noinfo
String ID: -
API String ID: 4036615347-2547889144
Opcode ID: 26c914aef9ac55f9fac2af390a0e01635bd93ea7664d4486faf8e589a2590b3f
Instruction ID: e01d432288a11f9d9accb2d249f5ab8d12bc7e72da4c750804de2649d2a572c4
Opcode Fuzzy Hash: 26c914aef9ac55f9fac2af390a0e01635bd93ea7664d4486faf8e589a2590b3f
Instruction Fuzzy Hash: 928111B3A4878556F660AF25D800B7AF6A1EF95BE0F844275DA9E43BC8DF3CD4028710

Function 00007FF70AA18BC8 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 17COMMON

Download Yara Rule

APIs

try_get_function.LIBVCRUNTIME ref: 00007FF70AA18BEB

Strings

GetSystemTimePreciseAsFileTime, xrefs: 00007FF70AA18BE4

Memory Dump Source

Source File: 0000000A.00000002.2345199746.00007FF70A9E1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF70A9E0000, based on PE: true

Associated: 0000000A.00000002.2345173222.00007FF70A9E0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2345236578.00007FF70AA34000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2345264921.00007FF70AA47000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2345286816.00007FF70AA4A000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff70a9e0000_tapinstall.jbxd

Similarity

API ID: try_get_function
String ID: GetSystemTimePreciseAsFileTime
API String ID: 2742660187-595813830
Opcode ID: 1d0520b3f6df9746826bb7b6fcba1e6990199ef5daaa10c23599dce049dd0ac3
Instruction ID: 216dace97f6d882675315d6397569a1946e585070495e418bfa290a0ea6c28a7
Opcode Fuzzy Hash: 1d0520b3f6df9746826bb7b6fcba1e6990199ef5daaa10c23599dce049dd0ac3
Instruction Fuzzy Hash: 2AE04FD7E1980B91FA16AB91EC509B09250AF0C744EC80472EA1C092D0DF3C6997C360

Function 00007FF70AA322DC Relevance: 3.2, APIs: 2, Instructions: 232COMMONLIBRARYCODE

Download Yara Rule

APIs

_clrfp.LIBCMT ref: 00007FF70AA3252B
RaiseException.KERNEL32 ref: 00007FF70AA3253C

Memory Dump Source

Source File: 0000000A.00000002.2345199746.00007FF70A9E1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF70A9E0000, based on PE: true

Associated: 0000000A.00000002.2345173222.00007FF70A9E0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2345236578.00007FF70AA34000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2345264921.00007FF70AA47000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2345286816.00007FF70AA4A000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff70a9e0000_tapinstall.jbxd

Similarity

API ID: ExceptionRaise_clrfp
String ID:
API String ID: 15204871-0
Opcode ID: 042903b91b322029902fdb30016251db946a203c4db05d47f10b001f22a1f15d
Instruction ID: c41590a41f4433080958909fb7af437b18ac4d3b4b1de25882e550098095dd1f
Opcode Fuzzy Hash: 042903b91b322029902fdb30016251db946a203c4db05d47f10b001f22a1f15d
Instruction Fuzzy Hash: A6B16DB3A01B848BEB15CF29C8827ACB7A0FB44B48F558975EA5D837A4CF39D456C710

Function 00007FF70AA21154 Relevance: 1.9, APIs: 1, Instructions: 439COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2345199746.00007FF70A9E1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF70A9E0000, based on PE: true

Associated: 0000000A.00000002.2345173222.00007FF70A9E0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2345236578.00007FF70AA34000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2345264921.00007FF70AA47000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2345286816.00007FF70AA4A000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff70a9e0000_tapinstall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5eba3dce41e42bb5723036e8a9e38019e2b58d05b121c9b7702cd6f0e866c16f
Instruction ID: 5c60dd473142347dba81a57797c355664ecda5e1b6761fde326867f28faa7d32
Opcode Fuzzy Hash: 5eba3dce41e42bb5723036e8a9e38019e2b58d05b121c9b7702cd6f0e866c16f
Instruction Fuzzy Hash: F002F3B3A0974640FA50BB19EC00E79E695AF45BA0FD447B8ED6D663D1EF3DA4138320

Function 00007FF70AA22160 Relevance: 1.9, APIs: 1, Instructions: 371COMMON

Download Yara Rule

APIs

GetCPInfo.KERNEL32 ref: 00007FF70AA222A8

Memory Dump Source

Source File: 0000000A.00000002.2345199746.00007FF70A9E1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF70A9E0000, based on PE: true

Associated: 0000000A.00000002.2345173222.00007FF70A9E0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2345236578.00007FF70AA34000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2345264921.00007FF70AA47000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2345286816.00007FF70AA4A000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff70a9e0000_tapinstall.jbxd

Similarity

API ID: Info
String ID:
API String ID: 1807457897-0
Opcode ID: 0d4af5a3afae456f38438869c21824332240df2c44c52117edcedc5ea83f20a3
Instruction ID: 25d30a45eac4269f6dc9d462d7912b02835047be4533677de2e3789f7df68b57
Opcode Fuzzy Hash: 0d4af5a3afae456f38438869c21824332240df2c44c52117edcedc5ea83f20a3
Instruction Fuzzy Hash: C012DF63A08BC186E751DF28D804BFDB3A4FB58748F819235EB9C46292EF39E195C710

Function 00007FF70AA22920 Relevance: 1.8, APIs: 1, Instructions: 336COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2345199746.00007FF70A9E1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF70A9E0000, based on PE: true

Associated: 0000000A.00000002.2345173222.00007FF70A9E0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2345236578.00007FF70AA34000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2345264921.00007FF70AA47000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2345286816.00007FF70AA4A000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff70a9e0000_tapinstall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7e3abf74bf7bcf05ea57da7a9d2ca99921f0183db8ab875d81e5133ab0ee468f
Instruction ID: cc03589442a22ac5c0ac9373a97b99bc1ab386764fa3ed12800d519885c919a5
Opcode Fuzzy Hash: 7e3abf74bf7bcf05ea57da7a9d2ca99921f0183db8ab875d81e5133ab0ee468f
Instruction Fuzzy Hash: CEE18F73A04B8185F710EB65E840AEE67A4FB98784F814631DF9D67782EF38D25AC710

Function 00007FF70AA1E810 Relevance: 1.6, APIs: 1, Instructions: 148COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2345199746.00007FF70A9E1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF70A9E0000, based on PE: true

Associated: 0000000A.00000002.2345173222.00007FF70A9E0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2345236578.00007FF70AA34000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2345264921.00007FF70AA47000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2345286816.00007FF70AA4A000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff70a9e0000_tapinstall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e1ecf19e44403f1bf0c8ff516f15394491a0df2bb93855bb1154bab4b69c0414
Instruction ID: 0c5e2c564c271bef6acde60e28775ee1d15b7e8ef0633f148093ac19577749ab
Opcode Fuzzy Hash: e1ecf19e44403f1bf0c8ff516f15394491a0df2bb93855bb1154bab4b69c0414
Instruction Fuzzy Hash: E851AF67B1869194F720AB62ED409BABBA4BF44BD4F944274EE9957BC5CF3CD002C700

Function 00007FF70AA25120 Relevance: 1.6, APIs: 1, Instructions: 70COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF70AA175E8: GetLastError.KERNEL32(?,?,?,00007FF70AA27232,?,?,?,?,?,?,?,?,?,?,?,00007FF70AA2712B), ref: 00007FF70AA175F7
Part of subcall function 00007FF70AA175E8: SetLastError.KERNEL32(?,?,?,00007FF70AA27232,?,?,?,?,?,?,?,?,?,?,?,00007FF70AA2712B), ref: 00007FF70AA17695

GetLocaleInfoW.KERNEL32 ref: 00007FF70AA25188

Memory Dump Source

Source File: 0000000A.00000002.2345199746.00007FF70A9E1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF70A9E0000, based on PE: true

Associated: 0000000A.00000002.2345173222.00007FF70A9E0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2345236578.00007FF70AA34000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2345264921.00007FF70AA47000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2345286816.00007FF70AA4A000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff70a9e0000_tapinstall.jbxd

Similarity

API ID: ErrorLast$InfoLocale
String ID:
API String ID: 3736152602-0
Opcode ID: 2daf3a8a6570d13e4a69e0773b16970abee15f26fc3cb4f4b112bd2ae792f481
Instruction ID: ab5ba62770b665de7e048b9cda0a2de26b9872ffdf40adfa699a4c08c4ccadf1
Opcode Fuzzy Hash: 2daf3a8a6570d13e4a69e0773b16970abee15f26fc3cb4f4b112bd2ae792f481
Instruction Fuzzy Hash: 843171B3E0878386FB24AB25E8417AAB2A1FF54784F809175DA5E936C5DF3CE5128710

Function 00007FF70AA24D3C Relevance: 1.6, APIs: 1, Instructions: 61COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF70AA175E8: GetLastError.KERNEL32(?,?,?,00007FF70AA27232,?,?,?,?,?,?,?,?,?,?,?,00007FF70AA2712B), ref: 00007FF70AA175F7
Part of subcall function 00007FF70AA175E8: SetLastError.KERNEL32(?,?,?,00007FF70AA27232,?,?,?,?,?,?,?,?,?,?,?,00007FF70AA2712B), ref: 00007FF70AA17695

EnumSystemLocalesW.KERNEL32(?,?,?,00007FF70AA2557B,?,00000000,00000092,?,?,00000000,?,00007FF70AA127F1), ref: 00007FF70AA24DDA

Memory Dump Source

Source File: 0000000A.00000002.2345199746.00007FF70A9E1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF70A9E0000, based on PE: true

Associated: 0000000A.00000002.2345173222.00007FF70A9E0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2345236578.00007FF70AA34000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2345264921.00007FF70AA47000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2345286816.00007FF70AA4A000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff70a9e0000_tapinstall.jbxd

Similarity

API ID: ErrorLast$EnumLocalesSystem
String ID:
API String ID: 2417226690-0
Opcode ID: b310e04edf9a4858b7711b1bc3cd10a3b5863322fdd0602e956277415e6d3450
Instruction ID: 5614483b0f5fa4248805a252eae73aef47007107fb0eecf6ff7ead052c3f1d8d
Opcode Fuzzy Hash: b310e04edf9a4858b7711b1bc3cd10a3b5863322fdd0602e956277415e6d3450
Instruction Fuzzy Hash: 4811D5A3E1864587FB149F19D440AA8B7A0EB94FA4F848136C619533C4CF78D5E2C750

Function 00007FF70AA2534C Relevance: 1.6, APIs: 1, Instructions: 50COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF70AA175E8: GetLastError.KERNEL32(?,?,?,00007FF70AA27232,?,?,?,?,?,?,?,?,?,?,?,00007FF70AA2712B), ref: 00007FF70AA175F7
Part of subcall function 00007FF70AA175E8: SetLastError.KERNEL32(?,?,?,00007FF70AA27232,?,?,?,?,?,?,?,?,?,?,?,00007FF70AA2712B), ref: 00007FF70AA17695

GetLocaleInfoW.KERNEL32(?,?,?,00007FF70AA250CD), ref: 00007FF70AA25383

Memory Dump Source

Source File: 0000000A.00000002.2345199746.00007FF70A9E1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF70A9E0000, based on PE: true

Associated: 0000000A.00000002.2345173222.00007FF70A9E0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2345236578.00007FF70AA34000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2345264921.00007FF70AA47000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2345286816.00007FF70AA4A000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff70a9e0000_tapinstall.jbxd

Similarity

API ID: ErrorLast$InfoLocale
String ID:
API String ID: 3736152602-0
Opcode ID: f0e1e85cb0904cfb13678112b23ba47b692ebdb17e326b7273fc79358d1f6376
Instruction ID: 3985cc4aba310777a2ac196a2b82a24eec1d3afd52ef7b8f21cbed059ff80bcb
Opcode Fuzzy Hash: f0e1e85cb0904cfb13678112b23ba47b692ebdb17e326b7273fc79358d1f6376
Instruction Fuzzy Hash: E6112373E1C69782F7746B1AD860A7DA2A1FF00764F902171EA2A536C4DF7CD8A28710

Function 00007FF70AA24E0C Relevance: 1.5, APIs: 1, Instructions: 41COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF70AA175E8: GetLastError.KERNEL32(?,?,?,00007FF70AA27232,?,?,?,?,?,?,?,?,?,?,?,00007FF70AA2712B), ref: 00007FF70AA175F7
Part of subcall function 00007FF70AA175E8: SetLastError.KERNEL32(?,?,?,00007FF70AA27232,?,?,?,?,?,?,?,?,?,?,?,00007FF70AA2712B), ref: 00007FF70AA17695

EnumSystemLocalesW.KERNEL32(?,?,?,00007FF70AA25537,?,00000000,00000092,?,?,00000000,?,00007FF70AA127F1), ref: 00007FF70AA24E8A

Memory Dump Source

Source File: 0000000A.00000002.2345199746.00007FF70A9E1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF70A9E0000, based on PE: true

Associated: 0000000A.00000002.2345173222.00007FF70A9E0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2345236578.00007FF70AA34000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2345264921.00007FF70AA47000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2345286816.00007FF70AA4A000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff70a9e0000_tapinstall.jbxd

Similarity

API ID: ErrorLast$EnumLocalesSystem
String ID:
API String ID: 2417226690-0
Opcode ID: e95a6f0b37c8df2f7d892436cbea75250c8106ecf43136de523b6d98b723d434
Instruction ID: fc2ed23567beb2c7123ba73eabd6c39fcf7f3f0986698658a39cc4887029722e
Opcode Fuzzy Hash: e95a6f0b37c8df2f7d892436cbea75250c8106ecf43136de523b6d98b723d434
Instruction Fuzzy Hash: 4001F1B3F0828287F7106B19E840FB9B6A1EF44BA4F859271D269572D4CF7CA892C714

Function 00007FF70AA17A70 Relevance: 1.5, APIs: 1, Instructions: 32COMMON

Download Yara Rule

APIs

EnumSystemLocalesW.KERNEL32(?,?,00000000,00007FF70AA18911,?,?,?,?,?,?,?,?,00000000,00007FF70AA24244), ref: 00007FF70AA17ABF

Memory Dump Source

Source File: 0000000A.00000002.2345199746.00007FF70A9E1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF70A9E0000, based on PE: true

Associated: 0000000A.00000002.2345173222.00007FF70A9E0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2345236578.00007FF70AA34000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2345264921.00007FF70AA47000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2345286816.00007FF70AA4A000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff70a9e0000_tapinstall.jbxd

Similarity

API ID: EnumLocalesSystem
String ID:
API String ID: 2099609381-0
Opcode ID: 0c79f0349c4a0605245a055538df7ef28e0d12ebb44365a436a3ebf26f8b2171
Instruction ID: 816f63155c3219fa00db17937bbd3bda682c6ead629253e6a64bb95e98c58964
Opcode Fuzzy Hash: 0c79f0349c4a0605245a055538df7ef28e0d12ebb44365a436a3ebf26f8b2171
Instruction Fuzzy Hash: 3AF06DB3B08A4183F744EB29EC409AAB365EFD8780F845175EA0D837A4CF7CD5A28310

Function 00007FF70AA24CB8 Relevance: 1.5, APIs: 1, Instructions: 26COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF70AA175E8: GetLastError.KERNEL32(?,?,?,00007FF70AA27232,?,?,?,?,?,?,?,?,?,?,?,00007FF70AA2712B), ref: 00007FF70AA175F7
Part of subcall function 00007FF70AA175E8: SetLastError.KERNEL32(?,?,?,00007FF70AA27232,?,?,?,?,?,?,?,?,?,?,?,00007FF70AA2712B), ref: 00007FF70AA17695

EnumSystemLocalesW.KERNEL32 ref: 00007FF70AA24CFF

Memory Dump Source

Source File: 0000000A.00000002.2345199746.00007FF70A9E1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF70A9E0000, based on PE: true

Associated: 0000000A.00000002.2345173222.00007FF70A9E0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2345236578.00007FF70AA34000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2345264921.00007FF70AA47000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2345286816.00007FF70AA4A000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff70a9e0000_tapinstall.jbxd

Similarity

API ID: ErrorLast$EnumLocalesSystem
String ID:
API String ID: 2417226690-0
Opcode ID: 37355801d101d15e73ed97373d1325733675572864da2e4454ebca36426ced02
Instruction ID: 3eac77d0ed2c250beca32fc03ecfc2e2800158ea42569776d0f57f1ec9375e07
Opcode Fuzzy Hash: 37355801d101d15e73ed97373d1325733675572864da2e4454ebca36426ced02
Instruction Fuzzy Hash: 40F054A3A0874582EB116F69E840769FBE1EF94BB4F859271D668432D5DF78C4A18700

Function 00007FF70AA17B7C Relevance: 1.5, APIs: 1, Instructions: 19COMMON

Download Yara Rule

APIs

EnumSystemLocalesW.KERNEL32 ref: 00007FF70AA17BB6

Memory Dump Source

Source File: 0000000A.00000002.2345199746.00007FF70A9E1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF70A9E0000, based on PE: true

Associated: 0000000A.00000002.2345173222.00007FF70A9E0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2345236578.00007FF70AA34000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2345264921.00007FF70AA47000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2345286816.00007FF70AA4A000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff70a9e0000_tapinstall.jbxd

Similarity

API ID: EnumLocalesSystem
String ID:
API String ID: 2099609381-0
Opcode ID: a3705e45a4f268f33fd337935757e13d22bf4229caecad54140b34f6bcf306e8
Instruction ID: 09e6f25b2c7e76623f0594cb3b0f4447efe12ceb1d7e2eaeb3491a18254909f8
Opcode Fuzzy Hash: a3705e45a4f268f33fd337935757e13d22bf4229caecad54140b34f6bcf306e8
Instruction Fuzzy Hash: F7E092E2B08A0182FB80EB15EC445267361AF9CBD0FC05071E90D47BA4DF7CD1528310

Function 00007FF70AA17BF8 Relevance: 1.5, APIs: 1, Instructions: 17COMMON

Download Yara Rule

APIs

EnumSystemLocalesW.KERNEL32 ref: 00007FF70AA17C2C

Memory Dump Source

Source File: 0000000A.00000002.2345199746.00007FF70A9E1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF70A9E0000, based on PE: true

Associated: 0000000A.00000002.2345173222.00007FF70A9E0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2345236578.00007FF70AA34000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2345264921.00007FF70AA47000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2345286816.00007FF70AA4A000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff70a9e0000_tapinstall.jbxd

Similarity

API ID: EnumLocalesSystem
String ID:
API String ID: 2099609381-0
Opcode ID: ae0b7570886a34609fae074dd6b97874d1210b0956683149f338bd6385165f94
Instruction ID: dd7f685f524f783737491cb992ada0f6537ef6f18e3624d8ad43d36c8adff0d6
Opcode Fuzzy Hash: ae0b7570886a34609fae074dd6b97874d1210b0956683149f338bd6385165f94
Instruction Fuzzy Hash: E1E04FA2E08A4292F644A751EC54A76A361AFE9791FC011B5F90D07BA09FBC92578310

Function 00007FF70AA056FC Relevance: 1.5, Strings: 1, Instructions: 213COMMON

Download Yara Rule

Strings

0, xrefs: 00007FF70AA058E1

Memory Dump Source

Source File: 0000000A.00000002.2345199746.00007FF70A9E1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF70A9E0000, based on PE: true

Associated: 0000000A.00000002.2345173222.00007FF70A9E0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2345236578.00007FF70AA34000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2345264921.00007FF70AA47000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2345286816.00007FF70AA4A000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff70a9e0000_tapinstall.jbxd

Similarity

API ID:
String ID: 0
API String ID: 0-4108050209
Opcode ID: 3298bf67b1f0c2be8d215b1ef692e2ed5dc4bc9733db5a3918195495d45e186b
Instruction ID: 509682f7d373e9f33f651ad315e437c8f248f1176167cf5fe09d15dc1489c474
Opcode Fuzzy Hash: 3298bf67b1f0c2be8d215b1ef692e2ed5dc4bc9733db5a3918195495d45e186b
Instruction Fuzzy Hash: 8E8107A3E1820346FB64BA39C800E7AA690EF40744FC49471DD8D976D8CF2DE847EB65

Function 00007FF70AA03F10 Relevance: 1.5, Strings: 1, Instructions: 210COMMON

Download Yara Rule

Strings

0, xrefs: 00007FF70AA040BF

Memory Dump Source

Source File: 0000000A.00000002.2345199746.00007FF70A9E1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF70A9E0000, based on PE: true

Associated: 0000000A.00000002.2345173222.00007FF70A9E0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2345236578.00007FF70AA34000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2345264921.00007FF70AA47000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2345286816.00007FF70AA4A000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff70a9e0000_tapinstall.jbxd

Similarity

API ID:
String ID: 0
API String ID: 0-4108050209
Opcode ID: e4dced8d68a820e1a1d04cc35ed3aba3688103cc88bf653a2760244175f13c08
Instruction ID: ab088eb11cbc0fe829e37bbd4d937e5f196ec9d1d5e57e40012ae5e619b61913
Opcode Fuzzy Hash: e4dced8d68a820e1a1d04cc35ed3aba3688103cc88bf653a2760244175f13c08
Instruction Fuzzy Hash: AC71D693A0C74647FAA4AE39C800FBAE791AF55744F8401B5CE499B6D9CF2DE4438731

Function 00007FF70AA059DC Relevance: 1.5, Strings: 1, Instructions: 209COMMON

Download Yara Rule

Strings

0, xrefs: 00007FF70AA05BAB

Memory Dump Source

Source File: 0000000A.00000002.2345199746.00007FF70A9E1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF70A9E0000, based on PE: true

Associated: 0000000A.00000002.2345173222.00007FF70A9E0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2345236578.00007FF70AA34000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2345264921.00007FF70AA47000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2345286816.00007FF70AA4A000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff70a9e0000_tapinstall.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: 0
API String ID: 3215553584-4108050209
Opcode ID: 1601ebb4a085dcb7d739bdd4eed40b615d2130470465d1318d301927c9e7c833
Instruction ID: fd75217bc57507ed43c44534ba3f3521c2adb280368fcf2df311f2b253b0bddc
Opcode Fuzzy Hash: 1601ebb4a085dcb7d739bdd4eed40b615d2130470465d1318d301927c9e7c833
Instruction Fuzzy Hash: B771E7A7F1820346FAA8BA35C844E79A290EF41744FC4D171DD89876D9DF2DF8438B25

Function 00007FF70AA05430 Relevance: 1.5, Strings: 1, Instructions: 209COMMON

Download Yara Rule

Strings

0, xrefs: 00007FF70AA055FF

Memory Dump Source

Source File: 0000000A.00000002.2345199746.00007FF70A9E1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF70A9E0000, based on PE: true

Associated: 0000000A.00000002.2345173222.00007FF70A9E0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2345236578.00007FF70AA34000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2345264921.00007FF70AA47000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2345286816.00007FF70AA4A000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff70a9e0000_tapinstall.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: 0
API String ID: 3215553584-4108050209
Opcode ID: d97ce31363821d7e59ff7b95ab789dce6dae42c5463c516f708e9ad5742ae19f
Instruction ID: 68888cd2fc12a99f224b83e4106ec0d845ee4303d56a9eabc3a1fee92f90a245
Opcode Fuzzy Hash: d97ce31363821d7e59ff7b95ab789dce6dae42c5463c516f708e9ad5742ae19f
Instruction Fuzzy Hash: 8271C697E1824342FA64BA39D800EB9A692EF40744FC49479DD4DC76D9CF2EF8438B25

Function 00007FF70AA041AC Relevance: 1.5, Strings: 1, Instructions: 206COMMON

Download Yara Rule

Strings

0, xrefs: 00007FF70AA04345

Memory Dump Source

Source File: 0000000A.00000002.2345199746.00007FF70A9E1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF70A9E0000, based on PE: true

Associated: 0000000A.00000002.2345173222.00007FF70A9E0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2345236578.00007FF70AA34000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2345264921.00007FF70AA47000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2345286816.00007FF70AA4A000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff70a9e0000_tapinstall.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: 0
API String ID: 3215553584-4108050209
Opcode ID: 77e714d55eda6aa17527c73dbb794f803213f9d7578e7f16155016f531fb6458
Instruction ID: 3bd0dc943d0160e1dc873905a4595625acf28aec1e9f0870063e4900ca2afcf6
Opcode Fuzzy Hash: 77e714d55eda6aa17527c73dbb794f803213f9d7578e7f16155016f531fb6458
Instruction Fuzzy Hash: B071E297B182424BFA64AA39D800FB9A791BF8D744FC411B1CF49876D9CF2DE8438361

Function 00007FF70AA03C8C Relevance: 1.5, Strings: 1, Instructions: 206COMMON

Download Yara Rule

Strings

0, xrefs: 00007FF70AA03E25

Memory Dump Source

Source File: 0000000A.00000002.2345199746.00007FF70A9E1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF70A9E0000, based on PE: true

Associated: 0000000A.00000002.2345173222.00007FF70A9E0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2345236578.00007FF70AA34000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2345264921.00007FF70AA47000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2345286816.00007FF70AA4A000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff70a9e0000_tapinstall.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: 0
API String ID: 3215553584-4108050209
Opcode ID: b9c2a45f343b5c87b971f1cf71d6bc23156fee6f057cfd2d8e17317b84542c78
Instruction ID: 12cdc43e8f40c99e01bd46fb7a9c67ad36425f6d7affb13d02e99f8ac819ccbb
Opcode Fuzzy Hash: b9c2a45f343b5c87b971f1cf71d6bc23156fee6f057cfd2d8e17317b84542c78
Instruction Fuzzy Hash: DE71E393A1824646FE64AA39D804FBAE7919F41744FC409B6DD498F2CACF2DE8438731

Function 00007FF70AA04698 Relevance: 1.4, Strings: 1, Instructions: 200COMMON

Download Yara Rule

Strings

0, xrefs: 00007FF70AA04847

Memory Dump Source

Source File: 0000000A.00000002.2345199746.00007FF70A9E1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF70A9E0000, based on PE: true

Associated: 0000000A.00000002.2345173222.00007FF70A9E0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2345236578.00007FF70AA34000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2345264921.00007FF70AA47000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2345286816.00007FF70AA4A000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff70a9e0000_tapinstall.jbxd

Similarity

API ID:
String ID: 0
API String ID: 0-4108050209
Opcode ID: 5db9519db1cddfaa4ec0483ba47a9384cbcec5f952c5f7433adf20521fb9aad9
Instruction ID: 303ea93aaa49714f4d2d64ee3bcf7e4594d15239f3ebe58304a71a0ceab4afa8
Opcode Fuzzy Hash: 5db9519db1cddfaa4ec0483ba47a9384cbcec5f952c5f7433adf20521fb9aad9
Instruction Fuzzy Hash: 9B710893E0C28247F6686939C800FBADB91BF4A744FC415B5DE48976D9CF2DE8478321

Function 00007FF70AA04430 Relevance: 1.4, Strings: 1, Instructions: 196COMMONLIBRARYCODE

Download Yara Rule

Strings

0, xrefs: 00007FF70AA045C9

Memory Dump Source

Source File: 0000000A.00000002.2345199746.00007FF70A9E1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF70A9E0000, based on PE: true

Associated: 0000000A.00000002.2345173222.00007FF70A9E0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2345236578.00007FF70AA34000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2345264921.00007FF70AA47000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2345286816.00007FF70AA4A000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff70a9e0000_tapinstall.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: 0
API String ID: 3215553584-4108050209
Opcode ID: 90d249107c8bf112e4df0f58921203419683959deed1fc803af336b87ec38021
Instruction ID: 15fe59aa3c80f707b96749edba30a66ea96c2faca2ccfcabe8807901442022b1
Opcode Fuzzy Hash: 90d249107c8bf112e4df0f58921203419683959deed1fc803af336b87ec38021
Instruction Fuzzy Hash: 0061D093A0C24247FA646A39D800FBAD791AF49744FC401B9DA89D76DACF2DFC438761

Function 00007FF70AA04914 Relevance: 1.4, Strings: 1, Instructions: 196COMMON

Download Yara Rule

Strings

0, xrefs: 00007FF70AA04AAD

Memory Dump Source

Source File: 0000000A.00000002.2345199746.00007FF70A9E1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF70A9E0000, based on PE: true

Associated: 0000000A.00000002.2345173222.00007FF70A9E0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2345236578.00007FF70AA34000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2345264921.00007FF70AA47000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2345286816.00007FF70AA4A000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff70a9e0000_tapinstall.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: 0
API String ID: 3215553584-4108050209
Opcode ID: 39f1ec5bb102f363b1fb50bc343c603d561d49684c5f7139075a3ba3241001c7
Instruction ID: 8aecd10aee20ed3337758f326afbbd25847b1ea2caab637caf82c56e88cf8bc7
Opcode Fuzzy Hash: 39f1ec5bb102f363b1fb50bc343c603d561d49684c5f7139075a3ba3241001c7
Instruction Fuzzy Hash: 5D612793A0C24247FA646A39D800FBAD791BF49744FC411B1DE49976DACF2DE8838369

Function 00007FF70AA2D168 Relevance: 1.4, APIs: 1, Instructions: 137COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 00007FF70AA2D20D

Part of subcall function 00007FF70AA17978: HeapAlloc.KERNEL32(?,?,00000000,00007FF70AA177C1,?,?,00000000,00007FF70AA16B85,?,?,?,?,00007FF70A9F6CA8), ref: 00007FF70AA179CD

Part of subcall function 00007FF70AA179F8: HeapFree.KERNEL32(?,?,?,00007FF70AA232DC,?,?,?,00007FF70AA236FF,?,?,00000000,00007FF70AA23F44,?,?,?,00007FF70AA23E77), ref: 00007FF70AA17A0E
Part of subcall function 00007FF70AA179F8: GetLastError.KERNEL32(?,?,?,00007FF70AA232DC,?,?,?,00007FF70AA236FF,?,?,00000000,00007FF70AA23F44,?,?,?,00007FF70AA23E77), ref: 00007FF70AA17A20

Part of subcall function 00007FF70AA2C088: _invalid_parameter_noinfo.LIBCMT ref: 00007FF70AA2C0B6

Memory Dump Source

Source File: 0000000A.00000002.2345199746.00007FF70A9E1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF70A9E0000, based on PE: true

Associated: 0000000A.00000002.2345173222.00007FF70A9E0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2345236578.00007FF70AA34000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2345264921.00007FF70AA47000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2345286816.00007FF70AA4A000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff70a9e0000_tapinstall.jbxd

Similarity

API ID: ErrorHeapLast$AllocFree_invalid_parameter_noinfo
String ID:
API String ID: 916656526-0
Opcode ID: bdc19389d7424b13ec30ac8dba11af17a85217a491f899bfad80f2150ff4fb30
Instruction ID: 60bda92ae01d20ff2aa8e5160d64c93c768383eb1daea617c8342dc00cf77e50
Opcode Fuzzy Hash: bdc19389d7424b13ec30ac8dba11af17a85217a491f899bfad80f2150ff4fb30
Instruction Fuzzy Hash: 2941B6A3B0928346FAA06A5AEC51E7AE6806F457C0F844575ED4D57BC6EF3CE4128720

Function 00007FF70AA257E0 Relevance: 1.3, APIs: 1, Instructions: 7memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 00007FF70AA257E4

Memory Dump Source

Source File: 0000000A.00000002.2345199746.00007FF70A9E1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF70A9E0000, based on PE: true

Associated: 0000000A.00000002.2345173222.00007FF70A9E0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2345236578.00007FF70AA34000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2345264921.00007FF70AA47000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2345286816.00007FF70AA4A000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff70a9e0000_tapinstall.jbxd

Similarity

API ID: HeapProcess
String ID:
API String ID: 54951025-0
Opcode ID: ad7aa9be03b136a8b86c241834f3511267ad507e402bf7d5c4e724964e796d7d
Instruction ID: 41b5e76a34766b69d13d8626c0b1d6464767a91689f5616c2288cab79ca0db98
Opcode Fuzzy Hash: ad7aa9be03b136a8b86c241834f3511267ad507e402bf7d5c4e724964e796d7d
Instruction Fuzzy Hash: BDB09262E07A06C2FA087B16AC8262563A4BF9C701FD440B8D10C42360DF2C20B65721

Function 00007FF70AA12640 Relevance: .4, Instructions: 355COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2345199746.00007FF70A9E1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF70A9E0000, based on PE: true

Associated: 0000000A.00000002.2345173222.00007FF70A9E0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2345236578.00007FF70AA34000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2345264921.00007FF70AA47000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2345286816.00007FF70AA4A000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff70a9e0000_tapinstall.jbxd

Similarity

API ID: ErrorLastNameTranslatetry_get_function$CodePageValid_invalid_parameter_noinfo
String ID:
API String ID: 3827717455-0
Opcode ID: 3f501d995b418e08b38f9edfabc86e8d3cac6d216730b2c8e5cca3346fb82f23
Instruction ID: 9b3c0c2810c2bcd26564f53b1cd25080115eab08cbb79f8bf97af3e721b76cb5
Opcode Fuzzy Hash: 3f501d995b418e08b38f9edfabc86e8d3cac6d216730b2c8e5cca3346fb82f23
Instruction Fuzzy Hash: 93E1A0A3A0868255FB64AB25DC10BFAA7A0FF94788F804075DE8D477C5EF3CD54A8720

Function 00007FF70AA24340 Relevance: .3, Instructions: 276COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2345199746.00007FF70A9E1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF70A9E0000, based on PE: true

Associated: 0000000A.00000002.2345173222.00007FF70A9E0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2345236578.00007FF70AA34000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2345264921.00007FF70AA47000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2345286816.00007FF70AA4A000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff70a9e0000_tapinstall.jbxd

Similarity

API ID: ErrorLast$CurrentFeatureInfoLocalePresentProcessProcessortry_get_function
String ID:
API String ID: 959782435-0
Opcode ID: d56ceefded4baa13521f4f609e87cf593d89bf52db51a349a613b99c63d43d38
Instruction ID: 26893ef75fefc29c459e925167d909730984a16a3d2a28dda03c138cd99ade29
Opcode Fuzzy Hash: d56ceefded4baa13521f4f609e87cf593d89bf52db51a349a613b99c63d43d38
Instruction Fuzzy Hash: B1B118A3A1864643FB54AF25D801AB9B391FF48B48F804175DA4E936C9DF3CD862C750

Function 00007FF70AA04E5C Relevance: .2, Instructions: 221COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2345199746.00007FF70A9E1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF70A9E0000, based on PE: true

Associated: 0000000A.00000002.2345173222.00007FF70A9E0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2345236578.00007FF70AA34000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2345264921.00007FF70AA47000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2345286816.00007FF70AA4A000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff70a9e0000_tapinstall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c849b448950fe45e02ea9840edd387fd791acb62ee3a335009b810c1d76624ef
Instruction ID: d3c77d9bae6d08bc385cfb7e194f2d1a1aa8c4c9c62870d8f005940a7aaec4ef
Opcode Fuzzy Hash: c849b448950fe45e02ea9840edd387fd791acb62ee3a335009b810c1d76624ef
Instruction Fuzzy Hash: FB81B5A7E182034BF7A8BE35D810EBDA290EF44B44FC49175DE49872D9CF2DE8478661

Function 00007FF70AA04B7C Relevance: .2, Instructions: 217COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2345199746.00007FF70A9E1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF70A9E0000, based on PE: true

Associated: 0000000A.00000002.2345173222.00007FF70A9E0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2345236578.00007FF70AA34000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2345264921.00007FF70AA47000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2345286816.00007FF70AA4A000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff70a9e0000_tapinstall.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: b9fb1412a969e83ffd452d5568cc414aa092d552430bd97b87d94c05d621c441
Instruction ID: e7c2e3f8b452c0a25a7d0b4ee00175f8f98f381b88583c207796129b6b0dd33f
Opcode Fuzzy Hash: b9fb1412a969e83ffd452d5568cc414aa092d552430bd97b87d94c05d621c441
Instruction Fuzzy Hash: 2881F5A7A1820247FB69BA39D800EB9A290FF48744FC55176DF49D72D9CF2DE8478260

Function 00007FF70AA05150 Relevance: .2, Instructions: 217COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2345199746.00007FF70A9E1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF70A9E0000, based on PE: true

Associated: 0000000A.00000002.2345173222.00007FF70A9E0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2345236578.00007FF70AA34000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2345264921.00007FF70AA47000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2345286816.00007FF70AA4A000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff70a9e0000_tapinstall.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: fda6414e0ca285d7d3c641e812502447004db9316ab5bd4eb360a61517eae451
Instruction ID: 29f0c567a3030e5bc5d498fad131496447a47dbe0b8b9ad404a384b17344473e
Opcode Fuzzy Hash: fda6414e0ca285d7d3c641e812502447004db9316ab5bd4eb360a61517eae451
Instruction Fuzzy Hash: 21810897E182034AFBA8BA39C810EB9A690EF05744FC49175DD49C72D9CF2DE8478F25

Function 00007FF70AA13F14 Relevance: .1, Instructions: 126COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2345199746.00007FF70A9E1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF70A9E0000, based on PE: true

Associated: 0000000A.00000002.2345173222.00007FF70A9E0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2345236578.00007FF70AA34000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2345264921.00007FF70AA47000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2345286816.00007FF70AA4A000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff70a9e0000_tapinstall.jbxd

Similarity

API ID: ErrorFreeHeapLast
String ID:
API String ID: 485612231-0
Opcode ID: b28074559aeab5e219c3ff33a27b5a6f1737238eeca4a21f3c0611eb71f637c7
Instruction ID: c95a4376ffb041c38a4f5a5b7543a4347673c31e25ff224ee544af5375b9d88b
Opcode Fuzzy Hash: b28074559aeab5e219c3ff33a27b5a6f1737238eeca4a21f3c0611eb71f637c7
Instruction Fuzzy Hash: DC41C0A3714A5496FB44DE2ADD14969B3A1AB48FD4F899136EE0D97B98DF7CC0428300

Function 00007FF70AA31B20 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2345199746.00007FF70A9E1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF70A9E0000, based on PE: true

Associated: 0000000A.00000002.2345173222.00007FF70A9E0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2345236578.00007FF70AA34000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2345264921.00007FF70AA47000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2345286816.00007FF70AA4A000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff70a9e0000_tapinstall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 12c6a83125842657aa20d81587556ef437bc21cebfee6fedb56fe02cecd375e9
Instruction ID: 985eaea3702849b52ae84cb159b06382acdc3a012255e4b959b6c441268ec1fc
Opcode Fuzzy Hash: 12c6a83125842657aa20d81587556ef437bc21cebfee6fedb56fe02cecd375e9
Instruction Fuzzy Hash: 5FF068B2B182D58AEB949F2CE842A7A77D0EB58380F908179E58D83B44D77C90618F14

Function 00007FF70A9E8738 Relevance: .0, Instructions: 2COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2345199746.00007FF70A9E1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF70A9E0000, based on PE: true

Associated: 0000000A.00000002.2345173222.00007FF70A9E0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2345236578.00007FF70AA34000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2345264921.00007FF70AA47000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2345286816.00007FF70AA4A000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff70a9e0000_tapinstall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 075bea70bcd4d8cceaabd6cf7978304fe9b2e4df568cf5a1b525f3513ad4298d
Instruction ID: 9bb9723b6f9c3618bd9dab75d372c1e7ae4c84c64df2cb8743b6c62b1a6c50c8
Opcode Fuzzy Hash: 075bea70bcd4d8cceaabd6cf7978304fe9b2e4df568cf5a1b525f3513ad4298d
Instruction Fuzzy Hash: 83A00167A1C842D2F645AB80EC54420A360FF64305F8084B1E00D910A1DF2DA4018220

Function 00007FF70A9EE890 Relevance: 82.7, APIs: 44, Strings: 3, Instructions: 459COMMONLIBRARYCODE

Download Yara Rule

APIs

DName::DName.LIBVCRUNTIME ref: 00007FF70A9EE93C

Part of subcall function 00007FF70A9EA83C: DName::doPchar.LIBVCRUNTIME ref: 00007FF70A9EA86E

DName::operator+.LIBVCRUNTIME ref: 00007FF70A9EE94C

Part of subcall function 00007FF70A9EAD70: DName::operator+=.LIBVCRUNTIME ref: 00007FF70A9EAD8B

DName::DName.LIBVCRUNTIME ref: 00007FF70A9EEEBD
DName::operator+=.LIBVCRUNTIME ref: 00007FF70A9EEEDE
DName::DName.LIBVCRUNTIME ref: 00007FF70A9EEF26
UnDecorator::getDecoratedName.LIBVCRUNTIME ref: 00007FF70A9EEF3B
DName::operator+=.LIBVCRUNTIME ref: 00007FF70A9EEF47
UnDecorator::getSymbolName.LIBVCRUNTIME ref: 00007FF70A9EEF64
DName::operator+=.LIBVCRUNTIME ref: 00007FF70A9EEF70
DName::operator+=.LIBCMT ref: 00007FF70A9EEF80
DName::operator=.LIBVCRUNTIME ref: 00007FF70A9EE926

Part of subcall function 00007FF70A9EAC18: DName::doPchar.LIBVCRUNTIME ref: 00007FF70A9EAC40

DName::doPchar.LIBVCRUNTIME ref: 00007FF70A9EE9C3
DName::operator+.LIBVCRUNTIME ref: 00007FF70A9EE9D3
DName::operator+=.LIBVCRUNTIME ref: 00007FF70A9EE9E0
DName::operator+=.LIBVCRUNTIME ref: 00007FF70A9EEA05
DName::operator+=.LIBVCRUNTIME ref: 00007FF70A9EEA10
DName::doPchar.LIBVCRUNTIME ref: 00007FF70A9EEA8A
DName::operator+.LIBVCRUNTIME ref: 00007FF70A9EEA9B
DName::operator+=.LIBVCRUNTIME ref: 00007FF70A9EEABF
DName::DName.LIBVCRUNTIME ref: 00007FF70A9EEB65
DName::DName.LIBVCRUNTIME ref: 00007FF70A9EEBA9
UnDecorator::getStringEncoding.LIBVCRUNTIME ref: 00007FF70A9EEBE8
DName::operator=.LIBVCRUNTIME ref: 00007FF70A9EEC67
DName::operator+.LIBVCRUNTIME ref: 00007FF70A9EEC88
DName::operator=.LIBVCRUNTIME ref: 00007FF70A9EECB5
DName::operator+.LIBVCRUNTIME ref: 00007FF70A9EECFA
UnDecorator::getSignedDimension.LIBVCRUNTIME ref: 00007FF70A9EED03
DName::operator+.LIBVCRUNTIME ref: 00007FF70A9EED12
DName::operator+=.LIBVCRUNTIME ref: 00007FF70A9EED1E
UnDecorator::getSignedDimension.LIBVCRUNTIME ref: 00007FF70A9EED27
DName::operator+.LIBVCRUNTIME ref: 00007FF70A9EED36
DName::operator+=.LIBVCRUNTIME ref: 00007FF70A9EED42
UnDecorator::getSignedDimension.LIBVCRUNTIME ref: 00007FF70A9EED4B
DName::operator+.LIBVCRUNTIME ref: 00007FF70A9EED5A
DName::operator+=.LIBVCRUNTIME ref: 00007FF70A9EED66
DName::operator+.LIBVCRUNTIME ref: 00007FF70A9EED80
DName::operator+=.LIBVCRUNTIME ref: 00007FF70A9EED8C
DName::operator+.LIBVCRUNTIME ref: 00007FF70A9EED9B
UnDecorator::getDataType.LIBVCRUNTIME ref: 00007FF70A9EEDAB
DName::operator+.LIBVCRUNTIME ref: 00007FF70A9EEDBB
DName::operator+.LIBVCRUNTIME ref: 00007FF70A9EEDCB
DName::operator+.LIBVCRUNTIME ref: 00007FF70A9EEDDA
DName::operator=.LIBVCRUNTIME ref: 00007FF70A9EEDFC
DName::operator=.LIBVCRUNTIME ref: 00007FF70A9EEFD9

Strings

operator, xrefs: 00007FF70A9EE931
`anonymous namespace', xrefs: 00007FF70A9EEC1D
`string', xrefs: 00007FF70A9EEBDD

Memory Dump Source

Source File: 0000000A.00000002.2345199746.00007FF70A9E1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF70A9E0000, based on PE: true

Associated: 0000000A.00000002.2345173222.00007FF70A9E0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2345236578.00007FF70AA34000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2345264921.00007FF70AA47000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2345286816.00007FF70AA4A000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff70a9e0000_tapinstall.jbxd

Similarity

API ID: Name::operator+Name::operator+=$Decorator::getName$Name::Name::operator=$Name::doPchar$DimensionSigned$DataDecoratedEncodingStringSymbolType
String ID: `anonymous namespace'$`string'$operator
API String ID: 2020783597-815891235
Opcode ID: aede423d4dabe3da59b1e03a92da396b2b5059be44e77dc81dd73a52e45e54ff
Instruction ID: db33c81846097360db02a22951237ee92d3b990d4103efefb360e311b280aaf0
Opcode Fuzzy Hash: aede423d4dabe3da59b1e03a92da396b2b5059be44e77dc81dd73a52e45e54ff
Instruction Fuzzy Hash: 38227E63B2CA6698FB14EB60DC901FCA761AF2478CFD440B6DA0D97696DF68E445C320

Function 00007FF70A9EC6CC Relevance: 73.8, APIs: 17, Strings: 25, Instructions: 277COMMONLIBRARYCODE

Download Yara Rule

APIs

DName::operator=.LIBVCRUNTIME ref: 00007FF70A9EC75B
DName::DName.LIBVCRUNTIME ref: 00007FF70A9EC818
UnDecorator::getECSUDataType.LIBVCRUNTIME ref: 00007FF70A9EC8CC
DName::operator=.LIBVCRUNTIME ref: 00007FF70A9EC9CB
DName::operator+=.LIBCMT ref: 00007FF70A9EC9DB
DName::DName.LIBVCRUNTIME ref: 00007FF70A9ECA21
DName::operator+.LIBVCRUNTIME ref: 00007FF70A9ECA31
DName::doPchar.LIBVCRUNTIME ref: 00007FF70A9ECA65
DName::operator+.LIBVCRUNTIME ref: 00007FF70A9ECA75
DName::operator+=.LIBVCRUNTIME ref: 00007FF70A9ECA82
DName::operator=.LIBVCRUNTIME ref: 00007FF70A9ECAB3
DName::operator+=.LIBCMT ref: 00007FF70A9ECAC7
DName::operator=.LIBVCRUNTIME ref: 00007FF70A9ECADD
UnDecorator::getPtrRefType.LIBVCRUNTIME ref: 00007FF70A9ECAF4
DName::operator+.LIBVCRUNTIME ref: 00007FF70A9ECB14

Strings

volatile, xrefs: 00007FF70A9ECABC
__int8, xrefs: 00007FF70A9EC7F5
wchar_t, xrefs: 00007FF70A9EC8FE
char32_t, xrefs: 00007FF70A9EC90A
char, xrefs: 00007FF70A9EC780
void, xrefs: 00007FF70A9EC99D
signed , xrefs: 00007FF70A9ECA16
<unknown>, xrefs: 00007FF70A9EC922
long, xrefs: 00007FF70A9EC765
float, xrefs: 00007FF70A9EC750
__w64 , xrefs: 00007FF70A9EC80A
bool, xrefs: 00007FF70A9EC88D
__int32, xrefs: 00007FF70A9EC881
long , xrefs: 00007FF70A9EC9C0
int, xrefs: 00007FF70A9EC76E
const, xrefs: 00007FF70A9ECAA8
__int128, xrefs: 00007FF70A9EC869
UNKNOWN, xrefs: 00007FF70A9EC8F2
char16_t, xrefs: 00007FF70A9EC916
short, xrefs: 00007FF70A9EC777
unsigned , xrefs: 00007FF70A9ECA0D
volatile, xrefs: 00007FF70A9ECAD2
__int64, xrefs: 00007FF70A9EC875
double, xrefs: 00007FF70A9EC9D0
__int16, xrefs: 00007FF70A9EC84A

Memory Dump Source

Source File: 0000000A.00000002.2345199746.00007FF70A9E1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF70A9E0000, based on PE: true

Associated: 0000000A.00000002.2345173222.00007FF70A9E0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2345236578.00007FF70AA34000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2345264921.00007FF70AA47000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2345286816.00007FF70AA4A000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff70a9e0000_tapinstall.jbxd

Similarity

API ID: Name::operator=$Name::operator+Name::operator+=$Decorator::getNameName::Type$DataName::doPchar
String ID: volatile$<unknown>$UNKNOWN$__int128$__int16$__int32$__int64$__int8$__w64 $bool$char$char16_t$char32_t$const$double$float$int$long$long $short$signed $unsigned $void$volatile$wchar_t
API String ID: 1480303775-3737837666
Opcode ID: 5336914cda9eb7d28fc33c9881fb9f0eefb368431fddd4b441b46ed6f18de0a2
Instruction ID: a6691637812ab297cf856dc4f386cf10bf62d08cb68a0ba77a6ac963f879bc71
Opcode Fuzzy Hash: 5336914cda9eb7d28fc33c9881fb9f0eefb368431fddd4b441b46ed6f18de0a2
Instruction Fuzzy Hash: 23D14BA3F2C65398FB54EB54DC806BCA370BF24348FD044B2E94D96696DF6CE54583A0

Function 00007FF70A9F03F0 Relevance: 59.7, APIs: 30, Strings: 4, Instructions: 242COMMONLIBRARYCODE

Download Yara Rule

APIs

UnDecorator::getDecoratedName.LIBVCRUNTIME ref: 00007FF70A9F0470

Part of subcall function 00007FF70A9ED694: UnDecorator::getDataType.LIBVCRUNTIME ref: 00007FF70A9ED6DC

UnDecorator::getSignedDimension.LIBVCRUNTIME ref: 00007FF70A9F047E
UnDecorator::getSignedDimension.LIBVCRUNTIME ref: 00007FF70A9F0487
DName::getString.LIBVCRUNTIME ref: 00007FF70A9F04AE
DName::DName.LIBVCRUNTIME ref: 00007FF70A9F04DE
DName::operator+.LIBVCRUNTIME ref: 00007FF70A9F04ED
DName::operator+.LIBVCRUNTIME ref: 00007FF70A9F04FC
DName::DName.LIBVCRUNTIME ref: 00007FF70A9F0520
UnDecorator::getSignedDimension.LIBVCRUNTIME ref: 00007FF70A9F0551
DName::doPchar.LIBVCRUNTIME ref: 00007FF70A9F0594
UnDecorator::getDecoratedName.LIBVCRUNTIME ref: 00007FF70A9F05A5
DName::operator+=.LIBVCRUNTIME ref: 00007FF70A9F05B1
DName::operator+=.LIBVCRUNTIME ref: 00007FF70A9F05BC
UnDecorator::getSignedDimension.LIBVCRUNTIME ref: 00007FF70A9F05DE
DName::operator+=.LIBVCRUNTIME ref: 00007FF70A9F05EA
DName::operator+=.LIBVCRUNTIME ref: 00007FF70A9F05F5
UnDecorator::getSignedDimension.LIBVCRUNTIME ref: 00007FF70A9F05FE
DName::operator+=.LIBVCRUNTIME ref: 00007FF70A9F060A
DName::operator+=.LIBVCRUNTIME ref: 00007FF70A9F0615
UnDecorator::getSignedDimension.LIBVCRUNTIME ref: 00007FF70A9F061E
DName::operator+=.LIBVCRUNTIME ref: 00007FF70A9F062A
DName::operator+.LIBVCRUNTIME ref: 00007FF70A9F0639

Strings

NULL, xrefs: 00007FF70A9F0516
`generic-class-parameter-, xrefs: 00007FF70A9F0767
`generic-method-parameter-, xrefs: 00007FF70A9F0732
`template-type-parameter-, xrefs: 00007FF70A9F0770

Memory Dump Source

Source File: 0000000A.00000002.2345199746.00007FF70A9E1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF70A9E0000, based on PE: true

Associated: 0000000A.00000002.2345173222.00007FF70A9E0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2345236578.00007FF70AA34000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2345264921.00007FF70AA47000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2345286816.00007FF70AA4A000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff70a9e0000_tapinstall.jbxd

Similarity

API ID: Decorator::get$Name::operator+=$DimensionSigned$Name$Name::operator+$DecoratedName::$DataName::doName::getPcharStringType
String ID: NULL$`generic-class-parameter-$`generic-method-parameter-$`template-type-parameter-
API String ID: 283215372-4167119577
Opcode ID: 7b301788f1c808b6dbcb0f6369f2a7d1d94637bd6059d460935599cb42e21360
Instruction ID: d3b2f6073262562e914ea57297026401fa5cf834a78c535ad0e5177aa6090a1d
Opcode Fuzzy Hash: 7b301788f1c808b6dbcb0f6369f2a7d1d94637bd6059d460935599cb42e21360
Instruction Fuzzy Hash: 1FB16C63F2D64398FB10EB64CC452FCA7A55F94788FD001B6D90D86A97EF6CA50AC320

Function 00007FF70A9EE070 Relevance: 52.9, APIs: 35, Instructions: 365COMMONLIBRARYCODE

Download Yara Rule

APIs

DName::operator+.LIBVCRUNTIME ref: 00007FF70A9EE0C1

Part of subcall function 00007FF70A9EAD70: DName::operator+=.LIBVCRUNTIME ref: 00007FF70A9EAD8B

DName::DName.LIBVCRUNTIME ref: 00007FF70A9EE179
DName::operator+.LIBVCRUNTIME ref: 00007FF70A9EE189
UnDecorator::getScope.LIBVCRUNTIME ref: 00007FF70A9EE1AC
DName::doPchar.LIBVCRUNTIME ref: 00007FF70A9EE1CE
DName::operator+.LIBVCRUNTIME ref: 00007FF70A9EE1DE
DName::operator+.LIBVCRUNTIME ref: 00007FF70A9EE1EF
UnDecorator::getDataIndirectType.LIBVCRUNTIME ref: 00007FF70A9EE296

Memory Dump Source

Source File: 0000000A.00000002.2345199746.00007FF70A9E1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF70A9E0000, based on PE: true

Associated: 0000000A.00000002.2345173222.00007FF70A9E0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2345236578.00007FF70AA34000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2345264921.00007FF70AA47000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2345286816.00007FF70AA4A000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff70a9e0000_tapinstall.jbxd

Similarity

API ID: Name::operator+$Decorator::get$DataIndirectNameName::Name::doName::operator+=PcharScopeType
String ID:
API String ID: 3173522582-0
Opcode ID: 0f8fc59074820430211e5edccfc92087bcdcd104a7c28eeafd2b21ab4534d517
Instruction ID: cab23ed5a67295b20c67f663985f6c6a74d1af702b1c4afab3e6c7dac6de9253
Opcode Fuzzy Hash: 0f8fc59074820430211e5edccfc92087bcdcd104a7c28eeafd2b21ab4534d517
Instruction Fuzzy Hash: 5D026D77B18A82AAFB10EF64D8401ECB7A1AF5474CF844076EA4D97A9ADF38D505C360

Function 00007FF70AA192EC Relevance: 36.8, APIs: 10, Strings: 11, Instructions: 57COMMON

Download Yara Rule

APIs

try_get_function.LIBVCRUNTIME ref: 00007FF70AA19307
try_get_function.LIBVCRUNTIME ref: 00007FF70AA19326

Part of subcall function 00007FF70AA181A8: GetProcAddress.KERNEL32(?,?,00000006,00007FF70AA18A2A,?,?,00000000,00007FF70AA177AE,?,?,00000000,00007FF70AA16B85), ref: 00007FF70AA18300

try_get_function.LIBVCRUNTIME ref: 00007FF70AA19345

Part of subcall function 00007FF70AA181A8: LoadLibraryExW.KERNELBASE(?,?,00000006,00007FF70AA18A2A,?,?,00000000,00007FF70AA177AE,?,?,00000000,00007FF70AA16B85), ref: 00007FF70AA1824B
Part of subcall function 00007FF70AA181A8: GetLastError.KERNEL32(?,?,00000006,00007FF70AA18A2A,?,?,00000000,00007FF70AA177AE,?,?,00000000,00007FF70AA16B85), ref: 00007FF70AA18259
Part of subcall function 00007FF70AA181A8: LoadLibraryExW.KERNEL32(?,?,00000006,00007FF70AA18A2A,?,?,00000000,00007FF70AA177AE,?,?,00000000,00007FF70AA16B85), ref: 00007FF70AA1829B

try_get_function.LIBVCRUNTIME ref: 00007FF70AA19364

Part of subcall function 00007FF70AA181A8: FreeLibrary.KERNEL32(?,?,00000006,00007FF70AA18A2A,?,?,00000000,00007FF70AA177AE,?,?,00000000,00007FF70AA16B85), ref: 00007FF70AA182D4

try_get_function.LIBVCRUNTIME ref: 00007FF70AA19383
try_get_function.LIBVCRUNTIME ref: 00007FF70AA193A2
try_get_function.LIBVCRUNTIME ref: 00007FF70AA193C1
try_get_function.LIBVCRUNTIME ref: 00007FF70AA193E0
try_get_function.LIBVCRUNTIME ref: 00007FF70AA193FF
try_get_function.LIBVCRUNTIME ref: 00007FF70AA1941E

Strings

GetDateFormatEx, xrefs: 00007FF70AA1934A, 00007FF70AA1935D
LCIDToLocaleName, xrefs: 00007FF70AA19404, 00007FF70AA19417
GetTimeFormatEx, xrefs: 00007FF70AA19388, 00007FF70AA1939B
IsValidLocaleName, xrefs: 00007FF70AA193C6, 00007FF70AA193D9
GetLocaleInfoEx, xrefs: 00007FF70AA19369, 00007FF70AA1937C
EnumSystemLocalesEx, xrefs: 00007FF70AA1932B, 00007FF70AA1933E
LCMapStringEx, xrefs: 00007FF70AA193E5, 00007FF70AA193F8
LocaleNameToLCID, xrefs: 00007FF70AA19423, 00007FF70AA19436
GetUserDefaultLocaleName, xrefs: 00007FF70AA193A7, 00007FF70AA193BA
AreFileApisANSI, xrefs: 00007FF70AA19300
CompareStringEx, xrefs: 00007FF70AA1930C, 00007FF70AA1931F

Memory Dump Source

Source File: 0000000A.00000002.2345199746.00007FF70A9E1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF70A9E0000, based on PE: true

Associated: 0000000A.00000002.2345173222.00007FF70A9E0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2345236578.00007FF70AA34000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2345264921.00007FF70AA47000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2345286816.00007FF70AA4A000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff70a9e0000_tapinstall.jbxd

Similarity

API ID: try_get_function$Library$Load$AddressErrorFreeLastProc
String ID: AreFileApisANSI$CompareStringEx$EnumSystemLocalesEx$GetDateFormatEx$GetLocaleInfoEx$GetTimeFormatEx$GetUserDefaultLocaleName$IsValidLocaleName$LCIDToLocaleName$LCMapStringEx$LocaleNameToLCID
API String ID: 3255926029-3252031757
Opcode ID: f5ddb8dc0f958fd9ea081183d1d9282a99c58eacf92a6cfce449543f48408e78
Instruction ID: df47c5032cfc14127be10bd1ca05223b491d374dc590565f2406a58d0bdaf211
Opcode Fuzzy Hash: f5ddb8dc0f958fd9ea081183d1d9282a99c58eacf92a6cfce449543f48408e78
Instruction Fuzzy Hash: 1B313BE7D08A8BA0F605FB54EC519F4A321AF48344FC054B3E40E462E19F7CAA5BD7A1

Function 00007FF70A9E61F0 Relevance: 28.2, APIs: 12, Strings: 4, Instructions: 191COMMON

Download Yara Rule

APIs

SetupDiGetDeviceInfoListDetailW.SETUPAPI ref: 00007FF70A9E6237
CM_Get_DevNode_Status_Ex.SETUPAPI ref: 00007FF70A9E6260
CM_Get_First_Log_Conf_Ex.SETUPAPI ref: 00007FF70A9E6289
CM_Get_First_Log_Conf_Ex.SETUPAPI ref: 00007FF70A9E62AA
CM_Get_First_Log_Conf_Ex.SETUPAPI ref: 00007FF70A9E62D8
CM_Get_Next_Res_Des_Ex.SETUPAPI ref: 00007FF70A9E638E
CM_Free_Res_Des_Handle.SETUPAPI ref: 00007FF70A9E63A8
CM_Get_Res_Des_Data_Size_Ex.SETUPAPI ref: 00007FF70A9E63C1
CM_Get_Res_Des_Data_Ex.SETUPAPI ref: 00007FF70A9E63F9
CM_Get_Next_Res_Des_Ex.SETUPAPI ref: 00007FF70A9E64C6
CM_Free_Res_Des_Handle.SETUPAPI ref: 00007FF70A9E64EC
CM_Free_Log_Conf_Handle.SETUPAPI ref: 00007FF70A9E64F7

Strings

IRQ : %u, xrefs: 00007FF70A9E642E
IO : %04I64x-%04I64x, xrefs: 00007FF70A9E646F
DMA : %u, xrefs: 00007FF70A9E6449
MEM : %08I64x-%08I64x, xrefs: 00007FF70A9E6490

Memory Dump Source

Source File: 0000000A.00000002.2345199746.00007FF70A9E1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF70A9E0000, based on PE: true

Associated: 0000000A.00000002.2345173222.00007FF70A9E0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2345236578.00007FF70AA34000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2345264921.00007FF70AA47000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2345286816.00007FF70AA4A000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff70a9e0000_tapinstall.jbxd

Similarity

API ID: Get_$Des_Res_$Conf_Log_$First_Free_Handle$Data_Next_$DetailDeviceInfoListNode_SetupSize_Status_
String ID: DMA : %u$IO : %04I64x-%04I64x$IRQ : %u$MEM : %08I64x-%08I64x
API String ID: 2957808706-3427375868
Opcode ID: a4e06f8e4a64dca8354c6e1283bba188da2d5f0b0782a176430cef695ac593de
Instruction ID: f1890312fef5a71e1d168a7e6a6e926b3e550611b5088bdfa76f938a2a0b269c
Opcode Fuzzy Hash: a4e06f8e4a64dca8354c6e1283bba188da2d5f0b0782a176430cef695ac593de
Instruction Fuzzy Hash: 2891647372C68286F750EF15E84466AE7A0FFA5B48F800075EA4D8769ADF3DE445CB20

Function 00007FF70A9E2C90 Relevance: 26.6, APIs: 11, Strings: 4, Instructions: 380serviceregistryCOMMON

Download Yara Rule

APIs

SetupDiClassGuidsFromNameExW.SETUPAPI ref: 00007FF70A9E2D04
GetLastError.KERNEL32 ref: 00007FF70A9E2D0E

Part of subcall function 00007FF70A9F676C: _invalid_parameter_noinfo.LIBCMT ref: 00007FF70A9F6789

SetupDiOpenClassRegKeyExW.SETUPAPI ref: 00007FF70A9E2D96
OpenSCManagerW.ADVAPI32 ref: 00007FF70A9E2ED7
OpenServiceW.ADVAPI32 ref: 00007FF70A9E2EF5
CloseServiceHandle.ADVAPI32 ref: 00007FF70A9E2F06
CloseServiceHandle.ADVAPI32 ref: 00007FF70A9E2F0F
RegCloseKey.ADVAPI32 ref: 00007FF70A9E31FD
RegCloseKey.ADVAPI32 ref: 00007FF70A9E321B

Strings

upper, xrefs: 00007FF70A9E2D2B
lower, xrefs: 00007FF70A9E2D50
LowerFilters, xrefs: 00007FF70A9E2D64
UpperFilters, xrefs: 00007FF70A9E2D43

Memory Dump Source

Source File: 0000000A.00000002.2345199746.00007FF70A9E1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF70A9E0000, based on PE: true

Associated: 0000000A.00000002.2345173222.00007FF70A9E0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2345236578.00007FF70AA34000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2345264921.00007FF70AA47000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2345286816.00007FF70AA4A000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff70a9e0000_tapinstall.jbxd

Similarity

API ID: Close$OpenService$ClassHandleSetup$ErrorFromGuidsLastManagerName_invalid_parameter_noinfo
String ID: LowerFilters$UpperFilters$lower$upper
API String ID: 159866419-3449112408
Opcode ID: 04d78bdca285827dd18647d1427b74e056b8c47343acbe8526b1cd4a7cfcbc6c
Instruction ID: 5c559b2899f6b3b1d695d00ff6c5e2f545162794ab39bb347503e0a86a1456aa
Opcode Fuzzy Hash: 04d78bdca285827dd18647d1427b74e056b8c47343acbe8526b1cd4a7cfcbc6c
Instruction Fuzzy Hash: 67E1D123B2DA4241FA60EB15DD4037AE2A5EF64B98F844175EE1E8B7D6DF3DE4418320

Function 00007FF70A9F1088 Relevance: 24.7, APIs: 12, Strings: 2, Instructions: 195COMMONLIBRARYCODE

Download Yara Rule

APIs

UnDecorator::getTemplateName.LIBVCRUNTIME ref: 00007FF70A9F1108
Replicator::operator+=.LIBVCRUNTIME ref: 00007FF70A9F132B

Strings

template-parameter-, xrefs: 00007FF70A9F1165
generic-type-, xrefs: 00007FF70A9F11A1

Memory Dump Source

Source File: 0000000A.00000002.2345199746.00007FF70A9E1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF70A9E0000, based on PE: true

Associated: 0000000A.00000002.2345173222.00007FF70A9E0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2345236578.00007FF70AA34000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2345264921.00007FF70AA47000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2345286816.00007FF70AA4A000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff70a9e0000_tapinstall.jbxd

Similarity

API ID: Decorator::getNameReplicator::operator+=Template
String ID: generic-type-$template-parameter-
API String ID: 2731555906-13229604
Opcode ID: 84b3677d49f92f823a7e74a3a09ad7f2eb3bf894bac47f523860a981e25c4147
Instruction ID: 409719c2dfd97dd0e17d0bd7196e64479cac18d31b9361b03375c5baec71c01a
Opcode Fuzzy Hash: 84b3677d49f92f823a7e74a3a09ad7f2eb3bf894bac47f523860a981e25c4147
Instruction Fuzzy Hash: 16918C63B28A4789FB10EB64DC905BCB7A1AF54B88FD001B6DA0D97795DF2CE506C360

Function 00007FF70A9E5BD0 Relevance: 21.3, APIs: 11, Strings: 1, Instructions: 272timeCOMMON

Download Yara Rule

APIs

SetupDiGetDeviceInstallParamsW.SETUPAPI ref: 00007FF70A9E5C48
SetupDiSetDeviceInstallParamsW.SETUPAPI ref: 00007FF70A9E5C69
SetupDiBuildDriverInfoList.SETUPAPI ref: 00007FF70A9E5C81
SetupDiEnumDriverInfoW.SETUPAPI ref: 00007FF70A9E5CB3
SetupDiGetDriverInfoDetailW.SETUPAPI ref: 00007FF70A9E5D2A
GetLastError.KERNEL32 ref: 00007FF70A9E5D34
FileTimeToSystemTime.KERNEL32 ref: 00007FF70A9E5E13
GetDateFormatW.KERNEL32 ref: 00007FF70A9E5E42
SetupDiGetDriverInstallParamsW.SETUPAPI ref: 00007FF70A9E5EDC
SetupDiEnumDriverInfoW.SETUPAPI ref: 00007FF70A9E602B
SetupDiDestroyDriverInfoList.SETUPAPI ref: 00007FF70A9E6061

Part of subcall function 00007FF70A9E4770: FormatMessageW.KERNEL32(?,?,?,?,?,?,?,?,00000000,?,00007FF70A9E10DD), ref: 00007FF70A9E47B7
Part of subcall function 00007FF70A9E4770: LocalFree.KERNEL32(?,?,?,?,?,?,?,?,00000000,?,00007FF70A9E10DD), ref: 00007FF70A9E480B

Strings

, xrefs: 00007FF70A9E5EC7

Memory Dump Source

Source File: 0000000A.00000002.2345199746.00007FF70A9E1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF70A9E0000, based on PE: true

Associated: 0000000A.00000002.2345173222.00007FF70A9E0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2345236578.00007FF70AA34000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2345264921.00007FF70AA47000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2345286816.00007FF70AA4A000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff70a9e0000_tapinstall.jbxd

Similarity

API ID: Setup$Driver$Info$InstallParams$DeviceEnumFormatListTime$BuildDateDestroyDetailErrorFileFreeLastLocalMessageSystem
String ID:
API String ID: 2668181066-3916222277
Opcode ID: e4b5dfb2d01c01c868df09e416ecf3eefc922ffbc0b423e26137771d3025f2ca
Instruction ID: 38ffdae1d34156e9a36f2c75cbdb738aee0f92fc569d3354aac5c6a9e6ea54e8
Opcode Fuzzy Hash: e4b5dfb2d01c01c868df09e416ecf3eefc922ffbc0b423e26137771d3025f2ca
Instruction Fuzzy Hash: CDC14032B2C28246F714BB61D8157EAA291EF94788F804475EA4E877C7CF7EE54087A0

Function 00007FF70A9F3800 Relevance: 19.6, APIs: 8, Strings: 3, Instructions: 316COMMONLIBRARYCODE

Download Yara Rule

APIs

__FrameHandler3::GetHandlerSearchState.LIBVCRUNTIME ref: 00007FF70A9F3865

Part of subcall function 00007FF70A9F5DD8: __GetUnwindTryBlock.LIBCMT ref: 00007FF70A9F5E1B
Part of subcall function 00007FF70A9F5DD8: __SetUnwindTryBlock.LIBVCRUNTIME ref: 00007FF70A9F5E40

Is_bad_exception_allowed.LIBVCRUNTIME ref: 00007FF70A9F393D
TypeMatchHelper.LIBVCRUNTIME ref: 00007FF70A9F3AAC
__FrameHandler3::ExecutionInCatch.LIBVCRUNTIME ref: 00007FF70A9F3BB2
__FrameHandler3::UnwindNestedFrames.LIBVCRUNTIME ref: 00007FF70A9F3C41
__DestructExceptionObject.LIBVCRUNTIME ref: 00007FF70A9F3CB6
std::bad_alloc::bad_alloc.LIBCMT ref: 00007FF70A9F3CBF
_CxxThrowException.LIBVCRUNTIME ref: 00007FF70A9F3CCF

Strings

csm, xrefs: 00007FF70A9F38E6
csm, xrefs: 00007FF70A9F3960
csm, xrefs: 00007FF70A9F387F

Memory Dump Source

Source File: 0000000A.00000002.2345199746.00007FF70A9E1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF70A9E0000, based on PE: true

Associated: 0000000A.00000002.2345173222.00007FF70A9E0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2345236578.00007FF70AA34000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2345264921.00007FF70AA47000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2345286816.00007FF70AA4A000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff70a9e0000_tapinstall.jbxd

Similarity

API ID: FrameHandler3::Unwind$BlockException$CatchDestructExecutionFramesHandlerHelperIs_bad_exception_allowedMatchNestedObjectSearchStateThrowTypestd::bad_alloc::bad_alloc
String ID: csm$csm$csm
API String ID: 15165021-393685449
Opcode ID: 21b97b16db538992eb6a75333495f7bcb45038915a3eb3cb518b00d563e8fba0
Instruction ID: 2adb64581e8c8e311ebd8f35a3436854dde7b89f6648bf301e7671daa300a5da
Opcode Fuzzy Hash: 21b97b16db538992eb6a75333495f7bcb45038915a3eb3cb518b00d563e8fba0
Instruction Fuzzy Hash: 00E15A63A186428AFB60AB65D8403AEB7A0FF54798F540175EE9D8BB59CF3CE090C610

Function 00007FF70A9E6530 Relevance: 17.6, APIs: 6, Strings: 4, Instructions: 116COMMON

Download Yara Rule

APIs

CM_Get_Next_Res_Des_Ex.SETUPAPI ref: 00007FF70A9E6573
CM_Free_Res_Des_Handle.SETUPAPI ref: 00007FF70A9E658E
CM_Get_Res_Des_Data_Size_Ex.SETUPAPI ref: 00007FF70A9E65AA
CM_Get_Res_Des_Data_Ex.SETUPAPI ref: 00007FF70A9E65E8
CM_Get_Next_Res_Des_Ex.SETUPAPI ref: 00007FF70A9E66C0
CM_Free_Res_Des_Handle.SETUPAPI ref: 00007FF70A9E66DB

Strings

IRQ : %u, xrefs: 00007FF70A9E6620
IO : %04I64x-%04I64x, xrefs: 00007FF70A9E6661
DMA : %u, xrefs: 00007FF70A9E663B
MEM : %08I64x-%08I64x, xrefs: 00007FF70A9E6682

Memory Dump Source

Source File: 0000000A.00000002.2345199746.00007FF70A9E1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF70A9E0000, based on PE: true

Associated: 0000000A.00000002.2345173222.00007FF70A9E0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2345236578.00007FF70AA34000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2345264921.00007FF70AA47000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2345286816.00007FF70AA4A000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff70a9e0000_tapinstall.jbxd

Similarity

API ID: Des_Res_$Get_$Data_Free_HandleNext_$Size_
String ID: DMA : %u$IO : %04I64x-%04I64x$IRQ : %u$MEM : %08I64x-%08I64x
API String ID: 1110773400-3427375868
Opcode ID: 9e4a8363610eefb0b6cbcea2d3461c166d1163f148688767d300006fdf73812f
Instruction ID: 274dd9896ec5577596458e5c98aeca18b3fe0a22a116170e807977240c3a1fe0
Opcode Fuzzy Hash: 9e4a8363610eefb0b6cbcea2d3461c166d1163f148688767d300006fdf73812f
Instruction Fuzzy Hash: DE414F63B2C64282FB50EF15E954679A360FFA4B88F8440B5EA4D87796DF3CE845C720

Function 00007FF70A9E5920 Relevance: 16.6, APIs: 11, Instructions: 150COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF70A9E7030: SetupDiGetDeviceInstallParamsW.SETUPAPI ref: 00007FF70A9E7092
Part of subcall function 00007FF70A9E7030: SetupDiSetDeviceInstallParamsW.SETUPAPI ref: 00007FF70A9E70B3
Part of subcall function 00007FF70A9E7030: SetupDiBuildDriverInfoList.SETUPAPI ref: 00007FF70A9E70C8
Part of subcall function 00007FF70A9E7030: SetupDiEnumDriverInfoW.SETUPAPI ref: 00007FF70A9E70E9

SetupDiGetDriverInfoDetailW.SETUPAPI ref: 00007FF70A9E59DC
GetLastError.KERNEL32 ref: 00007FF70A9E59E6
SetupDiSetSelectedDriverW.SETUPAPI ref: 00007FF70A9E5A1E
SetupOpenFileQueue.SETUPAPI ref: 00007FF70A9E5A2C
SetupDiGetDeviceInstallParamsW.SETUPAPI ref: 00007FF70A9E5A64
SetupDiSetDeviceInstallParamsW.SETUPAPI ref: 00007FF70A9E5A87
SetupDiCallClassInstaller.SETUPAPI ref: 00007FF70A9E5AA0
SetupScanFileQueueW.SETUPAPI ref: 00007FF70A9E5AE5
SetupScanFileQueueW.SETUPAPI ref: 00007FF70A9E5B4D
SetupDiDestroyDriverInfoList.SETUPAPI ref: 00007FF70A9E5B6D
SetupCloseFileQueue.SETUPAPI ref: 00007FF70A9E5B7C

Part of subcall function 00007FF70A9E4770: FormatMessageW.KERNEL32(?,?,?,?,?,?,?,?,00000000,?,00007FF70A9E10DD), ref: 00007FF70A9E47B7
Part of subcall function 00007FF70A9E4770: LocalFree.KERNEL32(?,?,?,?,?,?,?,?,00000000,?,00007FF70A9E10DD), ref: 00007FF70A9E480B

Memory Dump Source

Source File: 0000000A.00000002.2345199746.00007FF70A9E1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF70A9E0000, based on PE: true

Associated: 0000000A.00000002.2345173222.00007FF70A9E0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2345236578.00007FF70AA34000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2345264921.00007FF70AA47000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2345286816.00007FF70AA4A000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff70a9e0000_tapinstall.jbxd

Similarity

API ID: Setup$Driver$DeviceFileInfoInstallParamsQueue$ListScan$BuildCallClassCloseDestroyDetailEnumErrorFormatFreeInstallerLastLocalMessageOpenSelected
String ID:
API String ID: 1606212837-0
Opcode ID: e12b59f62743ec06b6094670a4a11f57fde35331bb7a5217e71e5602add53916
Instruction ID: e0068f2f53c5351395a16c5d45d4b0cadafffae1e45b46e7b5ebf48452ada4eb
Opcode Fuzzy Hash: e12b59f62743ec06b6094670a4a11f57fde35331bb7a5217e71e5602add53916
Instruction Fuzzy Hash: 10619023B2C68246F720EF21EC506E9A3A4FF84B98F840275EA1D47AD6CF3DD5058720

Function 00007FF70A9E34B0 Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 83libraryloaderCOMMON

Download Yara Rule

APIs

GetFullPathNameW.KERNEL32 ref: 00007FF70A9E350F
LoadLibraryW.KERNEL32 ref: 00007FF70A9E3530
GetProcAddress.KERNEL32 ref: 00007FF70A9E354C
GetLastError.KERNEL32 ref: 00007FF70A9E3572
FreeLibrary.KERNEL32 ref: 00007FF70A9E35B5

Strings

setupapi.dll, xrefs: 00007FF70A9E3529
SetupUninstallOEMInfW, xrefs: 00007FF70A9E3542

Memory Dump Source

Source File: 0000000A.00000002.2345199746.00007FF70A9E1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF70A9E0000, based on PE: true

Associated: 0000000A.00000002.2345173222.00007FF70A9E0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2345236578.00007FF70AA34000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2345264921.00007FF70AA47000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2345286816.00007FF70AA4A000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff70a9e0000_tapinstall.jbxd

Similarity

API ID: Library$AddressErrorFreeFullLastLoadNamePathProc
String ID: SetupUninstallOEMInfW$setupapi.dll
API String ID: 3805412813-3713901415
Opcode ID: 07190c82b7a186e3b5898b35f52d877f32724abc198f9c48db99fcc8c26ec65d
Instruction ID: b3ae7e987d1da57157843cf2006eb56daaa8eb9cefc5f13ddd764b5172dded4d
Opcode Fuzzy Hash: 07190c82b7a186e3b5898b35f52d877f32724abc198f9c48db99fcc8c26ec65d
Instruction Fuzzy Hash: 64318227B1C68643FB60AB10EC5937AA291EF89749F800075D94E877D6CF3DE8458760

Function 00007FF70A9F3CDC Relevance: 14.3, APIs: 5, Strings: 3, Instructions: 317COMMONLIBRARYCODE

Download Yara Rule

APIs

Is_bad_exception_allowed.LIBVCRUNTIME ref: 00007FF70A9F3E8B
TypeMatchHelper.LIBVCRUNTIME ref: 00007FF70A9F3FE3
__DestructExceptionObject.LIBVCRUNTIME ref: 00007FF70A9F41C2
std::bad_alloc::bad_alloc.LIBCMT ref: 00007FF70A9F41CB
_CxxThrowException.LIBVCRUNTIME ref: 00007FF70A9F41DB

Strings

csm, xrefs: 00007FF70A9F3E34
csm, xrefs: 00007FF70A9F3EB2
csm, xrefs: 00007FF70A9F3DCD

Memory Dump Source

Source File: 0000000A.00000002.2345199746.00007FF70A9E1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF70A9E0000, based on PE: true

Associated: 0000000A.00000002.2345173222.00007FF70A9E0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2345236578.00007FF70AA34000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2345264921.00007FF70AA47000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2345286816.00007FF70AA4A000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff70a9e0000_tapinstall.jbxd

Similarity

API ID: Exception$DestructHelperIs_bad_exception_allowedMatchObjectThrowTypestd::bad_alloc::bad_alloc
String ID: csm$csm$csm
API String ID: 3999431683-393685449
Opcode ID: dd461791980e8857ea159d38e58e30428d4de1eaec1c9c9603251b4acd30a3b7
Instruction ID: 868e290798ea3221677c0e6e1b7ae50d62b03969d4f216c7cc622c66962b1774
Opcode Fuzzy Hash: dd461791980e8857ea159d38e58e30428d4de1eaec1c9c9603251b4acd30a3b7
Instruction Fuzzy Hash: 81E18E73B286828AFB10EF25D8803AEBBA0FF54748F544275DA9D87656CF38E585C710

Function 00007FF70A9E2540 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 139COMMON

Download Yara Rule

APIs

GetFullPathNameW.KERNEL32 ref: 00007FF70A9E25BE
SetupDiGetINFClassW.SETUPAPI ref: 00007FF70A9E2668
SetupDiCreateDeviceInfoList.SETUPAPI ref: 00007FF70A9E267D
SetupDiCreateDeviceInfoW.SETUPAPI ref: 00007FF70A9E26BF
SetupDiSetDeviceRegistryPropertyW.SETUPAPI ref: 00007FF70A9E270D
SetupDiCallClassInstaller.SETUPAPI ref: 00007FF70A9E2724
SetupDiDestroyDeviceInfoList.SETUPAPI ref: 00007FF70A9E2762

Strings

, xrefs: 00007FF70A9E2695

Memory Dump Source

Source File: 0000000A.00000002.2345199746.00007FF70A9E1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF70A9E0000, based on PE: true

Associated: 0000000A.00000002.2345173222.00007FF70A9E0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2345236578.00007FF70AA34000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2345264921.00007FF70AA47000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2345286816.00007FF70AA4A000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff70a9e0000_tapinstall.jbxd

Similarity

API ID: Setup$Device$Info$ClassCreateList$CallDestroyFullInstallerNamePathPropertyRegistry
String ID:
API String ID: 1846165353-3916222277
Opcode ID: cea8426861f3347b505c897b4f246ebb9bfdbc3591874b8a41b436473b598dc7
Instruction ID: 0dfa635338d20762443030f5865e7b92ea8f9636dbdbed6eadb7b36af8f3e978
Opcode Fuzzy Hash: cea8426861f3347b505c897b4f246ebb9bfdbc3591874b8a41b436473b598dc7
Instruction Fuzzy Hash: AE51CF63B18A8182FB20DB10E8007AAB3A5FF94B94F944232DA9D836D5DF7DE545CB10

Function 00007FF70A9F07B4 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 76COMMONLIBRARYCODE

Download Yara Rule

APIs

DName::DName.LIBVCRUNTIME ref: 00007FF70A9F07F9
UnDecorator::getSignedDimension.LIBVCRUNTIME ref: 00007FF70A9F0810
DName::DName.LIBVCRUNTIME ref: 00007FF70A9F0887

Part of subcall function 00007FF70A9EA83C: DName::doPchar.LIBVCRUNTIME ref: 00007FF70A9EA86E

DName::operator+.LIBVCRUNTIME ref: 00007FF70A9F0897

Part of subcall function 00007FF70A9EAD70: DName::operator+=.LIBVCRUNTIME ref: 00007FF70A9EAD8B

DName::operator+.LIBVCRUNTIME ref: 00007FF70A9F08AA

Part of subcall function 00007FF70A9EADF4: DName::operator+=.LIBCMT ref: 00007FF70A9EAE0F

Strings

`template-parameter, xrefs: 00007FF70A9F087C
void, xrefs: 00007FF70A9F07E8

Memory Dump Source

Source File: 0000000A.00000002.2345199746.00007FF70A9E1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF70A9E0000, based on PE: true

Associated: 0000000A.00000002.2345173222.00007FF70A9E0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2345236578.00007FF70AA34000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2345264921.00007FF70AA47000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2345286816.00007FF70AA4A000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff70a9e0000_tapinstall.jbxd

Similarity

API ID: NameName::Name::operator+Name::operator+=$Decorator::getDimensionName::doPcharSigned
String ID: `template-parameter$void
API String ID: 1951524168-4057429177
Opcode ID: 7a7c9e4356da7ebb837bbe34803b1ef7ec7b8755a3141d29af5874025b868cc2
Instruction ID: a57d804906ccbb360ade2d732f06f73ccced8d15ca4af7031dae41aac51ebe13
Opcode Fuzzy Hash: 7a7c9e4356da7ebb837bbe34803b1ef7ec7b8755a3141d29af5874025b868cc2
Instruction Fuzzy Hash: 9A314263F28A4289FB00EB54DC506B9A365BF58788FD40075D90D9BB96DF7CE405C360

Function 00007FF70A9ED948 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 102COMMONLIBRARYCODE

Download Yara Rule

APIs

DName::DName.LIBVCRUNTIME ref: 00007FF70A9ED9B5
DName::DName.LIBVCRUNTIME ref: 00007FF70A9ED9C4
DName::operator+.LIBVCRUNTIME ref: 00007FF70A9ED9D3
DName::DName.LIBVCRUNTIME ref: 00007FF70A9ED9E6

Part of subcall function 00007FF70A9EA960: DName::doPchar.LIBVCRUNTIME ref: 00007FF70A9EA9CD

DName::DName.LIBVCRUNTIME ref: 00007FF70A9EDA62
DName::DName.LIBVCRUNTIME ref: 00007FF70A9EDA70

Strings

`non-type-template-parameter, xrefs: 00007FF70A9ED97B

Memory Dump Source

Source File: 0000000A.00000002.2345199746.00007FF70A9E1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF70A9E0000, based on PE: true

Associated: 0000000A.00000002.2345173222.00007FF70A9E0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2345236578.00007FF70AA34000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2345264921.00007FF70AA47000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2345286816.00007FF70AA4A000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff70a9e0000_tapinstall.jbxd

Similarity

API ID: NameName::$Name::doName::operator+Pchar
String ID: `non-type-template-parameter
API String ID: 3026640183-4247534891
Opcode ID: 2045f689735eeea40cce7efe3b8163e352433e1db3c7d53e5d39b0a4b2283e44
Instruction ID: 6a21580e100bec6cd376efb556251c63181c9f0728281b0547010c1eb9ca3aef
Opcode Fuzzy Hash: 2045f689735eeea40cce7efe3b8163e352433e1db3c7d53e5d39b0a4b2283e44
Instruction Fuzzy Hash: A1419073B2D69299F700EB11DC801BCB3A4BF60B88FD040B5DA4D87A86DF28E925C310

Function 00007FF70A9E23C0 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 84libraryloaderCOMMON

Download Yara Rule

APIs

GetFullPathNameW.KERNEL32 ref: 00007FF70A9E242C
GetFileAttributesW.KERNEL32 ref: 00007FF70A9E2444
LoadLibraryW.KERNEL32 ref: 00007FF70A9E2462
GetProcAddress.KERNEL32 ref: 00007FF70A9E2486
FreeLibrary.KERNEL32 ref: 00007FF70A9E24F7

Part of subcall function 00007FF70A9E4770: FormatMessageW.KERNEL32(?,?,?,?,?,?,?,?,00000000,?,00007FF70A9E10DD), ref: 00007FF70A9E47B7
Part of subcall function 00007FF70A9E4770: LocalFree.KERNEL32(?,?,?,?,?,?,?,?,00000000,?,00007FF70A9E10DD), ref: 00007FF70A9E480B

Strings

newdev.dll, xrefs: 00007FF70A9E2453
UpdateDriverForPlugAndPlayDevicesW, xrefs: 00007FF70A9E2474

Memory Dump Source

Source File: 0000000A.00000002.2345199746.00007FF70A9E1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF70A9E0000, based on PE: true

Associated: 0000000A.00000002.2345173222.00007FF70A9E0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2345236578.00007FF70AA34000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2345264921.00007FF70AA47000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2345286816.00007FF70AA4A000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff70a9e0000_tapinstall.jbxd

Similarity

API ID: FreeLibrary$AddressAttributesFileFormatFullLoadLocalMessageNamePathProc
String ID: UpdateDriverForPlugAndPlayDevicesW$newdev.dll
API String ID: 3199543795-3767700378
Opcode ID: 04ab7d4148ff324d2fd50ef0ea174a2fd79d77ffbdc2d0a2a02e6489278d7139
Instruction ID: 1ae86bfa8b931cfdfefe15a6531643a520bd2ca2065aaf8325ed48bf66c68530
Opcode Fuzzy Hash: 04ab7d4148ff324d2fd50ef0ea174a2fd79d77ffbdc2d0a2a02e6489278d7139
Instruction Fuzzy Hash: 5F318527B1CA8286FB60EB10EC947A9A364FF98B44F844075DA4D43795DF3CD449C720

Function 00007FF70A9EC60C Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 51COMMONLIBRARYCODE

Download Yara Rule

APIs

DName::DName.LIBVCRUNTIME ref: 00007FF70A9EC631
UnDecorator::getScopedName.LIBVCRUNTIME ref: 00007FF70A9EC66C

Part of subcall function 00007FF70A9EFB2C: UnDecorator::getScope.LIBVCRUNTIME ref: 00007FF70A9EFB72
Part of subcall function 00007FF70A9EFB2C: DName::operator+.LIBVCRUNTIME ref: 00007FF70A9EFB86
Part of subcall function 00007FF70A9EFB2C: DName::operator+.LIBVCRUNTIME ref: 00007FF70A9EFB96

DName::operator+=.LIBVCRUNTIME ref: 00007FF70A9EC679

Part of subcall function 00007FF70A9EAE4C: DName::operator+=.LIBVCRUNTIME ref: 00007FF70A9EAE67

DName::operator+=.LIBCMT ref: 00007FF70A9EC6AE

Part of subcall function 00007FF70A9EAFA8: DName::operator=.LIBVCRUNTIME ref: 00007FF70A9EAFD3

Strings

void, xrefs: 00007FF70A9EC680

Memory Dump Source

Source File: 0000000A.00000002.2345199746.00007FF70A9E1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF70A9E0000, based on PE: true

Associated: 0000000A.00000002.2345173222.00007FF70A9E0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2345236578.00007FF70AA34000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2345264921.00007FF70AA47000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2345286816.00007FF70AA4A000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff70a9e0000_tapinstall.jbxd

Similarity

API ID: Name::operator+=$Decorator::getNameName::operator+$Name::Name::operator=ScopeScoped
String ID: void
API String ID: 3176039966-3531332078
Opcode ID: 9e892f4fd707f0d60684168cfb52e33d9422594bf1c05951a142ce3f47b87fe0
Instruction ID: 6efbc9faf641bb2a2a33d7d7f5b7f2500d2ce5d6fcb46cd5da196ab5ad5da4f8
Opcode Fuzzy Hash: 9e892f4fd707f0d60684168cfb52e33d9422594bf1c05951a142ce3f47b87fe0
Instruction Fuzzy Hash: AF116563F2C54285FF20EB14EC50279A360BFA8749FC45071E58D866A6DF2CE506C761

Function 00007FF70AA2EE2C Relevance: 10.8, APIs: 7, Instructions: 291COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF70AA2F262

Memory Dump Source

Source File: 0000000A.00000002.2345199746.00007FF70A9E1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF70A9E0000, based on PE: true

Associated: 0000000A.00000002.2345173222.00007FF70A9E0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2345236578.00007FF70AA34000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2345264921.00007FF70AA47000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2345286816.00007FF70AA4A000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff70a9e0000_tapinstall.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 3e9133d60d70ee4b184cf4df9feb1deb47fa9a1110e34a9b0a205f5e93016ed5
Instruction ID: 3e370a632bdda2346336b353d67e758681c727d2141328c8476d4750f8531f9a
Opcode Fuzzy Hash: 3e9133d60d70ee4b184cf4df9feb1deb47fa9a1110e34a9b0a205f5e93016ed5
Instruction Fuzzy Hash: D8C1E1A3A0C68655F660AB19DC40ABEBB60EF81B80FC44171DA4D177D5DF7DE8768320

Function 00007FF70A9E6700 Relevance: 10.7, APIs: 3, Strings: 3, Instructions: 156registryCOMMON

Download Yara Rule

APIs

SetupDiGetDeviceInfoListDetailW.SETUPAPI ref: 00007FF70A9E672F
SetupDiOpenClassRegKeyExW.SETUPAPI ref: 00007FF70A9E676F
RegCloseKey.ADVAPI32 ref: 00007FF70A9E690B

Part of subcall function 00007FF70A9E4C30: RegQueryValueExW.ADVAPI32 ref: 00007FF70A9E4C83
Part of subcall function 00007FF70A9E4C30: GetLastError.KERNEL32 ref: 00007FF70A9E4C94
Part of subcall function 00007FF70A9E4C30: RegQueryValueExW.ADVAPI32 ref: 00007FF70A9E4CF6

Part of subcall function 00007FF70A9E4770: FormatMessageW.KERNEL32(?,?,?,?,?,?,?,?,00000000,?,00007FF70A9E10DD), ref: 00007FF70A9E47B7
Part of subcall function 00007FF70A9E4770: LocalFree.KERNEL32(?,?,?,?,?,?,?,?,00000000,?,00007FF70A9E10DD), ref: 00007FF70A9E480B

Strings

%s, xrefs: 00007FF70A9E6873
LowerFilters, xrefs: 00007FF70A9E68B5
UpperFilters, xrefs: 00007FF70A9E677E

Memory Dump Source

Source File: 0000000A.00000002.2345199746.00007FF70A9E1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF70A9E0000, based on PE: true

Associated: 0000000A.00000002.2345173222.00007FF70A9E0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2345236578.00007FF70AA34000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2345264921.00007FF70AA47000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2345286816.00007FF70AA4A000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff70a9e0000_tapinstall.jbxd

Similarity

API ID: QuerySetupValue$ClassCloseDetailDeviceErrorFormatFreeInfoLastListLocalMessageOpen
String ID: %s$LowerFilters$UpperFilters
API String ID: 1933970874-1836264166
Opcode ID: 2c9d6f15fb4d5093753cc64694a3814026eec7a59d5bbe1ac40501dd433a88c3
Instruction ID: 3eea51961ee5424882076970f1349a61cb1e42723621017b6e64731b68c2bf37
Opcode Fuzzy Hash: 2c9d6f15fb4d5093753cc64694a3814026eec7a59d5bbe1ac40501dd433a88c3
Instruction Fuzzy Hash: 1C515113B2C28646FA54FB51EC153BA91819FA4B98FC441B4DA0D8B7C7DF6DE84142B1

Function 00007FF70A9E1160 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 152COMMON

Download Yara Rule

APIs

SetupDiBuildClassInfoListExW.SETUPAPI ref: 00007FF70A9E11D0
GetLastError.KERNEL32 ref: 00007FF70A9E11E0
SetupDiBuildClassInfoListExW.SETUPAPI ref: 00007FF70A9E1232
SetupDiClassNameFromGuidExW.SETUPAPI ref: 00007FF70A9E1294
SetupDiGetClassDescriptionExW.SETUPAPI ref: 00007FF70A9E1314

Strings

%-20s: %s, xrefs: 00007FF70A9E1380

Memory Dump Source

Source File: 0000000A.00000002.2345199746.00007FF70A9E1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF70A9E0000, based on PE: true

Associated: 0000000A.00000002.2345173222.00007FF70A9E0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2345236578.00007FF70AA34000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2345264921.00007FF70AA47000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2345286816.00007FF70AA4A000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff70a9e0000_tapinstall.jbxd

Similarity

API ID: ClassSetup$BuildInfoList$DescriptionErrorFromGuidLastName
String ID: %-20s: %s
API String ID: 3437477559-1251934994
Opcode ID: 8de683dbc796dd8caca86f2723ecdf9223d82be46d02b5834d92cca158fced3c
Instruction ID: f707ab29c1df8f1b2c92e4c0845b5c0f173b4e3793f1b86e693e0862dd7d4d00
Opcode Fuzzy Hash: 8de683dbc796dd8caca86f2723ecdf9223d82be46d02b5834d92cca158fced3c
Instruction Fuzzy Hash: A8517063B2C68286FA60EB10E8447AAB3A0FF94B88F945175DA8D87B85DF3CD505C710

Function 00007FF70A9EDD94 Relevance: 10.6, APIs: 7, Instructions: 134COMMONLIBRARYCODE

Download Yara Rule

APIs

DName::doPchar.LIBVCRUNTIME ref: 00007FF70A9EDE35
DName::DName.LIBVCRUNTIME ref: 00007FF70A9EDE40

Part of subcall function 00007FF70A9EA960: DName::doPchar.LIBVCRUNTIME ref: 00007FF70A9EA9CD

DName::operator+.LIBVCRUNTIME ref: 00007FF70A9EDE50

Part of subcall function 00007FF70A9EAD70: DName::operator+=.LIBVCRUNTIME ref: 00007FF70A9EAD8B

DName::operator+.LIBVCRUNTIME ref: 00007FF70A9EDE6D
DName::operator+.LIBVCRUNTIME ref: 00007FF70A9EDEA2

Part of subcall function 00007FF70A9EAD9C: DName::operator+=.LIBVCRUNTIME ref: 00007FF70A9EADB7

DName::operator+=.LIBVCRUNTIME ref: 00007FF70A9EDED5

Part of subcall function 00007FF70A9EB034: DName::append.LIBVCRUNTIME ref: 00007FF70A9EB078

DName::doPchar.LIBVCRUNTIME ref: 00007FF70A9EDF34

Memory Dump Source

Source File: 0000000A.00000002.2345199746.00007FF70A9E1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF70A9E0000, based on PE: true

Associated: 0000000A.00000002.2345173222.00007FF70A9E0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2345236578.00007FF70AA34000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2345264921.00007FF70AA47000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2345286816.00007FF70AA4A000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff70a9e0000_tapinstall.jbxd

Similarity

API ID: Name::doName::operator+Name::operator+=Pchar$NameName::Name::append
String ID:
API String ID: 3659116837-0
Opcode ID: 6aaf8ef8ab975a96cade839fcc4cba8efc94d6294a4ba3211e0c36a2a6d5e19c
Instruction ID: 0c30ad7b244ce209e700bbe8f31d7abfd724f7ce75a4f9232e5ed8fc510d4136
Opcode Fuzzy Hash: 6aaf8ef8ab975a96cade839fcc4cba8efc94d6294a4ba3211e0c36a2a6d5e19c
Instruction Fuzzy Hash: 24614B73B28A5289F711EF24EC807A8A7A1AF54748F948479EA0D837A6DF7DD445C310

Function 00007FF70AA0F964 Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 113COMMON

Download Yara Rule

APIs

_set_error_mode.LIBCMT ref: 00007FF70AA0F984
GetModuleFileNameW.KERNEL32 ref: 00007FF70AA0F9E5

Strings

<program name unknown>, xrefs: 00007FF70AA0F9F3
Runtime Error!Program: , xrefs: 00007FF70AA0F9B5
Microsoft Visual C++ Runtime Library, xrefs: 00007FF70AA0FA7A
..., xrefs: 00007FF70AA0FA3C

Memory Dump Source

Source File: 0000000A.00000002.2345199746.00007FF70A9E1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF70A9E0000, based on PE: true

Associated: 0000000A.00000002.2345173222.00007FF70A9E0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2345236578.00007FF70AA34000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2345264921.00007FF70AA47000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2345286816.00007FF70AA4A000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff70a9e0000_tapinstall.jbxd

Similarity

API ID: FileModuleName_set_error_mode
String ID: ...$<program name unknown>$Microsoft Visual C++ Runtime Library$Runtime Error!Program:
API String ID: 3581924421-4022980321
Opcode ID: 0d1e8a8cf0d7e4a4f35967af43162b7572eefee810724939d3ab0ebac19dc9a6
Instruction ID: 1252e5a7287734e115edacee0aa12bcba16aa7a82844c6c5d4f1fc84793a3a5e
Opcode Fuzzy Hash: 0d1e8a8cf0d7e4a4f35967af43162b7572eefee810724939d3ab0ebac19dc9a6
Instruction Fuzzy Hash: 9241E2A3B0864259FA64AB22EC00DBAE351AF84BD4FC04172EE1D977D1DF3CE1078220

Function 00007FF70A9E3A00 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 69COMMON

Download Yara Rule

APIs

SetupDiGetDeviceInfoListDetailW.SETUPAPI ref: 00007FF70A9E3A33
CM_Get_Device_ID_ExW.SETUPAPI ref: 00007FF70A9E3A5F
SetupDiSetClassInstallParamsW.SETUPAPI ref: 00007FF70A9E3AA1
SetupDiCallClassInstaller.SETUPAPI ref: 00007FF70A9E3AB6
SetupDiGetDeviceInstallParamsW.SETUPAPI ref: 00007FF70A9E3AD9

Strings

%-60s: %s, xrefs: 00007FF70A9E3B13

Memory Dump Source

Source File: 0000000A.00000002.2345199746.00007FF70A9E1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF70A9E0000, based on PE: true

Associated: 0000000A.00000002.2345173222.00007FF70A9E0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2345236578.00007FF70AA34000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2345264921.00007FF70AA47000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2345286816.00007FF70AA4A000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff70a9e0000_tapinstall.jbxd

Similarity

API ID: Setup$ClassDeviceInstallParams$CallDetailDevice_Get_InfoInstallerList
String ID: %-60s: %s
API String ID: 4184553637-3470069224
Opcode ID: c50b428a501a26c9097843eac2ab180f505a000ca60ac8a98767d06fd166e556
Instruction ID: 8a6fa0c1655196e69d86d2b0174ebe7aab842f11b96c929fce88f11a7934316f
Opcode Fuzzy Hash: c50b428a501a26c9097843eac2ab180f505a000ca60ac8a98767d06fd166e556
Instruction Fuzzy Hash: 6C315EB2B1C68292F760DF11E8447AAB760FF94B89F804075CA4E47A95CF3DD456CB10

Function 00007FF70A9E27B0 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 67libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32 ref: 00007FF70A9E27D6
GetProcAddress.KERNEL32 ref: 00007FF70A9E2813
FreeLibrary.KERNEL32 ref: 00007FF70A9E2824

Part of subcall function 00007FF70A9E23C0: GetFullPathNameW.KERNEL32 ref: 00007FF70A9E242C
Part of subcall function 00007FF70A9E23C0: GetFileAttributesW.KERNEL32 ref: 00007FF70A9E2444
Part of subcall function 00007FF70A9E23C0: LoadLibraryW.KERNEL32 ref: 00007FF70A9E2462
Part of subcall function 00007FF70A9E23C0: GetProcAddress.KERNEL32 ref: 00007FF70A9E2486
Part of subcall function 00007FF70A9E23C0: FreeLibrary.KERNEL32 ref: 00007FF70A9E24F7

Strings

setupapi.dll, xrefs: 00007FF70A9E27C9
SetupSetNonInteractiveMode, xrefs: 00007FF70A9E2804

Memory Dump Source

Source File: 0000000A.00000002.2345199746.00007FF70A9E1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF70A9E0000, based on PE: true

Associated: 0000000A.00000002.2345173222.00007FF70A9E0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2345236578.00007FF70AA34000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2345264921.00007FF70AA47000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2345286816.00007FF70AA4A000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff70a9e0000_tapinstall.jbxd

Similarity

API ID: Library$AddressFreeLoadProc$AttributesFileFullNamePath
String ID: SetupSetNonInteractiveMode$setupapi.dll
API String ID: 1784877336-1268865691
Opcode ID: 46b5fed04645d8eac7faa08d99b50c110e1da90dcc4f8194fdf02fdc9e3b2f99
Instruction ID: 86b843c814330d05780694bd20738ad6f3e58e28a8e6995e2f288908c5e6cc3b
Opcode Fuzzy Hash: 46b5fed04645d8eac7faa08d99b50c110e1da90dcc4f8194fdf02fdc9e3b2f99
Instruction Fuzzy Hash: 6D215A27B1CB8183EA10AB16F840869E390BF99FD5F801074EE8D47B65CF3CE0428B24

Function 00007FF70AA3071C Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48fileCOMMON

Download Yara Rule

APIs

WriteConsoleW.KERNEL32 ref: 00007FF70AA3074D
GetLastError.KERNEL32 ref: 00007FF70AA30759
CloseHandle.KERNEL32 ref: 00007FF70AA30771
CreateFileW.KERNEL32 ref: 00007FF70AA3079C
WriteConsoleW.KERNEL32 ref: 00007FF70AA307BB

Strings

CONOUT$, xrefs: 00007FF70AA3077D

Memory Dump Source

Source File: 0000000A.00000002.2345199746.00007FF70A9E1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF70A9E0000, based on PE: true

Associated: 0000000A.00000002.2345173222.00007FF70A9E0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2345236578.00007FF70AA34000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2345264921.00007FF70AA47000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2345286816.00007FF70AA4A000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff70a9e0000_tapinstall.jbxd

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast
String ID: CONOUT$
API String ID: 3230265001-3130406586
Opcode ID: b8a696af87e1db244be29ab8bf7f91a733210b6ee2ef81bc7abc92eec04a5109
Instruction ID: df61a683c827ac9a2aa4d98ddb724a0a8cf5896a2feaed604e8ca6a86538baf2
Opcode Fuzzy Hash: b8a696af87e1db244be29ab8bf7f91a733210b6ee2ef81bc7abc92eec04a5109
Instruction Fuzzy Hash: 73119A63B18B4186F350AB06FC44B29A3A4BF88BE5F800274EA1D87BD4CF7CD8558750

Function 00007FF70AA30584 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 41fileCOMMON

Download Yara Rule

APIs

WriteConsoleW.KERNEL32 ref: 00007FF70AA305A9
GetLastError.KERNEL32 ref: 00007FF70AA305B5
CloseHandle.KERNEL32 ref: 00007FF70AA305CD
CreateFileW.KERNEL32 ref: 00007FF70AA305F8
WriteConsoleW.KERNEL32 ref: 00007FF70AA30619

Strings

CONOUT$, xrefs: 00007FF70AA305D9

Memory Dump Source

Source File: 0000000A.00000002.2345199746.00007FF70A9E1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF70A9E0000, based on PE: true

Associated: 0000000A.00000002.2345173222.00007FF70A9E0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2345236578.00007FF70AA34000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2345264921.00007FF70AA47000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2345286816.00007FF70AA4A000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff70a9e0000_tapinstall.jbxd

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast
String ID: CONOUT$
API String ID: 3230265001-3130406586
Opcode ID: 7293e43c7665d0d01c90415b99719ea9fa37c371d7253cfd48f9f2110afdc670
Instruction ID: 273c1b84991a0891503f09e82ccb18ec45ef373ef91cc18993c5d16273e78a81
Opcode Fuzzy Hash: 7293e43c7665d0d01c90415b99719ea9fa37c371d7253cfd48f9f2110afdc670
Instruction Fuzzy Hash: F2115BA3A08B4282F7509B55F814B29A360FF88BA9F904274EA5D477D4CF7CD4568720

Function 00007FF70A9E3B40 Relevance: 9.0, APIs: 4, Strings: 1, Instructions: 255COMMON

Download Yara Rule

APIs

SetupDiGetDeviceInfoListDetailW.SETUPAPI ref: 00007FF70A9E3B8A
CM_Get_Device_ID_ExW.SETUPAPI ref: 00007FF70A9E3BB9
CM_Get_DevNode_Status_Ex.SETUPAPI ref: 00007FF70A9E3BE1
SetupDiSetDeviceRegistryPropertyW.SETUPAPI ref: 00007FF70A9E3E64

Part of subcall function 00007FF70A9E4770: FormatMessageW.KERNEL32(?,?,?,?,?,?,?,?,00000000,?,00007FF70A9E10DD), ref: 00007FF70A9E47B7
Part of subcall function 00007FF70A9E4770: LocalFree.KERNEL32(?,?,?,?,?,?,?,?,00000000,?,00007FF70A9E10DD), ref: 00007FF70A9E480B

Strings

%-60s: , xrefs: 00007FF70A9E3BFA, 00007FF70A9E3EDD

Memory Dump Source

Source File: 0000000A.00000002.2345199746.00007FF70A9E1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF70A9E0000, based on PE: true

Associated: 0000000A.00000002.2345173222.00007FF70A9E0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2345236578.00007FF70AA34000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2345264921.00007FF70AA47000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2345286816.00007FF70AA4A000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff70a9e0000_tapinstall.jbxd

Similarity

API ID: DeviceGet_Setup$DetailDevice_FormatFreeInfoListLocalMessageNode_PropertyRegistryStatus_
String ID: %-60s:
API String ID: 1934003045-769737362
Opcode ID: de8e9d4bb21c2a1e4e45b1568ffa61b4194d45a09024fb21d31a3d48b576b7e1
Instruction ID: 7dbdc751bd206dae298ea7e535ca91e0ea97cd8e48f4d4f3af7df7a0e290a1c8
Opcode Fuzzy Hash: de8e9d4bb21c2a1e4e45b1568ffa61b4194d45a09024fb21d31a3d48b576b7e1
Instruction Fuzzy Hash: 3FB18623B2CA4682FA20EB15E84067AB7A4FF64B88F844175DE5E8B796DF3CD4518710

Function 00007FF70A9F0034 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 121COMMONLIBRARYCODE

Download Yara Rule

APIs

Replicator::operator+=.LIBVCRUNTIME ref: 00007FF70A9F0179
DName::operator+=.LIBVCRUNTIME ref: 00007FF70A9F0197
DName::operator+=.LIBVCRUNTIME ref: 00007FF70A9F01A3
DName::operator+=.LIBCMT ref: 00007FF70A9F01B7

Strings

..., xrefs: 00007FF70A9F01AD

Memory Dump Source

Source File: 0000000A.00000002.2345199746.00007FF70A9E1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF70A9E0000, based on PE: true

Associated: 0000000A.00000002.2345173222.00007FF70A9E0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2345236578.00007FF70AA34000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2345264921.00007FF70AA47000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2345286816.00007FF70AA4A000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff70a9e0000_tapinstall.jbxd

Similarity

API ID: Name::operator+=$Replicator::operator+=
String ID: ...
API String ID: 3157425598-440645147
Opcode ID: 8b1ea6b13d80497599b74a4f17c7f641e17d439436ac87c9fc46a30647371513
Instruction ID: c4b4f5f378ebbb2f7e0ff073b5e7c11cace2c20860db1d85b968a5ce25548eb7
Opcode Fuzzy Hash: 8b1ea6b13d80497599b74a4f17c7f641e17d439436ac87c9fc46a30647371513
Instruction Fuzzy Hash: 9151B563F2C64784FB11EB25EC80379A7A4AF45784FD480B9D90D866A6EF7DD442C310

Function 00007FF70AA116E4 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 24libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32 ref: 00007FF70AA11700
GetProcAddress.KERNEL32 ref: 00007FF70AA11716
FreeLibrary.KERNEL32 ref: 00007FF70AA11733

Strings

mscoree.dll, xrefs: 00007FF70AA116F7
CorExitProcess, xrefs: 00007FF70AA1170F

Memory Dump Source

Source File: 0000000A.00000002.2345199746.00007FF70A9E1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF70A9E0000, based on PE: true

Associated: 0000000A.00000002.2345173222.00007FF70A9E0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2345236578.00007FF70AA34000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2345264921.00007FF70AA47000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2345286816.00007FF70AA4A000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff70a9e0000_tapinstall.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: 0ccf8903cf5fd9aeb41b039fa9f1cb800aac3f93f93f03788acfe0ad99044ca6
Instruction ID: e42391c624c3729c3dd1988967b1b418893339b0cf7a935f12b4416430f9ee70
Opcode Fuzzy Hash: 0ccf8903cf5fd9aeb41b039fa9f1cb800aac3f93f93f03788acfe0ad99044ca6
Instruction Fuzzy Hash: B8F054A3F1964292FF446B51FC80B7593A4EF48781F8410B9E54F456E4DF2CE48AC720

Function 00007FF70A9F30D0 Relevance: 7.8, APIs: 5, Instructions: 289COMMONLIBRARYCODE

Download Yara Rule

APIs

__AdjustPointer.LIBCMT ref: 00007FF70A9F31F3
__AdjustPointer.LIBCMT ref: 00007FF70A9F323E

Memory Dump Source

Source File: 0000000A.00000002.2345199746.00007FF70A9E1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF70A9E0000, based on PE: true

Associated: 0000000A.00000002.2345173222.00007FF70A9E0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2345236578.00007FF70AA34000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2345264921.00007FF70AA47000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2345286816.00007FF70AA4A000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff70a9e0000_tapinstall.jbxd

Similarity

API ID: AdjustPointer
String ID:
API String ID: 1740715915-0
Opcode ID: 92d83d9b34f83b521a09ba5b49f4fa4ff0e4aabc531c5689a04bfc7cad77936e
Instruction ID: 80ff2e613f4bed7ff7f05f115ffa07e3f8215613f71c2500c98665e0a8f572f8
Opcode Fuzzy Hash: 92d83d9b34f83b521a09ba5b49f4fa4ff0e4aabc531c5689a04bfc7cad77936e
Instruction Fuzzy Hash: 11B19323B2A64381FE65FB15D98467AE390AF44B84F8984B5DE6D8F785DF3CD4428320

Function 00007FF70AA32044 Relevance: 7.7, APIs: 5, Instructions: 158COMMON

Download Yara Rule

APIs

_set_statfp.LIBCMT ref: 00007FF70AA32080
_set_statfp.LIBCMT ref: 00007FF70AA3209E
_set_statfp.LIBCMT ref: 00007FF70AA320C7
_set_statfp.LIBCMT ref: 00007FF70AA32280

Memory Dump Source

Source File: 0000000A.00000002.2345199746.00007FF70A9E1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF70A9E0000, based on PE: true

Associated: 0000000A.00000002.2345173222.00007FF70A9E0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2345236578.00007FF70AA34000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2345264921.00007FF70AA47000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2345286816.00007FF70AA4A000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff70a9e0000_tapinstall.jbxd

Similarity

API ID: _set_statfp
String ID:
API String ID: 1156100317-0
Opcode ID: 2bc9a1a893ca783c65b1834ad9b2aafb0e365d30d060e1b3bfacd12602894cdc
Instruction ID: 0d11f29cd7b9379a726264bf40ccf868012a716835e3291cc01ead6dbae53f91
Opcode Fuzzy Hash: 2bc9a1a893ca783c65b1834ad9b2aafb0e365d30d060e1b3bfacd12602894cdc
Instruction Fuzzy Hash: 625109A3D0894645F662BA34DC40BFAD250BF61750F9486B4FF5E266D0DF3CA44B9610

Function 00007FF70A9E37D0 Relevance: 7.6, APIs: 5, Instructions: 82COMMON

Download Yara Rule

APIs

SetupDiSetClassInstallParamsW.SETUPAPI ref: 00007FF70A9E3834
SetupDiCallClassInstaller.SETUPAPI ref: 00007FF70A9E3849
SetupDiSetClassInstallParamsW.SETUPAPI ref: 00007FF70A9E3880
SetupDiCallClassInstaller.SETUPAPI ref: 00007FF70A9E3895
SetupDiGetDeviceInstallParamsW.SETUPAPI ref: 00007FF70A9E38B2

Part of subcall function 00007FF70A9E6B80: SetupDiGetDeviceInfoListDetailW.SETUPAPI ref: 00007FF70A9E6BB9
Part of subcall function 00007FF70A9E6B80: CM_Get_Device_ID_ExW.SETUPAPI ref: 00007FF70A9E6BE3

Memory Dump Source

Source File: 0000000A.00000002.2345199746.00007FF70A9E1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF70A9E0000, based on PE: true

Associated: 0000000A.00000002.2345173222.00007FF70A9E0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2345236578.00007FF70AA34000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2345264921.00007FF70AA47000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2345286816.00007FF70AA4A000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff70a9e0000_tapinstall.jbxd

Similarity

API ID: Setup$Class$InstallParams$CallDeviceInstaller$DetailDevice_Get_InfoList
String ID:
API String ID: 3081971210-0
Opcode ID: 695bbc71baaaec773e58d73fb442ecad0b1640a0d8d46f012f6265395287b3fe
Instruction ID: cfc1ee733f9bda04c09f6ede5eee94c548275a7005dc2b301f10ea226487f600
Opcode Fuzzy Hash: 695bbc71baaaec773e58d73fb442ecad0b1640a0d8d46f012f6265395287b3fe
Instruction Fuzzy Hash: 3E3150B3B1C28586F720EB12E9053BAA6A0FF59FC8F404175DA894BB85CF7CD5068B11

Function 00007FF70AA317D4 Relevance: 7.6, APIs: 5, Instructions: 56COMMONLIBRARYCODE

Download Yara Rule

APIs

_set_statfp.LIBCMT ref: 00007FF70AA317FC
_set_statfp.LIBCMT ref: 00007FF70AA31817
_set_statfp.LIBCMT ref: 00007FF70AA31833
_set_statfp.LIBCMT ref: 00007FF70AA3186F

Memory Dump Source

Source File: 0000000A.00000002.2345199746.00007FF70A9E1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF70A9E0000, based on PE: true

Associated: 0000000A.00000002.2345173222.00007FF70A9E0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2345236578.00007FF70AA34000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2345264921.00007FF70AA47000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2345286816.00007FF70AA4A000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff70a9e0000_tapinstall.jbxd

Similarity

API ID: _set_statfp
String ID:
API String ID: 1156100317-0
Opcode ID: e7b1107881e48292ca022c74fe2ec48e51bdb5760dfe1fdbb7d7208ffa06045a
Instruction ID: 107ae6dace0972e3d63fccf36b3c1bdfda1a19e5c3f2472f02208c7934a62980
Opcode Fuzzy Hash: e7b1107881e48292ca022c74fe2ec48e51bdb5760dfe1fdbb7d7208ffa06045a
Instruction Fuzzy Hash: BB1154E3E18A1306FA543564EC46B75D180AF65378FD807B4F97E066D78F9CA8438229

Function 00007FF70A9F43FC Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 195COMMONLIBRARYCODE

Download Yara Rule

APIs

EncodePointer.KERNEL32 ref: 00007FF70A9F4467
_CallSETranslator.LIBVCRUNTIME ref: 00007FF70A9F44AB

Strings

RCC, xrefs: 00007FF70A9F4483
MOC, xrefs: 00007FF70A9F447B

Memory Dump Source

Source File: 0000000A.00000002.2345199746.00007FF70A9E1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF70A9E0000, based on PE: true

Associated: 0000000A.00000002.2345173222.00007FF70A9E0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2345236578.00007FF70AA34000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2345264921.00007FF70AA47000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2345286816.00007FF70AA4A000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff70a9e0000_tapinstall.jbxd

Similarity

API ID: CallEncodePointerTranslator
String ID: MOC$RCC
API String ID: 3544855599-2084237596
Opcode ID: f803d8c648c2122474ce86b0b39a3cc156ebe4fa619f756f266b7816edd56d32
Instruction ID: fc6839d786fb23ff4dbbbe5123856d127a8b2ac7bdecbf177d22bc48d90cd596
Opcode Fuzzy Hash: f803d8c648c2122474ce86b0b39a3cc156ebe4fa619f756f266b7816edd56d32
Instruction Fuzzy Hash: 4491B173B187828AFB10EB65EC402AEB7A0FB44788F504139EA4D97755DF38E191CB10

Function 00007FF70AA00EDC Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 191COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF70AA00F18
_invalid_parameter_noinfo.LIBCMT ref: 00007FF70AA0116B

Strings

, xrefs: 00007FF70AA00F2B
*, xrefs: 00007FF70AA01093

Memory Dump Source

Source File: 0000000A.00000002.2345199746.00007FF70A9E1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF70A9E0000, based on PE: true

Associated: 0000000A.00000002.2345173222.00007FF70A9E0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2345236578.00007FF70AA34000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2345264921.00007FF70AA47000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2345286816.00007FF70AA4A000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff70a9e0000_tapinstall.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: $*
API String ID: 3215553584-3982473090
Opcode ID: ebf6addb0422a3df8c88c69004cf465780081765257e989b9b1ed44549212502
Instruction ID: 1e7863f24f5854b6f6709ebdbf39da47a0305c550e3a4fa5bd1ee67dff800cc3
Opcode Fuzzy Hash: ebf6addb0422a3df8c88c69004cf465780081765257e989b9b1ed44549212502
Instruction Fuzzy Hash: BD8161F394824286F7A8AF35C844DB8B6A0EF15B44F9402B9DA89C62D5DF39E543C731

Function 00007FF70AA00734 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 191COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF70AA00770
_invalid_parameter_noinfo.LIBCMT ref: 00007FF70AA009C3

Strings

, xrefs: 00007FF70AA00783
*, xrefs: 00007FF70AA008EB

Memory Dump Source

Source File: 0000000A.00000002.2345199746.00007FF70A9E1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF70A9E0000, based on PE: true

Associated: 0000000A.00000002.2345173222.00007FF70A9E0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2345236578.00007FF70AA34000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2345264921.00007FF70AA47000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2345286816.00007FF70AA4A000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff70a9e0000_tapinstall.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: $*
API String ID: 3215553584-3982473090
Opcode ID: e60271a038c53331095bc1501989483a53fb311e552cdae94f782dd2e6294a65
Instruction ID: 750131cee3c875baaf770b6e58f5767cddfd3f8ec7f92dfa5c0a02a09d9f8432
Opcode Fuzzy Hash: e60271a038c53331095bc1501989483a53fb311e552cdae94f782dd2e6294a65
Instruction Fuzzy Hash: D48151B380824285F764AF35C854E79F6A0EF05B84F9441B6CA89C62C5DF3AE887C765

Function 00007FF70A9FF940 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 191COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF70A9FF977
_invalid_parameter_noinfo.LIBCMT ref: 00007FF70A9FF9B1

Strings

*, xrefs: 00007FF70A9FFB19
, xrefs: 00007FF70A9FFB83

Memory Dump Source

Source File: 0000000A.00000002.2345199746.00007FF70A9E1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF70A9E0000, based on PE: true

Associated: 0000000A.00000002.2345173222.00007FF70A9E0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2345236578.00007FF70AA34000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2345264921.00007FF70AA47000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2345286816.00007FF70AA4A000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff70a9e0000_tapinstall.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: $*
API String ID: 3215553584-3982473090
Opcode ID: 696b434c9b65d82e3cb3a69da655823cedb2bb2a6dca5773e12b0c135f28c375
Instruction ID: 3a930dc21976ce79d1c9017fc5c087b690ea896c498818243309c8d11074ac0a
Opcode Fuzzy Hash: 696b434c9b65d82e3cb3a69da655823cedb2bb2a6dca5773e12b0c135f28c375
Instruction Fuzzy Hash: 83818373A1C24386FB64AF25C854178BBA0EF05B59F9401B6CA8DC6299DF3DE481C725

Function 00007FF70AA00018 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 187COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF70AA00056
_invalid_parameter_noinfo.LIBCMT ref: 00007FF70AA00288

Strings

*, xrefs: 00007FF70AA001C0
, xrefs: 00007FF70AA0022A

Memory Dump Source

Source File: 0000000A.00000002.2345199746.00007FF70A9E1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF70A9E0000, based on PE: true

Associated: 0000000A.00000002.2345173222.00007FF70A9E0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2345236578.00007FF70AA34000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2345264921.00007FF70AA47000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2345286816.00007FF70AA4A000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff70a9e0000_tapinstall.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: $*
API String ID: 3215553584-3982473090
Opcode ID: 4b0bb82413f354565f6b76abb1ea6af1657192eeb5dcd769b60e7d6808cf1343
Instruction ID: 06f1ad0a19d9187880b97890ca6384731b1f06a629a8c28297e3139586965221
Opcode Fuzzy Hash: 4b0bb82413f354565f6b76abb1ea6af1657192eeb5dcd769b60e7d6808cf1343
Instruction Fuzzy Hash: B98131B384C2428AFBA4AE35D844E78BBA0EF59B44F9401B5CB49C62C5DF39E447C725

Function 00007FF70AA1C164 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 180COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF70AA1C1A7

Strings

e+000, xrefs: 00007FF70AA1C24C
gfff, xrefs: 00007FF70AA1C2C9
-, xrefs: 00007FF70AA1C382

Memory Dump Source

Source File: 0000000A.00000002.2345199746.00007FF70A9E1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF70A9E0000, based on PE: true

Associated: 0000000A.00000002.2345173222.00007FF70A9E0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2345236578.00007FF70AA34000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2345264921.00007FF70AA47000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2345286816.00007FF70AA4A000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff70a9e0000_tapinstall.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: -$e+000$gfff
API String ID: 3215553584-2620144452
Opcode ID: 0074e114a49e6fc809f4dcc0a04a1e80794e2a9b4d8ec782b6f912fc4b48aee0
Instruction ID: 39ca597acc931846632981a2c4056885061f3aa51532d0104bbf7befed6cc827
Opcode Fuzzy Hash: 0074e114a49e6fc809f4dcc0a04a1e80794e2a9b4d8ec782b6f912fc4b48aee0
Instruction Fuzzy Hash: B371C4A3B187C196F7209F25E94076AE791EB44BE0F889271DA9C87BD9DF2CD441C710

Function 00007FF70A9FF718 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 156COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF70A9FF928

Part of subcall function 00007FF70AA0D4EC: _invalid_parameter_noinfo.LIBCMT ref: 00007FF70AA0D576

_invalid_parameter_noinfo.LIBCMT ref: 00007FF70A9FF75C

Strings

*, xrefs: 00007FF70A9FF85E
, xrefs: 00007FF70A9FF8B3

Memory Dump Source

Source File: 0000000A.00000002.2345199746.00007FF70A9E1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF70A9E0000, based on PE: true

Associated: 0000000A.00000002.2345173222.00007FF70A9E0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2345236578.00007FF70AA34000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2345264921.00007FF70AA47000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2345286816.00007FF70AA4A000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff70a9e0000_tapinstall.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: $*
API String ID: 3215553584-3982473090
Opcode ID: 26b87493f0452009ca218a176671395cca8a3695ea8e3c936177f10e7989a2f7
Instruction ID: 38933933185b0ad1b7c50ba6b4d187cb9c117a32f622bcc7594e7ecaa420a257
Opcode Fuzzy Hash: 26b87493f0452009ca218a176671395cca8a3695ea8e3c936177f10e7989a2f7
Instruction Fuzzy Hash: F1615473A2C25386F768AF38C85437CB7A0EF05B19F9411BAC64F862D9CF29D485D621

Function 00007FF70A9FFBE8 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 151COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF70A9FFC14
_invalid_parameter_noinfo.LIBCMT ref: 00007FF70A9FFC46

Strings

, xrefs: 00007FF70A9FFD99
*, xrefs: 00007FF70A9FFD44

Memory Dump Source

Source File: 0000000A.00000002.2345199746.00007FF70A9E1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF70A9E0000, based on PE: true

Associated: 0000000A.00000002.2345173222.00007FF70A9E0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2345236578.00007FF70AA34000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2345264921.00007FF70AA47000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2345286816.00007FF70AA4A000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff70a9e0000_tapinstall.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: $*
API String ID: 3215553584-3982473090
Opcode ID: 48a48ff5bc0ae375988f414688e987a49450b8b663d7d16d07c4109e67f0f616
Instruction ID: ca1dca65d3160b4b37824cb6849ee19e61a5703ad468ef8bbdf81a805179b398
Opcode Fuzzy Hash: 48a48ff5bc0ae375988f414688e987a49450b8b663d7d16d07c4109e67f0f616
Instruction Fuzzy Hash: AA617173A2D21386F765AE34C85437CB7E0EF15B18F9411B6DA4AC22D9CF29E481C620

Function 00007FF70AA002B0 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 147COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF70AA002E5
_invalid_parameter_noinfo.LIBCMT ref: 00007FF70AA004B1

Strings

, xrefs: 00007FF70AA0043A
*, xrefs: 00007FF70AA003E5

Memory Dump Source

Source File: 0000000A.00000002.2345199746.00007FF70A9E1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF70A9E0000, based on PE: true

Associated: 0000000A.00000002.2345173222.00007FF70A9E0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2345236578.00007FF70AA34000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2345264921.00007FF70AA47000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2345286816.00007FF70AA4A000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff70a9e0000_tapinstall.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: $*
API String ID: 3215553584-3982473090
Opcode ID: f977a82e5c76788af1767a775f5033a8640c51099ef2c99c72258bbf43d06a9c
Instruction ID: 42ef2489cbc6e84a52f4764ef53951fa3dba302f62365a82b5bf20f129179e3d
Opcode Fuzzy Hash: f977a82e5c76788af1767a775f5033a8640c51099ef2c99c72258bbf43d06a9c
Instruction Fuzzy Hash: BB6180B390C6028AF765AE38C844F7CB7A0EF05B09F9411B5C64AC22D5DF3EE582C665

Function 00007FF70A9F41E8 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 142COMMONLIBRARYCODE

Download Yara Rule

APIs

EncodePointer.KERNEL32 ref: 00007FF70A9F423B
_CallSETranslator.LIBVCRUNTIME ref: 00007FF70A9F4280

Strings

MOC, xrefs: 00007FF70A9F424F
RCC, xrefs: 00007FF70A9F4258

Memory Dump Source

Source File: 0000000A.00000002.2345199746.00007FF70A9E1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF70A9E0000, based on PE: true

Associated: 0000000A.00000002.2345173222.00007FF70A9E0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2345236578.00007FF70AA34000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2345264921.00007FF70AA47000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2345286816.00007FF70AA4A000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff70a9e0000_tapinstall.jbxd

Similarity

API ID: CallEncodePointerTranslator
String ID: MOC$RCC
API String ID: 3544855599-2084237596
Opcode ID: 1468b56452d10623d81cdb1e1ed026f28ff39d5af83e5faff62cb6f8af0a23b1
Instruction ID: 6450c81dfbd85281cf88cbe4a31f4726dbaa32c59ff19bb3821eb1695a302c72
Opcode Fuzzy Hash: 1468b56452d10623d81cdb1e1ed026f28ff39d5af83e5faff62cb6f8af0a23b1
Instruction Fuzzy Hash: 6C514A33A28A4686FB10EF65D9803ADB7A0FB84B88F444265EF4D53B59DF78E055C710

Function 00007FF70A9F54F0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 114COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00007FF70A9F5596
_CreateFrameInfo.LIBVCRUNTIME ref: 00007FF70A9F55C2
__DestructExceptionObject.LIBVCRUNTIME ref: 00007FF70A9F56E1

Strings

csm, xrefs: 00007FF70A9F56B4

Memory Dump Source

Source File: 0000000A.00000002.2345199746.00007FF70A9E1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF70A9E0000, based on PE: true

Associated: 0000000A.00000002.2345173222.00007FF70A9E0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2345236578.00007FF70AA34000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2345264921.00007FF70AA47000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2345286816.00007FF70AA4A000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff70a9e0000_tapinstall.jbxd

Similarity

API ID: CreateDestructExceptionFrameInfoObject__except_validate_context_record
String ID: csm
API String ID: 146877497-1018135373
Opcode ID: a3fecbfbc24f64bd75b4b319e201772004d7a2b71ee4399e5099f2da34a284b3
Instruction ID: 34722bfc796799b11a2701599c5cb4552b5d132e1f243732846d9a1b1ef98e38
Opcode Fuzzy Hash: a3fecbfbc24f64bd75b4b319e201772004d7a2b71ee4399e5099f2da34a284b3
Instruction Fuzzy Hash: A5516E73A1878286E660EB15E84036EF7A0FB88794F440675EB8D87B56DF38E490CB10

Function 00007FF70A9E4C30 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 74registryCOMMON

Download Yara Rule

APIs

RegQueryValueExW.ADVAPI32 ref: 00007FF70A9E4C83
GetLastError.KERNEL32 ref: 00007FF70A9E4C94
RegQueryValueExW.ADVAPI32 ref: 00007FF70A9E4CF6

Strings

LowerFilters, xrefs: 00007FF70A9E4C3B

Memory Dump Source

Source File: 0000000A.00000002.2345199746.00007FF70A9E1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF70A9E0000, based on PE: true

Associated: 0000000A.00000002.2345173222.00007FF70A9E0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2345236578.00007FF70AA34000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2345264921.00007FF70AA47000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2345286816.00007FF70AA4A000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff70a9e0000_tapinstall.jbxd

Similarity

API ID: QueryValue$ErrorLast
String ID: LowerFilters
API String ID: 181557691-1260524392
Opcode ID: 7cfd38d4b9c6a9580be2e36a9189f51fd8cc7de6ed91d8435a286111ac9b45e5
Instruction ID: 1c4a97608f90994b1b88bfd07cda1691e53de681b05d42cfd868e9d5ab460712
Opcode Fuzzy Hash: 7cfd38d4b9c6a9580be2e36a9189f51fd8cc7de6ed91d8435a286111ac9b45e5
Instruction Fuzzy Hash: 9521A023B1CB4586FA10EB11E85026EE391EF99B98F840275EA4D83BD6EF3CE441C710

Function 00007FF70A9E56D0 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 69COMMON

Download Yara Rule

APIs

SetupDiGetDeviceInfoListDetailW.SETUPAPI ref: 00007FF70A9E5714
CM_Get_Device_ID_ExW.SETUPAPI ref: 00007FF70A9E573E

Strings

%-60s: %s, xrefs: 00007FF70A9E57A3
%s, xrefs: 00007FF70A9E57B9

Memory Dump Source

Source File: 0000000A.00000002.2345199746.00007FF70A9E1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF70A9E0000, based on PE: true

Associated: 0000000A.00000002.2345173222.00007FF70A9E0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2345236578.00007FF70AA34000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2345264921.00007FF70AA47000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2345286816.00007FF70AA4A000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff70a9e0000_tapinstall.jbxd

Similarity

API ID: DetailDeviceDevice_Get_InfoListSetup
String ID: %-60s: %s$%s
API String ID: 3680031113-1339393084
Opcode ID: a51e5089ce0a16c6d52d016b188cefe7c1f7e6d2c4a6f8978211d45e4c582602
Instruction ID: 98746c05516f0f7dbf90fb2d6e2b4dd778a6226f884fb353fd11d40299557caa
Opcode Fuzzy Hash: a51e5089ce0a16c6d52d016b188cefe7c1f7e6d2c4a6f8978211d45e4c582602
Instruction Fuzzy Hash: D921C863B1C54292FB20EF15EC507BAA3A0EF94B88FC54071DA4D87A96DF2CD506C760

Function 00007FF70A9E6B80 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 65COMMON

Download Yara Rule

APIs

SetupDiGetDeviceInfoListDetailW.SETUPAPI ref: 00007FF70A9E6BB9
CM_Get_Device_ID_ExW.SETUPAPI ref: 00007FF70A9E6BE3

Strings

%-60s: %s, xrefs: 00007FF70A9E6C51
%s, xrefs: 00007FF70A9E6C5F

Memory Dump Source

Source File: 0000000A.00000002.2345199746.00007FF70A9E1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF70A9E0000, based on PE: true

Associated: 0000000A.00000002.2345173222.00007FF70A9E0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2345236578.00007FF70AA34000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2345264921.00007FF70AA47000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2345286816.00007FF70AA4A000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff70a9e0000_tapinstall.jbxd

Similarity

API ID: DetailDeviceDevice_Get_InfoListSetup
String ID: %-60s: %s$%s
API String ID: 3680031113-1339393084
Opcode ID: c99e091277bb5b53b775382925c4bb54c33a56cc676f35083c55ea4e68d6ed99
Instruction ID: 7a1c714d7567d36c9a49f9fa400725a9e003038991b5aea4de2d3cf50e210ef8
Opcode Fuzzy Hash: c99e091277bb5b53b775382925c4bb54c33a56cc676f35083c55ea4e68d6ed99
Instruction Fuzzy Hash: CA218173B1CA8296FA20EF15E8507BAB360EFA8788F844175DB4D47A95DF2CD506C720

Function 00007FF70A9F562B Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 65COMMON

Download Yara Rule

APIs

__DestructExceptionObject.LIBVCRUNTIME ref: 00007FF70A9F5662
RaiseException.KERNEL32 ref: 00007FF70A9F5688
__DestructExceptionObject.LIBVCRUNTIME ref: 00007FF70A9F56E1

Strings

csm, xrefs: 00007FF70A9F56B4

Memory Dump Source

Source File: 0000000A.00000002.2345199746.00007FF70A9E1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF70A9E0000, based on PE: true

Associated: 0000000A.00000002.2345173222.00007FF70A9E0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2345236578.00007FF70AA34000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2345264921.00007FF70AA47000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2345286816.00007FF70AA4A000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff70a9e0000_tapinstall.jbxd

Similarity

API ID: Exception$DestructObject$Raise
String ID: csm
API String ID: 2826525264-1018135373
Opcode ID: c65463ea9101793cc31d4246695a90cc3882a240b8c6c27d7b38a8955c006e5e
Instruction ID: 128d353ccc0fc9798c8b0b4301f731183c831d4cdf6e870ec515f0d985b06df5
Opcode Fuzzy Hash: c65463ea9101793cc31d4246695a90cc3882a240b8c6c27d7b38a8955c006e5e
Instruction Fuzzy Hash: 68313A77B1824287F630EF11E84026EB760EF94B94F854675DA8A477A6CF3CE885CB10

Function 00007FF70A9F53FA Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 63COMMON

Download Yara Rule

APIs

__DestructExceptionObject.LIBVCRUNTIME ref: 00007FF70A9F5422
RaiseException.KERNEL32 ref: 00007FF70A9F544B
__DestructExceptionObject.LIBVCRUNTIME ref: 00007FF70A9F54AC

Strings

csm, xrefs: 00007FF70A9F547F

Memory Dump Source

Source File: 0000000A.00000002.2345199746.00007FF70A9E1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF70A9E0000, based on PE: true

Associated: 0000000A.00000002.2345173222.00007FF70A9E0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2345236578.00007FF70AA34000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2345264921.00007FF70AA47000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2345286816.00007FF70AA4A000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff70a9e0000_tapinstall.jbxd

Similarity

API ID: Exception$DestructObject$Raise
String ID: csm
API String ID: 2826525264-1018135373
Opcode ID: cc8eb6da96c197ed980eb35cf3cd2df0145045b221062dc3d4578f740a01ffa4
Instruction ID: a8fc352593bc068a4bb32f04084bef2522746191c000c3863a637a0155772f74
Opcode Fuzzy Hash: cc8eb6da96c197ed980eb35cf3cd2df0145045b221062dc3d4578f740a01ffa4
Instruction Fuzzy Hash: 1C214B7761864286E730EF15E44026EB760FB88BA5F850261DE9D47795CF3CE886CB11

Function 00007FF70AA194F4 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 50COMMON

Download Yara Rule

APIs

try_get_function.LIBVCRUNTIME ref: 00007FF70AA19527
try_get_function.LIBVCRUNTIME ref: 00007FF70AA1954E

Part of subcall function 00007FF70AA181A8: GetProcAddress.KERNEL32(?,?,00000006,00007FF70AA18A2A,?,?,00000000,00007FF70AA177AE,?,?,00000000,00007FF70AA16B85), ref: 00007FF70AA18300

Strings

GetProcessWindowStation, xrefs: 00007FF70AA1950D, 00007FF70AA19520
GetUserObjectInformationW, xrefs: 00007FF70AA19534, 00007FF70AA19547

Memory Dump Source

Source File: 0000000A.00000002.2345199746.00007FF70A9E1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF70A9E0000, based on PE: true

Associated: 0000000A.00000002.2345173222.00007FF70A9E0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2345236578.00007FF70AA34000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2345264921.00007FF70AA47000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2345286816.00007FF70AA4A000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff70a9e0000_tapinstall.jbxd

Similarity

API ID: try_get_function$AddressProc
String ID: GetProcessWindowStation$GetUserObjectInformationW
API String ID: 1640347226-2732317663
Opcode ID: 6f5883c30fa4d970a6b2ca5bc24385a593e52fa01d7559c029fb7798c3f6cd56
Instruction ID: ccb338f09547b7eb871c7ff66fc6fea934d5cbbbcdcbf21ccd953964e83f629b
Opcode Fuzzy Hash: 6f5883c30fa4d970a6b2ca5bc24385a593e52fa01d7559c029fb7798c3f6cd56
Instruction Fuzzy Hash: 171151A3A1874692FA41EB14EC509B6A3A1AF49754FC8017AE94D077D4DF3CE44AC760

Function 00007FF70AA190A0 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 49COMMON

Download Yara Rule

APIs

try_get_function.LIBVCRUNTIME ref: 00007FF70AA190DA
try_get_function.LIBVCRUNTIME ref: 00007FF70AA19136

Strings

MessageBoxW, xrefs: 00007FF70AA190BD, 00007FF70AA190CE
RoInitialize, xrefs: 00007FF70AA1911C, 00007FF70AA1912F

Memory Dump Source

Source File: 0000000A.00000002.2345199746.00007FF70A9E1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF70A9E0000, based on PE: true

Associated: 0000000A.00000002.2345173222.00007FF70A9E0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2345236578.00007FF70AA34000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2345264921.00007FF70AA47000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2345286816.00007FF70AA4A000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff70a9e0000_tapinstall.jbxd

Similarity

API ID: try_get_function
String ID: MessageBoxW$RoInitialize
API String ID: 2742660187-1810702038
Opcode ID: dd70e31a59fc5cbf4f5a0b82821224db7ed2afd1b9f1bcf175a30592a1cc4cdc
Instruction ID: e1e45e4795bb3af27b238180f375d9897ccf4d8cb3cceb7b58a4825e846c2a64
Opcode Fuzzy Hash: dd70e31a59fc5cbf4f5a0b82821224db7ed2afd1b9f1bcf175a30592a1cc4cdc
Instruction Fuzzy Hash: 061151E7E0864696FA45AB51FC408B5A310EF487D0F880476EE1C0BBD5CF3CE5968720

Function 00007FF70AA19188 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 38COMMON

Download Yara Rule

APIs

try_get_function.LIBVCRUNTIME ref: 00007FF70AA191B1
try_get_function.LIBVCRUNTIME ref: 00007FF70AA191FB

Strings

SystemFunction036, xrefs: 00007FF70AA19194, 00007FF70AA1919E
SetThreadStackGuarantee, xrefs: 00007FF70AA191E1, 00007FF70AA191F4

Memory Dump Source

Source File: 0000000A.00000002.2345199746.00007FF70A9E1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF70A9E0000, based on PE: true

Associated: 0000000A.00000002.2345173222.00007FF70A9E0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2345236578.00007FF70AA34000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2345264921.00007FF70AA47000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2345286816.00007FF70AA4A000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff70a9e0000_tapinstall.jbxd

Similarity

API ID: try_get_function
String ID: SetThreadStackGuarantee$SystemFunction036
API String ID: 2742660187-2910880125
Opcode ID: 82353169a2ab33f6a6eac203720c7793f9c27a950768576486ffb45298bb144f
Instruction ID: dc6ddcf12fe39d8fffb36e59e73db73f182cb8ddd30d196082bf26ebe115285b
Opcode Fuzzy Hash: 82353169a2ab33f6a6eac203720c7793f9c27a950768576486ffb45298bb144f
Instruction Fuzzy Hash: E8012CD3E18646A2FB09AB91EC408B0A351EF48740FD80072EE1C0A7D1DF7CE996C320

Function 00007FF70AA19448 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 30COMMON

Download Yara Rule

APIs

try_get_function.LIBVCRUNTIME ref: 00007FF70AA19468
try_get_function.LIBVCRUNTIME ref: 00007FF70AA1949A

Part of subcall function 00007FF70AA181A8: GetProcAddress.KERNEL32(?,?,00000006,00007FF70AA18A2A,?,?,00000000,00007FF70AA177AE,?,?,00000000,00007FF70AA16B85), ref: 00007FF70AA18300

Strings

GetLastActivePopup, xrefs: 00007FF70AA19480, 00007FF70AA19493
GetActiveWindow, xrefs: 00007FF70AA1944E, 00007FF70AA19461

Memory Dump Source

Source File: 0000000A.00000002.2345199746.00007FF70A9E1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF70A9E0000, based on PE: true

Associated: 0000000A.00000002.2345173222.00007FF70A9E0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2345236578.00007FF70AA34000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2345264921.00007FF70AA47000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2345286816.00007FF70AA4A000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff70a9e0000_tapinstall.jbxd

Similarity

API ID: try_get_function$AddressProc
String ID: GetActiveWindow$GetLastActivePopup
API String ID: 1640347226-3742175580
Opcode ID: 96139b02f01ac1a12e8e8bbed336b4c2bf4c2c17f5e7323450708969746c16ee
Instruction ID: 79d0726081a2e341c7c22870a8649aa2253b39ce2061b2c6673acabd8b14869f
Opcode Fuzzy Hash: 96139b02f01ac1a12e8e8bbed336b4c2bf4c2c17f5e7323450708969746c16ee
Instruction Fuzzy Hash: 29F0B6D7E09746A1FA14EB91DC609B092A09F08351FC804B6D90E0A3E0DF2CA587C270

Function 00007FF70AA1921C Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 28COMMON

Download Yara Rule

APIs

try_get_function.LIBVCRUNTIME ref: 00007FF70AA1924C
try_get_function.LIBVCRUNTIME ref: 00007FF70AA1926E

Part of subcall function 00007FF70AA181A8: GetProcAddress.KERNEL32(?,?,00000006,00007FF70AA18A2A,?,?,00000000,00007FF70AA177AE,?,?,00000000,00007FF70AA16B85), ref: 00007FF70AA18300

Strings

MessageBoxA, xrefs: 00007FF70AA19234, 00007FF70AA19242
MessageBoxW, xrefs: 00007FF70AA19256, 00007FF70AA19264

Memory Dump Source

Source File: 0000000A.00000002.2345199746.00007FF70A9E1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF70A9E0000, based on PE: true

Associated: 0000000A.00000002.2345173222.00007FF70A9E0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2345236578.00007FF70AA34000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2345264921.00007FF70AA47000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2345286816.00007FF70AA4A000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff70a9e0000_tapinstall.jbxd

Similarity

API ID: try_get_function$AddressProc
String ID: MessageBoxA$MessageBoxW
API String ID: 1640347226-1053882329
Opcode ID: d25e26e93fbc0f399955a4174ee145feb3741ebe1ff497b5d2ef8bac74c6ea03
Instruction ID: 15a0b8e5b8ff15dbac707a5cd08bf2e5af1b36f319ea9d14ca0b732e3a93b3f7
Opcode Fuzzy Hash: d25e26e93fbc0f399955a4174ee145feb3741ebe1ff497b5d2ef8bac74c6ea03
Instruction Fuzzy Hash: 7DF0CDE3D0864BA5FA04EB60EC918B4A351AF54784FC45077E54C122E5DF7CE95BCBA0

Function 00007FF70AA2E2A8 Relevance: 6.1, APIs: 4, Instructions: 64COMMON

Download Yara Rule

APIs

SetFilePointerEx.KERNEL32 ref: 00007FF70AA2E2F6
GetLastError.KERNEL32 ref: 00007FF70AA2E300
SetFilePointerEx.KERNEL32 ref: 00007FF70AA2E324
SetFilePointerEx.KERNEL32 ref: 00007FF70AA2E349

Memory Dump Source

Source File: 0000000A.00000002.2345199746.00007FF70A9E1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF70A9E0000, based on PE: true

Associated: 0000000A.00000002.2345173222.00007FF70A9E0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2345236578.00007FF70AA34000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2345264921.00007FF70AA47000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2345286816.00007FF70AA4A000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff70a9e0000_tapinstall.jbxd

Similarity

API ID: FilePointer$ErrorLast
String ID:
API String ID: 142388799-0
Opcode ID: 62e83ff613cf7e0c6914a0449e0ad6475a81f3d2e6a598e7b544edde691620a4
Instruction ID: e69a44c90d2d50f9704a1d2bee216ebffcadab04f6e7c14e950ac5ccbafe79cd
Opcode Fuzzy Hash: 62e83ff613cf7e0c6914a0449e0ad6475a81f3d2e6a598e7b544edde691620a4
Instruction Fuzzy Hash: 882199A3A0CA4141FB60AB29EC44569F761AF44BE0F984771EA6D47BD4CF7CD4528710

Function 00007FF70A9E77B0 Relevance: 6.1, APIs: 4, Instructions: 63COMMON

Download Yara Rule

APIs

_set_fmode.LIBCMT ref: 00007FF70A9E77C7
_RTC_Initialize.LIBCMT ref: 00007FF70A9E77E8

Part of subcall function 00007FF70A9E8390: _onexit.LIBCMT ref: 00007FF70A9E8394

Part of subcall function 00007FF70AA10610: _invalid_parameter_noinfo.LIBCMT ref: 00007FF70AA10642

__scrt_fastfail.LIBCMT ref: 00007FF70A9E7860
__scrt_initialize_default_local_stdio_options.LIBCMT ref: 00007FF70A9E7874

Memory Dump Source

Source File: 0000000A.00000002.2345199746.00007FF70A9E1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF70A9E0000, based on PE: true

Associated: 0000000A.00000002.2345173222.00007FF70A9E0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2345236578.00007FF70AA34000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2345264921.00007FF70AA47000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2345286816.00007FF70AA4A000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff70a9e0000_tapinstall.jbxd

Similarity

API ID: Initialize__scrt_fastfail__scrt_initialize_default_local_stdio_options_invalid_parameter_noinfo_onexit_set_fmode
String ID:
API String ID: 2724578021-0
Opcode ID: 59f558a869d8c5a2891d93cde5f61cf3a556da39cfb7dd89c65c92046b5ebcbe
Instruction ID: 9041e99c2b1b6b28ffbf576d13451e0db63adf8c93c2bd7bbf629a443c874582
Opcode Fuzzy Hash: 59f558a869d8c5a2891d93cde5f61cf3a556da39cfb7dd89c65c92046b5ebcbe
Instruction Fuzzy Hash: 44119A56F2C24345FA54BBF4CC566B991919FB4308FC088F4E50DDA2C3EF6CA8428672

Function 00007FF70A9E2BD0 Relevance: 6.1, APIs: 4, Instructions: 52COMMON

Download Yara Rule

APIs

CM_Connect_MachineW.SETUPAPI ref: 00007FF70A9E2BF7
CM_Locate_DevNode_ExW.SETUPAPI ref: 00007FF70A9E2C10
CM_Reenumerate_DevNode_Ex.SETUPAPI ref: 00007FF70A9E2C48
CM_Disconnect_Machine.SETUPAPI ref: 00007FF70A9E2C78

Memory Dump Source

Source File: 0000000A.00000002.2345199746.00007FF70A9E1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF70A9E0000, based on PE: true

Associated: 0000000A.00000002.2345173222.00007FF70A9E0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2345236578.00007FF70AA34000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2345264921.00007FF70AA47000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2345286816.00007FF70AA4A000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff70a9e0000_tapinstall.jbxd

Similarity

API ID: MachineNode_$Connect_Disconnect_Locate_Reenumerate_
String ID:
API String ID: 218754429-0
Opcode ID: 51e3b3903d85c558772266e626df222a9037cd96535ea5ab3710ae0d24f20ba0
Instruction ID: c72e6920f4042534a69560616df78cfa6aa78a86f21695886d5887016d66865d
Opcode Fuzzy Hash: 51e3b3903d85c558772266e626df222a9037cd96535ea5ab3710ae0d24f20ba0
Instruction Fuzzy Hash: 9411BB23B1C64243F714EF21E84056AE3A1FFD8B88F858171DA4D47655DF2DD5018610

Function 00007FF70A9EAF10 Relevance: 6.0, APIs: 4, Instructions: 45COMMONLIBRARYCODE

Download Yara Rule

APIs

DName::operator=.LIBVCRUNTIME ref: 00007FF70A9EAF37

Part of subcall function 00007FF70A9EAB98: _HeapManager::getMemory.LIBVCRUNTIME ref: 00007FF70A9EABC7

DName::operator+=.LIBVCRUNTIME ref: 00007FF70A9EAF48

Memory Dump Source

Source File: 0000000A.00000002.2345199746.00007FF70A9E1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF70A9E0000, based on PE: true

Associated: 0000000A.00000002.2345173222.00007FF70A9E0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2345236578.00007FF70AA34000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2345264921.00007FF70AA47000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2345286816.00007FF70AA4A000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff70a9e0000_tapinstall.jbxd

Similarity

API ID: HeapManager::getMemoryName::operator+=Name::operator=
String ID:
API String ID: 2929307750-0
Opcode ID: fce481929f355538a9b42238b523bc7f3f2660cc8b7c85b8c5e9693f606264b3
Instruction ID: 9f6d86062cbed0d1750e46d707dd092a2d9473c2fb05439a79b04634062e88e5
Opcode Fuzzy Hash: fce481929f355538a9b42238b523bc7f3f2660cc8b7c85b8c5e9693f606264b3
Instruction Fuzzy Hash: F411E763F2E69241FA11E751DC00179E391AF24BC5FD8C871D54C82A97DF2DE8528310

Function 00007FF70AA2E438 Relevance: 6.0, APIs: 4, Instructions: 43COMMON

Download Yara Rule

APIs

SetFilePointerEx.KERNEL32 ref: 00007FF70AA2E45B
GetLastError.KERNEL32 ref: 00007FF70AA2E465
SetFilePointerEx.KERNEL32 ref: 00007FF70AA2E48C
SetFilePointerEx.KERNEL32 ref: 00007FF70AA2E4AF

Memory Dump Source

Source File: 0000000A.00000002.2345199746.00007FF70A9E1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF70A9E0000, based on PE: true

Associated: 0000000A.00000002.2345173222.00007FF70A9E0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2345236578.00007FF70AA34000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2345264921.00007FF70AA47000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2345286816.00007FF70AA4A000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff70a9e0000_tapinstall.jbxd

Similarity

API ID: FilePointer$ErrorLast
String ID:
API String ID: 142388799-0
Opcode ID: 5218c0f678f2c40fbbdda99fcc7e3f762700fa66660efab7cd38c83b84687fb8
Instruction ID: 1a13e36eaace3665d2488044d4f09f22823387f0932a7a8292d27047565007f0
Opcode Fuzzy Hash: 5218c0f678f2c40fbbdda99fcc7e3f762700fa66660efab7cd38c83b84687fb8
Instruction Fuzzy Hash: FD1191A3A0CA4182F720AB65FC0096AEB60BF88B94F904171EA9D43AD4CF3CD4528710

Function 00007FF70AA00C54 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 176COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF70AA00C8C
_invalid_parameter_noinfo.LIBCMT ref: 00007FF70AA00ED3

Strings

*, xrefs: 00007FF70AA00D9B

Memory Dump Source

Source File: 0000000A.00000002.2345199746.00007FF70A9E1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF70A9E0000, based on PE: true

Associated: 0000000A.00000002.2345173222.00007FF70A9E0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2345236578.00007FF70AA34000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2345264921.00007FF70AA47000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2345286816.00007FF70AA4A000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff70a9e0000_tapinstall.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: *
API String ID: 3215553584-163128923
Opcode ID: c702a447af3feb003120d3a589a2401bc16d95218c9ee08842c12031ba723851
Instruction ID: ca539f9fac52d421642419a24c89274671e40ed9ab6446239e81a6815c0d1f2f
Opcode Fuzzy Hash: c702a447af3feb003120d3a589a2401bc16d95218c9ee08842c12031ba723851
Instruction Fuzzy Hash: 6A7194F390861286F768AF38D854E7CBAA0EF05B58F95017ACA4E922D4DF39D443C764

Function 00007FF70AA004BC Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 174COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF70AA004F4
_invalid_parameter_noinfo.LIBCMT ref: 00007FF70AA0072A

Strings

*, xrefs: 00007FF70AA00603

Memory Dump Source

Source File: 0000000A.00000002.2345199746.00007FF70A9E1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF70A9E0000, based on PE: true

Associated: 0000000A.00000002.2345173222.00007FF70A9E0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2345236578.00007FF70AA34000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2345264921.00007FF70AA47000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2345286816.00007FF70AA4A000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff70a9e0000_tapinstall.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: *
API String ID: 3215553584-163128923
Opcode ID: 273e77a1793748d35078b520fc40068adaf46b422db4c706b51f3ef3c241a5fe
Instruction ID: 59af38bb5b3729055bb9b9910826e157ac1254a9b0c31d62d1d2756330458c91
Opcode Fuzzy Hash: 273e77a1793748d35078b520fc40068adaf46b422db4c706b51f3ef3c241a5fe
Instruction Fuzzy Hash: 6C71CAF390921286F7686F38C850E7DFBB1EF44B14F950179DA4A822D5DF69D482C720

Function 00007FF70AA01190 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 171COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF70AA011C8
_invalid_parameter_noinfo.LIBCMT ref: 00007FF70AA01402

Strings

*, xrefs: 00007FF70AA012D5

Memory Dump Source

Source File: 0000000A.00000002.2345199746.00007FF70A9E1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF70A9E0000, based on PE: true

Associated: 0000000A.00000002.2345173222.00007FF70A9E0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2345236578.00007FF70AA34000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2345264921.00007FF70AA47000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2345286816.00007FF70AA4A000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff70a9e0000_tapinstall.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: *
API String ID: 3215553584-163128923
Opcode ID: 44c1df76ee1ff000bf001b99eeb66820c451a0d8bf2018bec658e7c217c0f5f6
Instruction ID: 412fdc3f3376c0d87b468794014872670c663536b423a73f354621f4a36fdf06
Opcode Fuzzy Hash: 44c1df76ee1ff000bf001b99eeb66820c451a0d8bf2018bec658e7c217c0f5f6
Instruction Fuzzy Hash: 157182F390861286F7A5AF39C884CBCB6A0EF09B48F941275CA4AC26D4DF29D443C765

Function 00007FF70AA009E8 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 169COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF70AA00A20
_invalid_parameter_noinfo.LIBCMT ref: 00007FF70AA00C49

Strings

*, xrefs: 00007FF70AA00B2D

Memory Dump Source

Source File: 0000000A.00000002.2345199746.00007FF70A9E1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF70A9E0000, based on PE: true

Associated: 0000000A.00000002.2345173222.00007FF70A9E0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2345236578.00007FF70AA34000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2345264921.00007FF70AA47000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2345286816.00007FF70AA4A000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff70a9e0000_tapinstall.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: *
API String ID: 3215553584-163128923
Opcode ID: 0377a43a123b46e862bf5f185707fa53883c6999a2b7e98940989a3650cad85b
Instruction ID: 485913fa6a264684ddd8c3d2e3ab3009fc7c53138f28a0e1c60f10136280e257
Opcode Fuzzy Hash: 0377a43a123b46e862bf5f185707fa53883c6999a2b7e98940989a3650cad85b
Instruction Fuzzy Hash: 3D7183B390821286F765AF38C844E7DBBA0EF06B58F954175CA89C22D9DF39D493C724

Function 00007FF70AA10610 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 111COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF70AA10642

Part of subcall function 00007FF70AA179F8: HeapFree.KERNEL32(?,?,?,00007FF70AA232DC,?,?,?,00007FF70AA236FF,?,?,00000000,00007FF70AA23F44,?,?,?,00007FF70AA23E77), ref: 00007FF70AA17A0E
Part of subcall function 00007FF70AA179F8: GetLastError.KERNEL32(?,?,?,00007FF70AA232DC,?,?,?,00007FF70AA236FF,?,?,00000000,00007FF70AA23F44,?,?,?,00007FF70AA23E77), ref: 00007FF70AA17A20

GetModuleFileNameW.KERNEL32(?,?,?,?,?,00007FF70A9E7805), ref: 00007FF70AA10660

Strings

C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exe, xrefs: 00007FF70AA1064E

Memory Dump Source

Source File: 0000000A.00000002.2345199746.00007FF70A9E1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF70A9E0000, based on PE: true

Associated: 0000000A.00000002.2345173222.00007FF70A9E0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2345236578.00007FF70AA34000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2345264921.00007FF70AA47000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2345286816.00007FF70AA4A000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff70a9e0000_tapinstall.jbxd

Similarity

API ID: ErrorFileFreeHeapLastModuleName_invalid_parameter_noinfo
String ID: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exe
API String ID: 3580290477-2985852448
Opcode ID: b063ccabdf4ae0fb810ec30d9af89ab26e9ed12f878b4f8ead2f3c050a887b6f
Instruction ID: 7a3c18c4b51368127bf1f103e92511ef18320918addec69006cbe28aefd8a205
Opcode Fuzzy Hash: b063ccabdf4ae0fb810ec30d9af89ab26e9ed12f878b4f8ead2f3c050a887b6f
Instruction Fuzzy Hash: BF419AB3A08B12AAF744AF21EC408B8B790AF847C0F940075E94E47BC5DF3DE4828720

Function 00007FF70AA0FD7C Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 109COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF70AA0FDB3

Strings

C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exe, xrefs: 00007FF70AA0FDBF

Memory Dump Source

Source File: 0000000A.00000002.2345199746.00007FF70A9E1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF70A9E0000, based on PE: true

Associated: 0000000A.00000002.2345173222.00007FF70A9E0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2345236578.00007FF70AA34000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2345264921.00007FF70AA47000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2345286816.00007FF70AA4A000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff70a9e0000_tapinstall.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exe
API String ID: 3215553584-2985852448
Opcode ID: e29d975727e9928f6db482a1ce53242b1b870c676fb5658a615ffb6c2a7e9428
Instruction ID: 24c3d134b08b664df115b4354d17e7b90fc5d97d00a598033c3e7a41a5d8d0c3
Opcode Fuzzy Hash: e29d975727e9928f6db482a1ce53242b1b870c676fb5658a615ffb6c2a7e9428
Instruction Fuzzy Hash: 6441AFB3A08B1289F760AF29EC408ACA794EF447D4F944072E94D97BD5DF7DE4828320

Function 00007FF70AA26F00 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 100fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32 ref: 00007FF70AA27017
GetLastError.KERNEL32 ref: 00007FF70AA27039

Strings

U, xrefs: 00007FF70AA26FC3

Memory Dump Source

Source File: 0000000A.00000002.2345199746.00007FF70A9E1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF70A9E0000, based on PE: true

Associated: 0000000A.00000002.2345173222.00007FF70A9E0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2345236578.00007FF70AA34000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2345264921.00007FF70AA47000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2345286816.00007FF70AA4A000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff70a9e0000_tapinstall.jbxd

Similarity

API ID: ErrorFileLastWrite
String ID: U
API String ID: 442123175-4171548499
Opcode ID: 1fe9f3420805e2f29ef7fd3f085adcd01cfbc63ee96cabacd67f80ead1b7df33
Instruction ID: 678d2e39fd067967328e1fe5dff46a460cbffb35bd1221bf126abac660a66933
Opcode Fuzzy Hash: 1fe9f3420805e2f29ef7fd3f085adcd01cfbc63ee96cabacd67f80ead1b7df33
Instruction Fuzzy Hash: 7341D473B29B8282EB509F29E8447AAA760FB98784F804031EE4D977D8DF3CD552C750

Function 00007FF70AA063EC Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 92COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF70AA0648B
_invalid_parameter_noinfo.LIBCMT ref: 00007FF70AA064E5

Strings

(null), xrefs: 00007FF70AA06520

Memory Dump Source

Source File: 0000000A.00000002.2345199746.00007FF70A9E1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF70A9E0000, based on PE: true

Associated: 0000000A.00000002.2345173222.00007FF70A9E0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2345236578.00007FF70AA34000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2345264921.00007FF70AA47000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2345286816.00007FF70AA4A000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff70a9e0000_tapinstall.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: (null)
API String ID: 3215553584-3941151225
Opcode ID: 6c3bdb81d6503200fbc9806bbd4de99d2cd9e2aec5a58b5ddbe94e3352eb6c76
Instruction ID: 6bf4746f0192bdd6f5e5d06fc0ac26bc4a65ee2f32f0b89db1e17a69d1a5aeae
Opcode Fuzzy Hash: 6c3bdb81d6503200fbc9806bbd4de99d2cd9e2aec5a58b5ddbe94e3352eb6c76
Instruction Fuzzy Hash: E5419FF390864286FB54AF38C940ABCA7A0EF05B4CF944079C648873D5EB6AE463C720

Function 00007FF70AA061AC Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 91COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF70AA0624B
_invalid_parameter_noinfo.LIBCMT ref: 00007FF70AA062A5

Strings

(null), xrefs: 00007FF70AA062E0

Memory Dump Source

Source File: 0000000A.00000002.2345199746.00007FF70A9E1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF70A9E0000, based on PE: true

Associated: 0000000A.00000002.2345173222.00007FF70A9E0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2345236578.00007FF70AA34000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2345264921.00007FF70AA47000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2345286816.00007FF70AA4A000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff70a9e0000_tapinstall.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: (null)
API String ID: 3215553584-3941151225
Opcode ID: 86f5d118cb039ec818438e09ce49581f3b3a508989dcbeb2b4f251bb552b9fde
Instruction ID: 1c47929305b8be3a48016dafe955bef9b6fd5abfaed1e3c4898cc9f2e4fcf986
Opcode Fuzzy Hash: 86f5d118cb039ec818438e09ce49581f3b3a508989dcbeb2b4f251bb552b9fde
Instruction Fuzzy Hash: 92414DB3D086428AFB546F28C944A7CE7A0EF19B4CF944079C648872D5DBAAD467DB20

Function 00007FF70AA0686C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 80COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF70AA06903
_invalid_parameter_noinfo.LIBCMT ref: 00007FF70AA0695F

Strings

(null), xrefs: 00007FF70AA06981

Memory Dump Source

Source File: 0000000A.00000002.2345199746.00007FF70A9E1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF70A9E0000, based on PE: true

Associated: 0000000A.00000002.2345173222.00007FF70A9E0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2345236578.00007FF70AA34000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2345264921.00007FF70AA47000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2345286816.00007FF70AA4A000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff70a9e0000_tapinstall.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: (null)
API String ID: 3215553584-3941151225
Opcode ID: cc2c6a8b0e55809a46d0f9a000170ec88b53eaf67deeeed0a9ebb9cf96cbfb4a
Instruction ID: 4a3b9976c19d625692091bf0add3f7f94a9e80a189d8f31d719c5997b6a10002
Opcode Fuzzy Hash: cc2c6a8b0e55809a46d0f9a000170ec88b53eaf67deeeed0a9ebb9cf96cbfb4a
Instruction Fuzzy Hash: 25318CB390864286FB54AF25D940ABCA7A0EF05B88F944079CA8C477D5DF7EE466C720

Function 00007FF70AA06634 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 80COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF70AA066CB
_invalid_parameter_noinfo.LIBCMT ref: 00007FF70AA06727

Strings

(null), xrefs: 00007FF70AA06749

Memory Dump Source

Source File: 0000000A.00000002.2345199746.00007FF70A9E1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF70A9E0000, based on PE: true

Associated: 0000000A.00000002.2345173222.00007FF70A9E0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2345236578.00007FF70AA34000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2345264921.00007FF70AA47000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2345286816.00007FF70AA4A000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff70a9e0000_tapinstall.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: (null)
API String ID: 3215553584-3941151225
Opcode ID: 8d16575f416e964c397b675debac7c57f087c1fd9fd9ac565c228dc38de02ea8
Instruction ID: 1414f2dab9978a07e45e26c0fa60d9b9d0103638c0e1d614f8b2c6f8b8ab3834
Opcode Fuzzy Hash: 8d16575f416e964c397b675debac7c57f087c1fd9fd9ac565c228dc38de02ea8
Instruction Fuzzy Hash: 58316BB390865186FB54AF25D940A7CABA1EF14B48F9440BACB4C473D5DFBAE463C720

Function 00007FF70A9E93B8 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 80COMMON

Download Yara Rule

APIs

__unDName.LIBVCRUNTIME ref: 00007FF70A9E940D
InterlockedPushEntrySList.KERNEL32 ref: 00007FF70A9E948F

Strings

, xrefs: 00007FF70A9E9430

Memory Dump Source

Source File: 0000000A.00000002.2345199746.00007FF70A9E1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF70A9E0000, based on PE: true

Associated: 0000000A.00000002.2345173222.00007FF70A9E0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2345236578.00007FF70AA34000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2345264921.00007FF70AA47000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2345286816.00007FF70AA4A000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff70a9e0000_tapinstall.jbxd

Similarity

API ID: EntryInterlockedListNamePush__un
String ID:
API String ID: 524438517-3916222277
Opcode ID: 417fdae7254f6f5144bd35c4e94cf888892e231184d73a789330c72b6a667246
Instruction ID: 18ec29e2732764835474cb0796e1e348ff043c10951544ef92b324d9d38b6cad
Opcode Fuzzy Hash: 417fdae7254f6f5144bd35c4e94cf888892e231184d73a789330c72b6a667246
Instruction Fuzzy Hash: 8C31F553B29B9250FE45EB2ADC044A9E3A0BF58BE8F984671DD2D43381EF39D402C360

Function 00007FF70AA32648 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 54COMMON

Download Yara Rule

APIs

_set_errno_from_matherr.LIBCMT ref: 00007FF70AA326F4
_set_errno_from_matherr.LIBCMT ref: 00007FF70AA32708

Strings

exp, xrefs: 00007FF70AA3266F

Memory Dump Source

Source File: 0000000A.00000002.2345199746.00007FF70A9E1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF70A9E0000, based on PE: true

Associated: 0000000A.00000002.2345173222.00007FF70A9E0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2345236578.00007FF70AA34000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2345264921.00007FF70AA47000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2345286816.00007FF70AA4A000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff70a9e0000_tapinstall.jbxd

Similarity

API ID: _set_errno_from_matherr
String ID: exp
API String ID: 1187470696-113136155
Opcode ID: d5f934b609bcad54c18539aeaafe18b7f7d4df74e02c91daf66fb3b3797701d8
Instruction ID: dd084f42ffc388dc9f604802e12636695dbbb65ec04c32a05222070b2395ffad
Opcode Fuzzy Hash: d5f934b609bcad54c18539aeaafe18b7f7d4df74e02c91daf66fb3b3797701d8
Instruction Fuzzy Hash: D6212FB7E196418BE760DF28E840AAAF2A0FFA9700F905535F68D82795DF3CE4058F10

Function 00007FF70AA18EA0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 50COMMONLIBRARYCODE

Download Yara Rule

APIs

try_get_function.LIBVCRUNTIME ref: 00007FF70AA18ED9
LCMapStringW.KERNEL32 ref: 00007FF70AA18F61

Strings

LCMapStringEx, xrefs: 00007FF70AA18EBC, 00007FF70AA18ECD

Memory Dump Source

Source File: 0000000A.00000002.2345199746.00007FF70A9E1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF70A9E0000, based on PE: true

Associated: 0000000A.00000002.2345173222.00007FF70A9E0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2345236578.00007FF70AA34000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2345264921.00007FF70AA47000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2345286816.00007FF70AA4A000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff70a9e0000_tapinstall.jbxd

Similarity

API ID: Stringtry_get_function
String ID: LCMapStringEx
API String ID: 2588686239-3893581201
Opcode ID: cb295809db890668f8262a5fe3d3b6ddd0daf1558d4252fdccb92730558150a5
Instruction ID: 83267fae7ca098e4c88bb2e332333022af59f9b15ed0808a3c40c9707fcda91d
Opcode Fuzzy Hash: cb295809db890668f8262a5fe3d3b6ddd0daf1558d4252fdccb92730558150a5
Instruction Fuzzy Hash: 8E111872A08B8186E660DB05F8406AAB7A1FBC9B90F944136EE8D83B59CF3CD4518B40

Function 00007FF70AA187B0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 50COMMON

Download Yara Rule

APIs

try_get_function.LIBVCRUNTIME ref: 00007FF70AA187E9
CompareStringW.KERNEL32 ref: 00007FF70AA18871

Strings

CompareStringEx, xrefs: 00007FF70AA187CC, 00007FF70AA187DD

Memory Dump Source

Source File: 0000000A.00000002.2345199746.00007FF70A9E1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF70A9E0000, based on PE: true

Associated: 0000000A.00000002.2345173222.00007FF70A9E0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2345236578.00007FF70AA34000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2345264921.00007FF70AA47000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2345286816.00007FF70AA4A000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff70a9e0000_tapinstall.jbxd

Similarity

API ID: CompareStringtry_get_function
String ID: CompareStringEx
API String ID: 3328479835-2590796910
Opcode ID: b4cbd51ef5490bc2d2e272553a4ec6addf4d60e5b84b1302dc18e736ddf69fb6
Instruction ID: d8b27b45cac24908e9f735f979514a89959c6f4723443fd3f1d58af97ab6d861
Opcode Fuzzy Hash: b4cbd51ef5490bc2d2e272553a4ec6addf4d60e5b84b1302dc18e736ddf69fb6
Instruction Fuzzy Hash: C7112977A08B8186E760DF15F8406AAB7A0FB8CB90F944136EE8D43B59CF3CD4418B40

Function 00007FF70AA18A50 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 46COMMON

Download Yara Rule

APIs

try_get_function.LIBVCRUNTIME ref: 00007FF70AA18A89
GetDateFormatW.KERNEL32 ref: 00007FF70AA18AEB

Strings

GetDateFormatEx, xrefs: 00007FF70AA18A6C, 00007FF70AA18A7D

Memory Dump Source

Source File: 0000000A.00000002.2345199746.00007FF70A9E1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF70A9E0000, based on PE: true

Associated: 0000000A.00000002.2345173222.00007FF70A9E0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2345236578.00007FF70AA34000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2345264921.00007FF70AA47000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2345286816.00007FF70AA4A000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff70a9e0000_tapinstall.jbxd

Similarity

API ID: DateFormattry_get_function
String ID: GetDateFormatEx
API String ID: 595753042-159735388
Opcode ID: 10ba63a0d18b04a583d40d43b30d9b9fca51ff14bda4a48675f954ae51532e04
Instruction ID: ea63c67705d7be4c191010236721f8690a489c96e965c1cf7177249e6b74fc11
Opcode Fuzzy Hash: 10ba63a0d18b04a583d40d43b30d9b9fca51ff14bda4a48675f954ae51532e04
Instruction Fuzzy Hash: 39113AA2A08B8186E610DF55F84059AB7A0FB89BD0F584136FE8D43BA8CF3CD5418B40

Function 00007FF70AA18C10 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44timeCOMMON

Download Yara Rule

APIs

try_get_function.LIBVCRUNTIME ref: 00007FF70AA18C49
GetTimeFormatW.KERNEL32 ref: 00007FF70AA18CA0

Strings

GetTimeFormatEx, xrefs: 00007FF70AA18C2C, 00007FF70AA18C3D

Memory Dump Source

Source File: 0000000A.00000002.2345199746.00007FF70A9E1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF70A9E0000, based on PE: true

Associated: 0000000A.00000002.2345173222.00007FF70A9E0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2345236578.00007FF70AA34000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2345264921.00007FF70AA47000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2345286816.00007FF70AA4A000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff70a9e0000_tapinstall.jbxd

Similarity

API ID: FormatTimetry_get_function
String ID: GetTimeFormatEx
API String ID: 3261793192-1692793031
Opcode ID: aeeeb5d1137ef8777056a49e071640647c3087b2b7666cf388f882a4f27613d1
Instruction ID: fdcbcc91dd8a1fc9f8f3f5297c3c7ca03b36494dbc766e5bac19cb50a1c27b1f
Opcode Fuzzy Hash: aeeeb5d1137ef8777056a49e071640647c3087b2b7666cf388f882a4f27613d1
Instruction Fuzzy Hash: BB1130A7A0878186E611DB56E80045AB7A0FF8CBD0F584175FE8D43BA9CF3CD5568B50

Function 00007FF70AA18CBC Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 26COMMON

Download Yara Rule

APIs

try_get_function.LIBVCRUNTIME ref: 00007FF70AA18CE5
GetUserDefaultLCID.KERNEL32(?,?,000000A0,00007FF70AA24130), ref: 00007FF70AA18CFC

Strings

GetUserDefaultLocaleName, xrefs: 00007FF70AA18CC8, 00007FF70AA18CD2

Memory Dump Source

Source File: 0000000A.00000002.2345199746.00007FF70A9E1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF70A9E0000, based on PE: true

Associated: 0000000A.00000002.2345173222.00007FF70A9E0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2345236578.00007FF70AA34000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2345264921.00007FF70AA47000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2345286816.00007FF70AA4A000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff70a9e0000_tapinstall.jbxd

Similarity

API ID: DefaultUsertry_get_function
String ID: GetUserDefaultLocaleName
API String ID: 3217810228-151340334
Opcode ID: 40f2b170c37b226c28a728e1fb59e4eb6a38f080f95f7a64a26471c64eab7d17
Instruction ID: 98c35a4afc60d0fd2ed7bde96de2e3160a8041f29f325b1938484b5c0df2daf2
Opcode Fuzzy Hash: 40f2b170c37b226c28a728e1fb59e4eb6a38f080f95f7a64a26471c64eab7d17
Instruction Fuzzy Hash: 7AF054D3F1854292FB15A755ED80DB5A2616F4C780FC44075E90D067D5CF2CD8478320

Function 00007FF70AA18D74 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 25COMMON

Download Yara Rule

APIs

try_get_function.LIBVCRUNTIME ref: 00007FF70AA18DA5
InitializeCriticalSectionAndSpinCount.KERNEL32(?,?,00000003,00007FF70A9F69F1), ref: 00007FF70AA18DBF

Strings

InitializeCriticalSectionEx, xrefs: 00007FF70AA18D99

Memory Dump Source

Source File: 0000000A.00000002.2345199746.00007FF70A9E1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF70A9E0000, based on PE: true

Associated: 0000000A.00000002.2345173222.00007FF70A9E0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2345236578.00007FF70AA34000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2345264921.00007FF70AA47000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2345286816.00007FF70AA4A000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff70a9e0000_tapinstall.jbxd

Similarity

API ID: CountCriticalInitializeSectionSpintry_get_function
String ID: InitializeCriticalSectionEx
API String ID: 539475747-3084827643
Opcode ID: 036a1433a8a1f8b3f241dbe4fb9b563d765e8a3562a01f57a6fbde3195910b39
Instruction ID: 5bfaba655362ca0b8e81d7a67cafc067faaccf28a1a299e012a917791a943fae
Opcode Fuzzy Hash: 036a1433a8a1f8b3f241dbe4fb9b563d765e8a3562a01f57a6fbde3195910b39
Instruction Fuzzy Hash: C4F054A7E1874192FA05BB51FD408A9A261BF4CB80FC840B6E91D13BD5CF3CD4568760

Function 00007FF70A9E8A74 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 23COMMON

Download Yara Rule

APIs

std::bad_alloc::bad_alloc.LIBCMT ref: 00007FF70A9E8A7D
_CxxThrowException.LIBVCRUNTIME ref: 00007FF70A9E8A8E

Part of subcall function 00007FF70A9E95E8: RtlPcToFileHeader.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00007FF70A9E8A93), ref: 00007FF70A9E965D
Part of subcall function 00007FF70A9E95E8: RaiseException.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00007FF70A9E8A93), ref: 00007FF70A9E968F

Strings

Unknown exception, xrefs: 00007FF70A9E8AA5

Memory Dump Source

Source File: 0000000A.00000002.2345199746.00007FF70A9E1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF70A9E0000, based on PE: true

Associated: 0000000A.00000002.2345173222.00007FF70A9E0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2345236578.00007FF70AA34000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2345264921.00007FF70AA47000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2345286816.00007FF70AA4A000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff70a9e0000_tapinstall.jbxd

Similarity

API ID: Exception$FileHeaderRaiseThrowstd::bad_alloc::bad_alloc
String ID: Unknown exception
API String ID: 3561508498-410509341
Opcode ID: c34982857cb7bf4f7b9c185461aa535e310ed63d4d8e15e87b28d440cdfdae32
Instruction ID: 89e5904bae8aba284b576f7ba01df5c0c038c0190a7b1967bf5d55da93ba5e63
Opcode Fuzzy Hash: c34982857cb7bf4f7b9c185461aa535e310ed63d4d8e15e87b28d440cdfdae32
Instruction Fuzzy Hash: 22D01263A1858692FE10FB40DC40794A330FFD4308FE04472E14C815B1DF6CD946C750

Function 00007FF70AA189FC Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 21COMMONLIBRARYCODE

Download Yara Rule

APIs

try_get_function.LIBVCRUNTIME ref: 00007FF70AA18A25
TlsSetValue.KERNEL32(?,?,00000000,00007FF70AA177AE,?,?,00000000,00007FF70AA16B85,?,?,?,?,00007FF70A9F6CA8), ref: 00007FF70AA18A3C

Strings

FlsSetValue, xrefs: 00007FF70AA18A12

Memory Dump Source

Source File: 0000000A.00000002.2345199746.00007FF70A9E1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF70A9E0000, based on PE: true

Associated: 0000000A.00000002.2345173222.00007FF70A9E0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2345236578.00007FF70AA34000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2345264921.00007FF70AA47000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2345286816.00007FF70AA4A000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff70a9e0000_tapinstall.jbxd

Similarity

API ID: Valuetry_get_function
String ID: FlsSetValue
API String ID: 738293619-3750699315
Opcode ID: f6d5dd2663f4e630c5fdec50bbb7cd7a8c87450e82d038accba4aa9b3675ea98
Instruction ID: 93fb054dfa85bd6fa3c6255c0b3af59079fe66d2dfc59d58fb354606186a193d
Opcode Fuzzy Hash: f6d5dd2663f4e630c5fdec50bbb7cd7a8c87450e82d038accba4aa9b3675ea98
Instruction Fuzzy Hash: 9EE0E5E7E1864693FA046B51FC408B9E221AF8C781FD951B6E91E063D5CF3CD8968320

Function 00007FF70A9EA544 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 21COMMONLIBRARYCODE

Download Yara Rule

APIs

try_get_function.LIBVCRUNTIME ref: 00007FF70A9EA56D
TlsSetValue.KERNEL32(?,?,?,00007FF70A9E9CC5,?,?,?,?,00007FF70A9E91A4,?,?,?,?,00007FF70A9E814B), ref: 00007FF70A9EA584

Strings

FlsSetValue, xrefs: 00007FF70A9EA551, 00007FF70A9EA55A

Memory Dump Source

Source File: 0000000A.00000002.2345199746.00007FF70A9E1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF70A9E0000, based on PE: true

Associated: 0000000A.00000002.2345173222.00007FF70A9E0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2345236578.00007FF70AA34000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2345264921.00007FF70AA47000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2345286816.00007FF70AA4A000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff70a9e0000_tapinstall.jbxd

Similarity

API ID: Valuetry_get_function
String ID: FlsSetValue
API String ID: 738293619-3750699315
Opcode ID: 620ae2d36bd9a72b075ae6d885032ef81b4224fd675c2c0689d5fc8c746a91d4
Instruction ID: 28e0831541fc5d9f0361a77179e2c2084921e31fad00dc4494a592ffe4ec5ebb
Opcode Fuzzy Hash: 620ae2d36bd9a72b075ae6d885032ef81b4224fd675c2c0689d5fc8c746a91d4
Instruction Fuzzy Hash: 00E030E7E1C64293FA04AB50FC008BCE321AF8C791FDA40B2E91D466A5CF3CD8568320

Analysis Process: nfregdrv.exePID: 3116, Parent PID: 6640COMMON

Execution Graph

Execution Coverage:	1.2%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	2.9%
Total number of Nodes:	2000
Total number of Limit Nodes:	28

Executed Functions

Function 100134A0 Relevance: 15.1, APIs: 10, Instructions: 58
serviceCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

OpenSCManagerA.ADVAPI32(00000000,00000000,000F003F), ref: 100134BE
OpenServiceA.ADVAPI32(00000000,?,00010000), ref: 100134D1
DeleteService.ADVAPI32(00000000), ref: 100134DE
GetLastError.KERNEL32 ref: 100134E4
CloseServiceHandle.ADVAPI32(00000000), ref: 100134ED
CloseServiceHandle.ADVAPI32(00000000), ref: 100134F6
GetLastError.KERNEL32 ref: 100134FE
CloseServiceHandle.ADVAPI32(00000000), ref: 10013507
GetLastError.KERNEL32 ref: 1001350F
SetLastError.KERNEL32(00000000), ref: 10013518

Memory Dump Source

Source File: 00000019.00000002.2407428257.0000000010001000.00000020.00000001.01000000.0000000A.sdmp, Offset: 10000000, based on PE: true

Associated: 00000019.00000002.2407398545.0000000010000000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.2407457416.0000000010019000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.2407486723.000000001001E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.2407543255.0000000010022000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_10000000_nfregdrv.jbxd

Similarity

API ID: Service$ErrorLast$CloseHandle$Open$DeleteManager
String ID:
API String ID: 2479149357-0
Opcode ID: 0b951e9cdb1a0b26f3be69c1878f1c2782ce42dc9d03292b26ecafa066a6cc1a
Instruction ID: 46c2e6c5a61eedaf3fef038684788d392a8c372027cf2a0885eba6b60b5d160f
Opcode Fuzzy Hash: 0b951e9cdb1a0b26f3be69c1878f1c2782ce42dc9d03292b26ecafa066a6cc1a
Instruction Fuzzy Hash: 9F01F132641624AFE7126BF49C8DB5E3B68EF49F42F058130FB01DA161DAB1E84086B1

Function 10012F40 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 66
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__snprintf.LIBCMT ref: 10012F6E
RegOpenKeyExA.KERNELBASE(80000002,?,00000000,00000003,?,?,?,?,?), ref: 10012F89
RegQueryValueExA.ADVAPI32(?,Tag,00000000,?,00000001,?), ref: 10012FD4
RegCloseKey.ADVAPI32(?), ref: 10012FFA

Strings

SYSTEM\CurrentControlSet\Services\%s, xrefs: 10012F5D
Tag, xrefs: 10012FC6
Tag, xrefs: 10012FE7

Memory Dump Source

Source File: 00000019.00000002.2407428257.0000000010001000.00000020.00000001.01000000.0000000A.sdmp, Offset: 10000000, based on PE: true

Associated: 00000019.00000002.2407398545.0000000010000000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.2407457416.0000000010019000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.2407486723.000000001001E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.2407543255.0000000010022000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_10000000_nfregdrv.jbxd

Similarity

API ID: CloseOpenQueryValue__snprintf
String ID: SYSTEM\CurrentControlSet\Services\%s$Tag$Tag
API String ID: 906094135-167878906
Opcode ID: 6f56ef87285fea69d5a8c9f690d12e05e358ab22d85251f7a7e5ed3c1616b0d0
Instruction ID: f9c08eb89e650521aaf22d2235fa5d9325a6f599f2f4c571dbf36a9dd9bf478e
Opcode Fuzzy Hash: 6f56ef87285fea69d5a8c9f690d12e05e358ab22d85251f7a7e5ed3c1616b0d0
Instruction Fuzzy Hash: 33116DB1A04354AFE328CB64CC4AFEB77E8EB89B40F40481CB74D9A180E774D945C7A2

Function 10012D70 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 55
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExA.KERNELBASE(80000002,SYSTEM\CurrentControlSet\Services\Tcpip6\Parameters,00000000,00000003,?,?,?,10013525,00000000), ref: 10012D86
RegQueryValueExA.KERNELBASE ref: 10012DB9
RegSetValueExA.KERNELBASE(?,DisabledComponents,00000000,00000004,?,00000004,?), ref: 10012DF7
RegCloseKey.KERNELBASE(?), ref: 10012E04

Strings

DisabledComponents, xrefs: 10012DF1
DisabledComponents, xrefs: 10012DAB
SYSTEM\CurrentControlSet\Services\Tcpip6\Parameters, xrefs: 10012D7C

Memory Dump Source

Source File: 00000019.00000002.2407428257.0000000010001000.00000020.00000001.01000000.0000000A.sdmp, Offset: 10000000, based on PE: true

Associated: 00000019.00000002.2407398545.0000000010000000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.2407457416.0000000010019000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.2407486723.000000001001E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.2407543255.0000000010022000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_10000000_nfregdrv.jbxd

Similarity

API ID: Value$CloseOpenQuery
String ID: DisabledComponents$DisabledComponents$SYSTEM\CurrentControlSet\Services\Tcpip6\Parameters
API String ID: 237177642-4216016250
Opcode ID: e76360cbcc9baf098a5e93c68d2a24a7b395f91ed9355a7129efde6212d0d687
Instruction ID: 9ee4d2c3e57a7063b565cc8fc060191f73725880ea3dbb34ca1c1c45c67cef35
Opcode Fuzzy Hash: e76360cbcc9baf098a5e93c68d2a24a7b395f91ed9355a7129efde6212d0d687
Instruction Fuzzy Hash: 7911A0B5508312BFE710DB54DD44FAB7BE8EB88B44F41890CF6899A0D0E374C984C756

Function 10012D00 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 37
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExA.KERNELBASE(80000002,SYSTEM\CurrentControlSet\Services\Tcpip\Parameters,00000000,00000002,00000000,00000000,00000000), ref: 10012D15
RegSetValueExA.KERNELBASE(00000000,DisableTaskOffload,00000000,00000004,?,00000004,?), ref: 10012D47
RegCloseKey.ADVAPI32(?), ref: 10012D54

Strings

DisableTaskOffload, xrefs: 10012D3D
SYSTEM\CurrentControlSet\Services\Tcpip\Parameters, xrefs: 10012D0B

Memory Dump Source

Source File: 00000019.00000002.2407428257.0000000010001000.00000020.00000001.01000000.0000000A.sdmp, Offset: 10000000, based on PE: true

Associated: 00000019.00000002.2407398545.0000000010000000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.2407457416.0000000010019000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.2407486723.000000001001E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.2407543255.0000000010022000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_10000000_nfregdrv.jbxd

Similarity

API ID: CloseOpenValue
String ID: DisableTaskOffload$SYSTEM\CurrentControlSet\Services\Tcpip\Parameters
API String ID: 779948276-1474643600
Opcode ID: b914e9072d492bfd31763df8d8490f62f2f2385f3a95968ca031b7c0720cf9be
Instruction ID: 2230c34db065372bc40d34239641de211e9b25fb5ab268f73dea6e655c247ba9
Opcode Fuzzy Hash: b914e9072d492bfd31763df8d8490f62f2f2385f3a95968ca031b7c0720cf9be
Instruction Fuzzy Hash: BBF0E9716043207FE711EB209C4AF5B37E8AB8CB00F84891CF794DA180E370C958C796

Function 00401000 Relevance: 3.8, APIs: 3, Instructions: 36
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CharNextA.USER32 ref: 0040102B
CharNextA.USER32 ref: 00401032
CharNextA.USER32 ref: 00401040

Memory Dump Source

Source File: 00000019.00000002.2406935891.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000019.00000002.2406895102.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000019.00000002.2406977537.0000000000408000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000019.00000002.2407008193.000000000040A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000019.00000002.2407030372.000000000040C000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_400000_nfregdrv.jbxd

Similarity

API ID: CharNext
String ID:
API String ID: 3213498283-0
Opcode ID: 7c522331cf8c48b44b5ec6a2051b80fc459d173407debce357d97d96f401c9b2
Instruction ID: dde81b71a90f9f684eae9ae77c255fe350d7d91c01edff3817fbd5cfc17a4160
Opcode Fuzzy Hash: 7c522331cf8c48b44b5ec6a2051b80fc459d173407debce357d97d96f401c9b2
Instruction Fuzzy Hash: 3BE06522A056E216D732162D28107AB568C4FD57E071A457BE8C0F77A5D639CCC642DD

Function 100092CF Relevance: 3.0, APIs: 2, Instructions: 28
memoryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

HeapCreate.KERNELBASE(00000000,00001000,00000000,10008AA9,00000001,?,?,00000001,?,?,10008C27,00000001,?,?,1001B608,0000000C), ref: 100092E0
HeapDestroy.KERNEL32(?,?,00000001,?,?,10008C27,00000001,?,?,1001B608,0000000C,10008CE1,?), ref: 10009316

Memory Dump Source

Source File: 00000019.00000002.2407428257.0000000010001000.00000020.00000001.01000000.0000000A.sdmp, Offset: 10000000, based on PE: true

Associated: 00000019.00000002.2407398545.0000000010000000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.2407457416.0000000010019000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.2407486723.000000001001E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.2407543255.0000000010022000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_10000000_nfregdrv.jbxd

Similarity

API ID: Heap$CreateDestroy
String ID:
API String ID: 3296620671-0
Opcode ID: 564c51fca60af66e7a4a00761b05f1ec1e784a5b92eab29dc0ead7a71cea7728
Instruction ID: 0c4cb1e0f78fd55b04bfad504b74cc3b14dfc1a1f94936553e122905dbeb7e21
Opcode Fuzzy Hash: 564c51fca60af66e7a4a00761b05f1ec1e784a5b92eab29dc0ead7a71cea7728
Instruction Fuzzy Hash: 3CE01279654362AEFB41DB308C8976A35E8E7547C6F10C939F415C50B8FBB0C6809A04

Function 0040285E Relevance: 3.0, APIs: 2, Instructions: 28
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

HeapCreate.KERNELBASE(00000000,00001000,00000000,00401236,00000001), ref: 0040286F
HeapDestroy.KERNEL32 ref: 004028A5

Memory Dump Source

Source File: 00000019.00000002.2406935891.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000019.00000002.2406895102.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000019.00000002.2406977537.0000000000408000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000019.00000002.2407008193.000000000040A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000019.00000002.2407030372.000000000040C000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_400000_nfregdrv.jbxd

Similarity

API ID: Heap$CreateDestroy
String ID:
API String ID: 3296620671-0
Opcode ID: 6a61f211992a6e18c95607d49fad3f3b072efb0b2f059ec0a30deba2ad50305b
Instruction ID: c9b1d8ae43914fce643a3b0feff7cc958f3d34f8e715b1d91c1e9ab3a3c39313
Opcode Fuzzy Hash: 6a61f211992a6e18c95607d49fad3f3b072efb0b2f059ec0a30deba2ad50305b
Instruction Fuzzy Hash: ABE06576550301DAEB457B715F0DB363594E74074AF10853BF841F51E2FBB88540960D

Function 004014E3 Relevance: 3.0, APIs: 2, Instructions: 5
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

___crtCorExitProcess.LIBCMT ref: 004014E7

Part of subcall function 004014BD: GetModuleHandleA.KERNEL32(mscoree.dll,004014EC,?,00405D96,000000FF,0000001E,00000001,00000000,00000000,?,004040D4,?,00000001,?,00402C9C,00000018), ref: 004014C2
Part of subcall function 004014BD: GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 004014D2

ExitProcess.KERNEL32 ref: 004014F1

Memory Dump Source

Source File: 00000019.00000002.2406935891.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000019.00000002.2406895102.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000019.00000002.2406977537.0000000000408000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000019.00000002.2407008193.000000000040A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000019.00000002.2407030372.000000000040C000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_400000_nfregdrv.jbxd

Similarity

API ID: ExitProcess$AddressHandleModuleProc___crt
String ID:
API String ID: 2427264223-0
Opcode ID: 6c26d35538560624cb0276524913e3c26102e8c22ac44d2ad5d5b3d3ea4d6717
Instruction ID: 537dee8b853bd8b800ce6c4827e120e5e31ff7b11606db799f1f5586ed61abf1
Opcode Fuzzy Hash: 6c26d35538560624cb0276524913e3c26102e8c22ac44d2ad5d5b3d3ea4d6717
Instruction Fuzzy Hash: EBB01230004100AFC6012B10EF0BC0D7B71EF40744F00C47DF088100708F354C54BE05

Non-executed Functions

Function 10013540 Relevance: 28.1, APIs: 13, Strings: 3, Instructions: 138serviceCOMMON

Download Yara Rule

APIs

OpenSCManagerA.ADVAPI32(00000000,00000000,000F003F), ref: 100135C3
CreateServiceW.ADVAPI32(00000000,?,?,000F01FF,00000001,00000001,00000001,?,PNP_TDI,?,00000000,00000000,00000000), ref: 10013605
CloseServiceHandle.ADVAPI32(00000000), ref: 1001361B
GetLastError.KERNEL32 ref: 10013625
GetLastError.KERNEL32 ref: 1001363D
OpenServiceA.ADVAPI32(?,?,00000014), ref: 10013655
QueryServiceStatus.ADVAPI32(00000000,?), ref: 10013667
StartServiceA.ADVAPI32(00000000,00000000,00000000), ref: 1001367D
GetLastError.KERNEL32 ref: 10013689
CloseServiceHandle.ADVAPI32(00000000), ref: 10013692
CloseServiceHandle.ADVAPI32(?), ref: 100136A7
SetLastError.KERNEL32(00000000), ref: 100136B9

Strings

PNP_TDI, xrefs: 100135E4
system32\drivers\%S.sys, xrefs: 100135A3
%S\%S.sys, xrefs: 1001358A

Memory Dump Source

Source File: 00000019.00000002.2407428257.0000000010001000.00000020.00000001.01000000.0000000A.sdmp, Offset: 10000000, based on PE: true

Associated: 00000019.00000002.2407398545.0000000010000000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.2407457416.0000000010019000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.2407486723.000000001001E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.2407543255.0000000010022000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_10000000_nfregdrv.jbxd

Similarity

API ID: Service$ErrorLast$CloseHandle$Open$CreateManagerQueryStartStatus
String ID: %S\%S.sys$PNP_TDI$system32\drivers\%S.sys
API String ID: 3292902256-1894622794
Opcode ID: 660a23612fc86a23e892aea1473c593627136715394c5b516177490ee6cba120
Instruction ID: 3a4aafa71a6d85f3e9df812c39c39bfa152d82fe410905c2edde1af795798740
Opcode Fuzzy Hash: 660a23612fc86a23e892aea1473c593627136715394c5b516177490ee6cba120
Instruction Fuzzy Hash: 1841E172644310BFE321DB608C89FAB77E9EB89B40F01851CFB859B291DA71E9408766

Function 10002060 Relevance: 19.9, APIs: 13, Instructions: 395COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32 ref: 100020EF
__aullrem.LIBCMT ref: 10002114
GetTickCount.KERNEL32 ref: 1000215A
LeaveCriticalSection.KERNEL32(1002030C), ref: 10002199
EnterCriticalSection.KERNEL32(1002030C), ref: 100021AE
GetTickCount.KERNEL32 ref: 10002256
LeaveCriticalSection.KERNEL32(1002030C), ref: 10002295
EnterCriticalSection.KERNEL32(1002030C), ref: 100022AA
EnterCriticalSection.KERNEL32 ref: 1000239F
EnterCriticalSection.KERNEL32(?), ref: 100023FE
LeaveCriticalSection.KERNEL32(1002030C), ref: 10002498
EnterCriticalSection.KERNEL32(1002030C), ref: 100024AD
LeaveCriticalSection.KERNEL32(1002030C), ref: 10002563

Part of subcall function 10014ED0: EnterCriticalSection.KERNEL32(10020324,?,?,?,?,?,?,?,?,?,1001536D), ref: 10014F3F
Part of subcall function 10014ED0: WriteFile.KERNEL32(FFFFFFFF,?,00000008,00000000,?), ref: 10014F8F
Part of subcall function 10014ED0: GetLastError.KERNEL32 ref: 10014F99
Part of subcall function 10014ED0: LeaveCriticalSection.KERNEL32(10020324), ref: 10014FAB

Memory Dump Source

Source File: 00000019.00000002.2407428257.0000000010001000.00000020.00000001.01000000.0000000A.sdmp, Offset: 10000000, based on PE: true

Associated: 00000019.00000002.2407398545.0000000010000000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.2407457416.0000000010019000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.2407486723.000000001001E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.2407543255.0000000010022000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_10000000_nfregdrv.jbxd

Similarity

API ID: CriticalSection$Enter$Leave$CountTick$ErrorFileLastWrite__aullrem
String ID:
API String ID: 2584342812-0
Opcode ID: af9e0746b45dabf02fd2421baf30e015d80efef54aadf8bda24db42c6145cc84
Instruction ID: 27e7611ef1cc4cd64037de96806a1b775dfd5a4704548cb2295c2b271f4c6af1
Opcode Fuzzy Hash: af9e0746b45dabf02fd2421baf30e015d80efef54aadf8bda24db42c6145cc84
Instruction Fuzzy Hash: F8F19A74604742EFE310CF64C984A4AB7F6FF48784F418929E9499BA15E330FD95CBA2

Function 100139D0 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 62COMMON

Download Yara Rule

APIs

GetCurrentProcessId.KERNEL32 ref: 100139D4
OpenProcess.KERNEL32(001F0FFF,00000000,00000000), ref: 100139E2
OpenProcessToken.ADVAPI32(00000000,00000020,?), ref: 100139F7
LookupPrivilegeValueA.ADVAPI32(00000000,SeDebugPrivilege,?), ref: 10013A13
CloseHandle.KERNEL32(?), ref: 10013A22
CloseHandle.KERNEL32(00000000), ref: 10013A25
AdjustTokenPrivileges.ADVAPI32 ref: 10013A5F
CloseHandle.KERNEL32(?), ref: 10013A74
CloseHandle.KERNEL32(00000000), ref: 10013A77

Strings

SeDebugPrivilege, xrefs: 10013A0C

Memory Dump Source

Source File: 00000019.00000002.2407428257.0000000010001000.00000020.00000001.01000000.0000000A.sdmp, Offset: 10000000, based on PE: true

Associated: 00000019.00000002.2407398545.0000000010000000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.2407457416.0000000010019000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.2407486723.000000001001E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.2407543255.0000000010022000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_10000000_nfregdrv.jbxd

Similarity

API ID: CloseHandle$Process$OpenToken$AdjustCurrentLookupPrivilegePrivilegesValue
String ID: SeDebugPrivilege
API String ID: 2638893802-2896544425
Opcode ID: 419289fe1aa8360b2f1914424ecfbc0142881d51788569709d273a4057b6a3c7
Instruction ID: 0388be8fc12d26e35ffcfca9aa46a7d98fc754c634c7c292c2151c31a72acd32
Opcode Fuzzy Hash: 419289fe1aa8360b2f1914424ecfbc0142881d51788569709d273a4057b6a3c7
Instruction Fuzzy Hash: 58116A75604310AFE201EB68CC89FAF7BE8EFC8754F44841CFA8896291D770E5448BA6

Function 100163B0 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 240COMMON

Download Yara Rule

APIs

GetLogicalDriveStringsW.KERNEL32(00000104,?,DF9D727A,?,?,?,00000000), ref: 1001640D
QueryDosDeviceW.KERNEL32 ref: 1001646C
GetDriveTypeW.KERNEL32(?,?,?,?,?,?), ref: 100165A1
EnterCriticalSection.KERNEL32(10020484), ref: 10016726
LeaveCriticalSection.KERNEL32(10020484), ref: 10016742

Strings

:, xrefs: 1001645A

Memory Dump Source

Source File: 00000019.00000002.2407428257.0000000010001000.00000020.00000001.01000000.0000000A.sdmp, Offset: 10000000, based on PE: true

Associated: 00000019.00000002.2407398545.0000000010000000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.2407457416.0000000010019000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.2407486723.000000001001E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.2407543255.0000000010022000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_10000000_nfregdrv.jbxd

Similarity

API ID: CriticalDriveSection$DeviceEnterLeaveLogicalQueryStringsType
String ID: :
API String ID: 3137785116-336475711
Opcode ID: 309e0b93bcea4dd87cd4e26c409c77e7e666b1aaa0db519f1e08522f54eca9c8
Instruction ID: 05aef7f753930580f9efe3ccf0e9bc9ed64d96a84334a073f7ef42401ff9f03d
Opcode Fuzzy Hash: 309e0b93bcea4dd87cd4e26c409c77e7e666b1aaa0db519f1e08522f54eca9c8
Instruction Fuzzy Hash: ADA15AB15083818BE720CF64CC85B9BB7E5FF88344F448A1EE6898B251D770E688CB53

Function 00401050 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 48windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00401000: CharNextA.USER32 ref: 0040102B
Part of subcall function 00401000: CharNextA.USER32 ref: 00401032

MessageBoxA.USER32(00000000,Usage: nfregdrv.exe <driver_name> - register windows\system32\drivers\<driver_name>.sys nfregdrv.exe -u <driver_name> - unregister windows\system32\drivers\<driver_name>.sys,nfregdvr,00000000), ref: 004010AE
?nf_registerDriver@nfapi@@YA?AW4_NF_STATUS@@PBD@Z.NFAPI(?), ref: 004010CA
?nf_unRegisterDriver@nfapi@@YA?AW4_NF_STATUS@@PBD@Z.NFAPI(?), ref: 004010DB

Strings

nfregdvr, xrefs: 004010A2
Usage: nfregdrv.exe <driver_name> - register windows\system32\drivers\<driver_name>.sys nfregdrv.exe -u <driver_name> - unregister windows\system32\drivers\<driver_name>.sys, xrefs: 004010A7

Memory Dump Source

Source File: 00000019.00000002.2406935891.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000019.00000002.2406895102.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000019.00000002.2406977537.0000000000408000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000019.00000002.2407008193.000000000040A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000019.00000002.2407030372.000000000040C000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_400000_nfregdrv.jbxd

Similarity

API ID: CharDriver@nfapi@@Next$?nf_register?nf_unMessageRegister
String ID: Usage: nfregdrv.exe <driver_name> - register windows\system32\drivers\<driver_name>.sys nfregdrv.exe -u <driver_name> - unregister windows\system32\drivers\<driver_name>.sys$nfregdvr
API String ID: 1889258244-2180452595
Opcode ID: 3a882d4fb6fe95bf0d5de4b4e3cf2f64ab34e96ef2f70e27ee227c43f8033b4f
Instruction ID: 1ab8e34958d480acc8493b27089cbdf5696b9cf7d697ab9778d1d713517b65dd
Opcode Fuzzy Hash: 3a882d4fb6fe95bf0d5de4b4e3cf2f64ab34e96ef2f70e27ee227c43f8033b4f
Instruction Fuzzy Hash: 8F01DE705082806AE70163746E057877A806F55755F08C87BF9D4B63E2E6B88898C7BF

Function 100141E0 Relevance: 7.6, APIs: 5, Instructions: 73COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(1002030C), ref: 100141E6
LeaveCriticalSection.KERNEL32(1002030C), ref: 100141FA
DeviceIoControl.KERNEL32(FFFFFFFF,00000000,?,0000024A,00000000,00000000,?,00000000), ref: 10014287
LeaveCriticalSection.KERNEL32(1002030C), ref: 10014297

Memory Dump Source

Source File: 00000019.00000002.2407428257.0000000010001000.00000020.00000001.01000000.0000000A.sdmp, Offset: 10000000, based on PE: true

Associated: 00000019.00000002.2407398545.0000000010000000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.2407457416.0000000010019000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.2407486723.000000001001E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.2407543255.0000000010022000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_10000000_nfregdrv.jbxd

Similarity

API ID: CriticalSection$Leave$ControlDeviceEnter
String ID:
API String ID: 3744975357-0
Opcode ID: c1d6194b3b625dbf574e7b20ed250350b817444bdaab0ad358dee30cb838081e
Instruction ID: 85bbbeb16c55dea885b82d2df4faedcc8aa5688a631ff53f8ce63f3f1ec5c482
Opcode Fuzzy Hash: c1d6194b3b625dbf574e7b20ed250350b817444bdaab0ad358dee30cb838081e
Instruction Fuzzy Hash: 17110A76510210AFE700CB68DC89E9633E9EF89761F51C215F6168F1E5EF70EAC4C6A1

Function 10007CCF Relevance: 7.6, APIs: 5, Instructions: 57COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32 ref: 1000A7F0
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 1000A805
UnhandledExceptionFilter.KERNEL32(100198DC), ref: 1000A810
GetCurrentProcess.KERNEL32(C0000409), ref: 1000A82C
TerminateProcess.KERNEL32(00000000), ref: 1000A833

Memory Dump Source

Source File: 00000019.00000002.2407428257.0000000010001000.00000020.00000001.01000000.0000000A.sdmp, Offset: 10000000, based on PE: true

Associated: 00000019.00000002.2407398545.0000000010000000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.2407457416.0000000010019000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.2407486723.000000001001E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.2407543255.0000000010022000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_10000000_nfregdrv.jbxd

Similarity

API ID: ExceptionFilterProcessUnhandled$CurrentDebuggerPresentTerminate
String ID:
API String ID: 2579439406-0
Opcode ID: 06ef2c53437fd46401bc4568d3fe183aff5b9b3a6a8811e184a836bfc1ef5544
Instruction ID: 5cd202c4d6932f10897f274e1b34921bd933b478cb37430cfba53272a53993d9
Opcode Fuzzy Hash: 06ef2c53437fd46401bc4568d3fe183aff5b9b3a6a8811e184a836bfc1ef5544
Instruction Fuzzy Hash: 9E21AEB89083259FF701DF94DCC46647BE4FB28754F40D15EE508872A5E7B0D9808F45

Function 10014000 Relevance: 7.5, APIs: 5, Instructions: 37COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32 ref: 10014010
LeaveCriticalSection.KERNEL32(1002030C), ref: 10014025
DeviceIoControl.KERNEL32(FFFFFFFF,0022019C,00000000,00000000,00000000,00000004,00000000,00000000), ref: 10014049
LeaveCriticalSection.KERNEL32(1002030C), ref: 1001405F

Memory Dump Source

Source File: 00000019.00000002.2407428257.0000000010001000.00000020.00000001.01000000.0000000A.sdmp, Offset: 10000000, based on PE: true

Associated: 00000019.00000002.2407398545.0000000010000000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.2407457416.0000000010019000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.2407486723.000000001001E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.2407543255.0000000010022000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_10000000_nfregdrv.jbxd

Similarity

API ID: CriticalSection$Leave$ControlDeviceEnter
String ID:
API String ID: 3744975357-0
Opcode ID: 4981ae034996778ee2c8bf16bcf631c7842ba69716a9c5caf53513e94cd4e299
Instruction ID: 194b0543918d9f7547c24edad603a73f0d8bc4c4cca9a48bf73c364b07b3f58e
Opcode Fuzzy Hash: 4981ae034996778ee2c8bf16bcf631c7842ba69716a9c5caf53513e94cd4e299
Instruction Fuzzy Hash: E8F09674A10310AFF701EB60ED89B8937A6EB98F12FC2C514F7098A1E1D7B5D95CC662

Function 10014170 Relevance: 7.5, APIs: 5, Instructions: 32COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(1002030C), ref: 10014176
LeaveCriticalSection.KERNEL32(1002030C), ref: 1001418B
DeviceIoControl.KERNEL32(FFFFFFFF,002201D0,00000000,00000000,00000000,00000000,?,00000000), ref: 100141AD
LeaveCriticalSection.KERNEL32(1002030C), ref: 100141BC

Memory Dump Source

Source File: 00000019.00000002.2407428257.0000000010001000.00000020.00000001.01000000.0000000A.sdmp, Offset: 10000000, based on PE: true

Associated: 00000019.00000002.2407398545.0000000010000000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.2407457416.0000000010019000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.2407486723.000000001001E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.2407543255.0000000010022000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_10000000_nfregdrv.jbxd

Similarity

API ID: CriticalSection$Leave$ControlDeviceEnter
String ID:
API String ID: 3744975357-0
Opcode ID: ed04f4c91301ef5749866e6216c76f80c91ee0689320974670393c5e7210247c
Instruction ID: ea0cb0fdb19bb7dbbc03564ec765e3cd75472be6806d2b7526bfc3e15de05ea0
Opcode Fuzzy Hash: ed04f4c91301ef5749866e6216c76f80c91ee0689320974670393c5e7210247c
Instruction Fuzzy Hash: 83F03974261310BFF205D7749D8AF5533A9EF18B32F628708F62AD90E1DF70E8449A51

Function 100013F0 Relevance: 3.1, APIs: 2, Instructions: 77COMMON

Download Yara Rule

APIs

ResetEvent.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,100175DD,10020370), ref: 100013FC
GetSystemInfo.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,100175DD,10020370), ref: 10001411

Memory Dump Source

Source File: 00000019.00000002.2407428257.0000000010001000.00000020.00000001.01000000.0000000A.sdmp, Offset: 10000000, based on PE: true

Associated: 00000019.00000002.2407398545.0000000010000000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.2407457416.0000000010019000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.2407486723.000000001001E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.2407543255.0000000010022000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_10000000_nfregdrv.jbxd

Similarity

API ID: EventInfoResetSystem
String ID:
API String ID: 3761259369-0
Opcode ID: 508fc2042419c3a36b202234b76a069f5d08a4c1d9f6591d6dd30bc335c3ad5d
Instruction ID: 39d4c7a7ad4dc565fb3197904db44af1b56c26df66e8bdcd4ed7d8d6cef16289
Opcode Fuzzy Hash: 508fc2042419c3a36b202234b76a069f5d08a4c1d9f6591d6dd30bc335c3ad5d
Instruction Fuzzy Hash: DE210172A002119BE320CE14CD40F9B73EAEFC4790F0A891CED5A9B268EA71FD4487D1

Function 1000A532 Relevance: 33.4, APIs: 15, Strings: 4, Instructions: 156
fileCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_strcpy_s.LIBCMT ref: 1000A59E
__invoke_watson.LIBCMT ref: 1000A5AF
GetModuleFileNameA.KERNEL32(00000000,1001F3C9,00000104), ref: 1000A5CB
_strcpy_s.LIBCMT ref: 1000A5E0
__invoke_watson.LIBCMT ref: 1000A5F3
_strlen.LIBCMT ref: 1000A5FC
_strlen.LIBCMT ref: 1000A609
__invoke_watson.LIBCMT ref: 1000A636
_strcat_s.LIBCMT ref: 1000A649
__invoke_watson.LIBCMT ref: 1000A65A
_strcat_s.LIBCMT ref: 1000A66B
__invoke_watson.LIBCMT ref: 1000A67C
GetStdHandle.KERNEL32(000000F4,00000001,00000001,00000000,76EC5E70,00000003,1000A6FE,000000FC,10007C34,00000001,00000000,00000000,?,1000B162,?,00000001), ref: 1000A69B
_strlen.LIBCMT ref: 1000A6BC
WriteFile.KERNEL32(00000000,00000000,00000000,?,00000000,?,1000B162,?,00000001,00000001,1000949D,00000018,1001B628,0000000C,1000952C,00000001), ref: 1000A6C6

Strings

..., xrefs: 1000A61A
Microsoft Visual C++ Runtime Library, xrefs: 1000A689
Runtime Error!Program: , xrefs: 1000A58D
<program name unknown>, xrefs: 1000A5D5

Memory Dump Source

Source File: 00000019.00000002.2407428257.0000000010001000.00000020.00000001.01000000.0000000A.sdmp, Offset: 10000000, based on PE: true

Associated: 00000019.00000002.2407398545.0000000010000000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.2407457416.0000000010019000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.2407486723.000000001001E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.2407543255.0000000010022000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_10000000_nfregdrv.jbxd

Similarity

API ID: __invoke_watson$_strlen$File_strcat_s_strcpy_s$HandleModuleNameWrite
String ID: ...$<program name unknown>$Microsoft Visual C++ Runtime Library$Runtime Error!Program:
API String ID: 1879448924-4022980321
Opcode ID: 4af349e1e8f6137c98c74494d34e3a9ba254edd55f11037dcb0b6f13b7d5c0d9
Instruction ID: ea148cf6e80d7e79cea2e11fe5e00895b7d8e29f61cf08ee7211173885be836a
Opcode Fuzzy Hash: 4af349e1e8f6137c98c74494d34e3a9ba254edd55f11037dcb0b6f13b7d5c0d9
Instruction Fuzzy Hash: E83118B69001252AF600E6208C56F7F369CEF172D0F050225FD49A519BEF37EEC241B6

Function 004017B5 Relevance: 33.4, APIs: 15, Strings: 4, Instructions: 156
fileCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_strcpy_s.LIBCMT ref: 00401821
__invoke_watson.LIBCMT ref: 00401832
GetModuleFileNameA.KERNEL32(00000000,0040B059,00000104), ref: 0040184E
_strcpy_s.LIBCMT ref: 00401863
__invoke_watson.LIBCMT ref: 00401876
_strlen.LIBCMT ref: 0040187F
_strlen.LIBCMT ref: 0040188C
__invoke_watson.LIBCMT ref: 004018B9
_strcat_s.LIBCMT ref: 004018CC
__invoke_watson.LIBCMT ref: 004018DD
_strcat_s.LIBCMT ref: 004018EE
__invoke_watson.LIBCMT ref: 004018FF
GetStdHandle.KERNEL32(000000F4,?,?,00000000,76EC5E70,00000003,00401981,000000FC,00405D85,00000001,00000000,00000000,?,004040D4,?,00000001), ref: 0040191E
_strlen.LIBCMT ref: 0040193F
WriteFile.KERNEL32(00000000,00000000,00000000,?,00000000,?,004040D4,?,00000001,?,00402C9C,00000018,004094A0,0000000C,00402D2B,?), ref: 00401949

Strings

Microsoft Visual C++ Runtime Library, xrefs: 0040190C
..., xrefs: 0040189D
<program name unknown>, xrefs: 00401858
Runtime Error!Program: , xrefs: 00401810

Memory Dump Source

Source File: 00000019.00000002.2406935891.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000019.00000002.2406895102.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000019.00000002.2406977537.0000000000408000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000019.00000002.2407008193.000000000040A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000019.00000002.2407030372.000000000040C000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_400000_nfregdrv.jbxd

Similarity

API ID: __invoke_watson$_strlen$File_strcat_s_strcpy_s$HandleModuleNameWrite
String ID: ...$<program name unknown>$Microsoft Visual C++ Runtime Library$Runtime Error!Program:
API String ID: 1879448924-4022980321
Opcode ID: 38520d41a68f396a59cc94f311c6a7ce392be311100e9e9c31ac4f97fc74b26a
Instruction ID: ac205ba077d332f24294b0c45a0e422cb4ceea3e0f9d8061dc6338a319882752
Opcode Fuzzy Hash: 38520d41a68f396a59cc94f311c6a7ce392be311100e9e9c31ac4f97fc74b26a
Instruction Fuzzy Hash: 043126E26402057AE6213A265E4AF2F3A4C9B01755F14403BFD45B22F3FA7E9A1181FE

Function 1000AD10 Relevance: 29.9, APIs: 12, Strings: 5, Instructions: 109libraryloadermemoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(KERNEL32.DLL,?,10008AB7,?,?,00000001,?,?,10008C27,00000001,?,?,1001B608,0000000C,10008CE1,?), ref: 1000AD16
__mtterm.LIBCMT ref: 1000AD22

Part of subcall function 1000A9FB: TlsFree.KERNEL32(00000001,10008B53,?,?,00000001,?,?,10008C27,00000001,?,?,1001B608,0000000C,10008CE1,?), ref: 1000AA26

GetProcAddress.KERNEL32(00000000,FlsAlloc), ref: 1000AD38
GetProcAddress.KERNEL32(00000000,FlsGetValue), ref: 1000AD45
GetProcAddress.KERNEL32(00000000,FlsSetValue), ref: 1000AD52
GetProcAddress.KERNEL32(00000000,FlsFree), ref: 1000AD5F
TlsAlloc.KERNEL32(?,?,00000001,?,?,10008C27,00000001,?,?,1001B608,0000000C,10008CE1,?), ref: 1000ADAF
TlsSetValue.KERNEL32(00000000,?,?,00000001,?,?,10008C27,00000001,?,?,1001B608,0000000C,10008CE1,?), ref: 1000ADCA
__init_pointers.LIBCMT ref: 1000ADD4
__calloc_crt.LIBCMT ref: 1000AE49
GetCurrentThreadId.KERNEL32 ref: 1000AE79

Strings

FlsAlloc, xrefs: 1000AD32
FlsFree, xrefs: 1000AD54
FlsGetValue, xrefs: 1000AD3A
KERNEL32.DLL, xrefs: 1000AD11
FlsSetValue, xrefs: 1000AD47

Memory Dump Source

Source File: 00000019.00000002.2407428257.0000000010001000.00000020.00000001.01000000.0000000A.sdmp, Offset: 10000000, based on PE: true

Associated: 00000019.00000002.2407398545.0000000010000000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.2407457416.0000000010019000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.2407486723.000000001001E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.2407543255.0000000010022000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_10000000_nfregdrv.jbxd

Similarity

API ID: AddressProc$AllocCurrentFreeHandleModuleThreadValue__calloc_crt__init_pointers__mtterm
String ID: FlsAlloc$FlsFree$FlsGetValue$FlsSetValue$KERNEL32.DLL
API String ID: 630932248-3819984048
Opcode ID: 27197f949f2674e2884e29655a0beec5e1f2c8da553a5096224482f203d367b5
Instruction ID: 1b7aacb4b742e95e3da3d0493d0b543e31d3ba40a5e9cc7053759451afc8b022
Opcode Fuzzy Hash: 27197f949f2674e2884e29655a0beec5e1f2c8da553a5096224482f203d367b5
Instruction Fuzzy Hash: D5317EB1801262AAFB10EF78CC85A253FA4EB622D0B22C72EF425C71A4DF35C4C0CB51

Function 0040267F Relevance: 29.9, APIs: 12, Strings: 5, Instructions: 109
libraryloadermemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleA.KERNEL32(KERNEL32.DLL,?,00401248), ref: 00402685
__mtterm.LIBCMT ref: 00402691

Part of subcall function 004023D3: TlsFree.KERNEL32(00000003,004027FE), ref: 004023FE
Part of subcall function 004023D3: DeleteCriticalSection.KERNEL32(00000000,00000000,7591DFB0,00000001,004027FE), ref: 00402C00
Part of subcall function 004023D3: DeleteCriticalSection.KERNEL32(00000003,7591DFB0,00000001,004027FE), ref: 00402C2A

GetProcAddress.KERNEL32(00000000,FlsAlloc), ref: 004026A7
GetProcAddress.KERNEL32(00000000,FlsGetValue), ref: 004026B4
GetProcAddress.KERNEL32(00000000,FlsSetValue), ref: 004026C1
GetProcAddress.KERNEL32(00000000,FlsFree), ref: 004026CE
TlsAlloc.KERNEL32 ref: 0040271E
TlsSetValue.KERNEL32(00000000), ref: 00402739
__init_pointers.LIBCMT ref: 00402743
__calloc_crt.LIBCMT ref: 004027B8
GetCurrentThreadId.KERNEL32 ref: 004027E8

Strings

FlsFree, xrefs: 004026C3
KERNEL32.DLL, xrefs: 00402680
FlsGetValue, xrefs: 004026A9
FlsSetValue, xrefs: 004026B6
FlsAlloc, xrefs: 004026A1

Memory Dump Source

Source File: 00000019.00000002.2406935891.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000019.00000002.2406895102.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000019.00000002.2406977537.0000000000408000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000019.00000002.2407008193.000000000040A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000019.00000002.2407030372.000000000040C000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_400000_nfregdrv.jbxd

Similarity

API ID: AddressProc$CriticalDeleteSection$AllocCurrentFreeHandleModuleThreadValue__calloc_crt__init_pointers__mtterm
String ID: FlsAlloc$FlsFree$FlsGetValue$FlsSetValue$KERNEL32.DLL
API String ID: 2125014093-3819984048
Opcode ID: 566b6117ed883b32ce1da04161b31b8634341426bd229c3b9e021c861b04e7bb
Instruction ID: cf69b49cc4cf955eeb84bbbee0c69ed19c09a43a9505152bb4945c0e988a6b5c
Opcode Fuzzy Hash: 566b6117ed883b32ce1da04161b31b8634341426bd229c3b9e021c861b04e7bb
Instruction Fuzzy Hash: EF313931900311DADB51AB75AF49A063BA4EB44354B10053FE994B72F2DFB98540DF9E

Function 10017590 Relevance: 28.7, APIs: 19, Instructions: 204filesynchronizationCOMMON

Download Yara Rule

APIs

SetEvent.KERNEL32(FFFFFFFF), ref: 100175B7

Part of subcall function 100013F0: ResetEvent.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,100175DD,10020370), ref: 100013FC
Part of subcall function 100013F0: GetSystemInfo.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,100175DD,10020370), ref: 10001411

EnterCriticalSection.KERNEL32(100203D8,100203F0,10020370), ref: 10017613
LeaveCriticalSection.KERNEL32(100203D8), ref: 10017621
ReadFile.KERNEL32(FFFFFFFF,?,00000008,00000000,?), ref: 10017661
GetLastError.KERNEL32 ref: 1001766B
WaitForMultipleObjects.KERNEL32(00000002,?,00000000,0000000A), ref: 1001768B
EnterCriticalSection.KERNEL32(100203D8), ref: 100176B7
LeaveCriticalSection.KERNEL32(100203D8), ref: 100176C4
SetEvent.KERNEL32(?), ref: 100176D9
SetEvent.KERNEL32(?), ref: 100176ED
WaitForMultipleObjects.KERNEL32(00000002,?,00000000,00001388), ref: 10017700
WaitForSingleObject.KERNEL32(FFFFFFFF,00000000), ref: 10017719
GetOverlappedResult.KERNEL32(FFFFFFFF,?,?,00000000), ref: 10017739
EnterCriticalSection.KERNEL32(100203D8), ref: 100177F0
LeaveCriticalSection.KERNEL32(100203D8), ref: 100177FD
SetEvent.KERNEL32(?), ref: 10017812
SetEvent.KERNEL32(?), ref: 10017826
CancelIo.KERNEL32(FFFFFFFF), ref: 10017847
SetEvent.KERNEL32(FFFFFFFF), ref: 10017868

Memory Dump Source

Source File: 00000019.00000002.2407428257.0000000010001000.00000020.00000001.01000000.0000000A.sdmp, Offset: 10000000, based on PE: true

Associated: 00000019.00000002.2407398545.0000000010000000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.2407457416.0000000010019000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.2407486723.000000001001E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.2407543255.0000000010022000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_10000000_nfregdrv.jbxd

Similarity

API ID: Event$CriticalSection$EnterLeaveWait$MultipleObjects$CancelErrorFileInfoLastObjectOverlappedReadResetResultSingleSystem
String ID:
API String ID: 2252100280-0
Opcode ID: e910f63d7a54be93efb29594c5c449f4169a1d0cc538782f8b68b19805b9bf9f
Instruction ID: f695dd025300f569b5dc1954a0fe927f0ea0d4c7cb43f690e196a72113c686ee
Opcode Fuzzy Hash: e910f63d7a54be93efb29594c5c449f4169a1d0cc538782f8b68b19805b9bf9f
Instruction Fuzzy Hash: 147180719093A19FE341DB64CCC4A5E7BFAFB88344F51881DF549CB262D630E945CB52

Function 10013790 Relevance: 28.2, APIs: 9, Strings: 7, Instructions: 156fileCOMMON

Download Yara Rule

APIs

__snprintf.LIBCMT ref: 100137C7
CreateFileA.KERNEL32(?,C0000000,00000000,00000000,00000003,40000000,00000000,?,?,?,?,00000000), ref: 100137EF
GetLastError.KERNEL32(?,?,?,?,00000000), ref: 100137F9
CreateFileA.KERNEL32(?,C0000000,00000000,00000000,00000003,40000000,00000000,?,?,?,?,?,00000000), ref: 10013846
GetLastError.KERNEL32(?,?,?,?,?,00000000), ref: 1001384A
_memset.LIBCMT ref: 1001386F
GetVersionExA.KERNEL32 ref: 10013884
DeviceIoControl.KERNEL32(00000000,0022019C,00000000,00000000,?,00000004,?,00000000), ref: 100138A8
SetLastError.KERNEL32(?,?,?,?,?,00000000), ref: 10013975

Part of subcall function 10013540: OpenSCManagerA.ADVAPI32(00000000,00000000,000F003F), ref: 100135C3

Strings

aswstm, xrefs: 10013955
%s%s, xrefs: 100137AD
\\.\CtrlSM, xrefs: 100137A8
nisdrv, xrefs: 100138EE
360netmon, xrefs: 10013903
symnets, xrefs: 10013914
aswstm, xrefs: 100138B8

Memory Dump Source

Source File: 00000019.00000002.2407428257.0000000010001000.00000020.00000001.01000000.0000000A.sdmp, Offset: 10000000, based on PE: true

Associated: 00000019.00000002.2407398545.0000000010000000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.2407457416.0000000010019000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.2407486723.000000001001E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.2407543255.0000000010022000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_10000000_nfregdrv.jbxd

Similarity

API ID: ErrorLast$CreateFile$ControlDeviceManagerOpenVersion__snprintf_memset
String ID: %s%s$360netmon$\\.\CtrlSM$aswstm$aswstm$nisdrv$symnets
API String ID: 3009835240-779568551
Opcode ID: a3a7f9f4621a4370de1945aa5ff1c6f54205322984f1227c5b51e51712c71830
Instruction ID: baa3f68826ae7ef6a95450bd968b4d24564606f9d9b479f6fa913fa53dd98394
Opcode Fuzzy Hash: a3a7f9f4621a4370de1945aa5ff1c6f54205322984f1227c5b51e51712c71830
Instruction Fuzzy Hash: B641F6F5904341ABE610DB649C82F9B77E8EB81758F00852DF6456A1C2EB71E9C8C763

Function 10012E20 Relevance: 22.9, APIs: 9, Strings: 4, Instructions: 110registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000002,SYSTEM\CurrentControlSet\Control\GroupOrderList,00000000,00000003,?,?,00000001,?,?,00000000), ref: 10012E39
RegQueryValueExA.ADVAPI32(?,PNP_TDI,00000000,?,00000000,?,00000000), ref: 10012E70
RegCloseKey.ADVAPI32(?,?,?,?,?,?,?,?,?,?,00000001), ref: 10012E7B

Strings

SYSTEM\CurrentControlSet\Control\GroupOrderList, xrefs: 10012E2F
PNP_TDI, xrefs: 10012EBD
PNP_TDI, xrefs: 10012E6A
PNP_TDI, xrefs: 10012F12

Memory Dump Source

Source File: 00000019.00000002.2407428257.0000000010001000.00000020.00000001.01000000.0000000A.sdmp, Offset: 10000000, based on PE: true

Associated: 00000019.00000002.2407398545.0000000010000000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.2407457416.0000000010019000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.2407486723.000000001001E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.2407543255.0000000010022000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_10000000_nfregdrv.jbxd

Similarity

API ID: CloseOpenQueryValue
String ID: PNP_TDI$PNP_TDI$PNP_TDI$SYSTEM\CurrentControlSet\Control\GroupOrderList
API String ID: 3677997916-2641009432
Opcode ID: 2eb10eaa1c7938493b03d9852b263a48069f7a2f456ef6b17a8b5cbc44dafcf6
Instruction ID: adba37e169228668f0a2802fe9bc245960bfac646b6212eb4cbe9f041a721e83
Opcode Fuzzy Hash: 2eb10eaa1c7938493b03d9852b263a48069f7a2f456ef6b17a8b5cbc44dafcf6
Instruction Fuzzy Hash: 6531A1B6500311ABE711DB64EC86FDB77E8EF48641F504428F649D7240E730E854C7A1

Function 10013020 Relevance: 22.8, APIs: 6, Strings: 7, Instructions: 88registryCOMMON

Download Yara Rule

APIs

__snprintf.LIBCMT ref: 10013094
RegOpenKeyExA.ADVAPI32(80000002,?,00000000,00000003,?,?,?,?,?), ref: 100130AF
RegSetValueExA.ADVAPI32(?,Group,00000000,00000001,?,00000005), ref: 100130F6
RegSetValueExA.ADVAPI32(?,DependOnService,00000000,00000007,?,00000007), ref: 1001310D
RegCloseKey.ADVAPI32(?), ref: 10013133

Strings

DependOnService, xrefs: 10013107
PNP_TDI, xrefs: 10013063
Group, xrefs: 100130F0
SYSTEM\CurrentControlSet\Services\%s, xrefs: 10013073
Group, xrefs: 10013120
tcpip, xrefs: 10013057
NDIS, xrefs: 1001303A

Memory Dump Source

Source File: 00000019.00000002.2407428257.0000000010001000.00000020.00000001.01000000.0000000A.sdmp, Offset: 10000000, based on PE: true

Associated: 00000019.00000002.2407398545.0000000010000000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.2407457416.0000000010019000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.2407486723.000000001001E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.2407543255.0000000010022000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_10000000_nfregdrv.jbxd

Similarity

API ID: Value$CloseOpen__snprintf
String ID: DependOnService$Group$Group$NDIS$PNP_TDI$SYSTEM\CurrentControlSet\Services\%s$tcpip
API String ID: 1654562893-4206996638
Opcode ID: 8e36c738326b6755c6e6de9151109be2b92cdf69e4b2cd075e3ef94430a67263
Instruction ID: f39133bfa4f10865251ae0e01663f88c1eeb0859d6cfe85fe8bdc8d9a42c57b8
Opcode Fuzzy Hash: 8e36c738326b6755c6e6de9151109be2b92cdf69e4b2cd075e3ef94430a67263
Instruction Fuzzy Hash: AF316675618350AFE715CB64CC91FAB77E5AB8D710F40C80CF68897290EA74E984CBD2

Function 1000EA12 Relevance: 21.2, APIs: 8, Strings: 4, Instructions: 164libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(USER32.DLL,00000000,00000000,00000314,?,?,?,1001F3B0,1000A694,1001F3B0,Microsoft Visual C++ Runtime Library,00012010), ref: 1000EA3F
GetProcAddress.KERNEL32(00000000,MessageBoxA), ref: 1000EA5B

Part of subcall function 1000A8A7: TlsGetValue.KERNEL32(00000000,1000A91C,00000000,1000EA20,00000000,00000000,00000314,?,?,?,1001F3B0,1000A694,1001F3B0,Microsoft Visual C++ Runtime Library,00012010), ref: 1000A8B4
Part of subcall function 1000A8A7: TlsGetValue.KERNEL32(00000002,?,?,?,1001F3B0,1000A694,1001F3B0,Microsoft Visual C++ Runtime Library,00012010), ref: 1000A8CB

GetProcAddress.KERNEL32(00000000,00000000), ref: 1000EA78

Part of subcall function 1000A8A7: GetModuleHandleA.KERNEL32(KERNEL32.DLL,?,?,?,1001F3B0,1000A694,1001F3B0,Microsoft Visual C++ Runtime Library,00012010), ref: 1000A8E0
Part of subcall function 1000A8A7: GetProcAddress.KERNEL32(00000000,EncodePointer), ref: 1000A8FB

GetProcAddress.KERNEL32(00000000,00000000), ref: 1000EA8D
__invoke_watson.LIBCMT ref: 1000EAAE

Part of subcall function 100081EF: _memset.LIBCMT ref: 1000827B
Part of subcall function 100081EF: IsDebuggerPresent.KERNEL32(?,?,00000000), ref: 10008299
Part of subcall function 100081EF: SetUnhandledExceptionFilter.KERNEL32(00000000,?,?,00000000), ref: 100082A3
Part of subcall function 100081EF: UnhandledExceptionFilter.KERNEL32(1001F3B0,?,?,00000000), ref: 100082AD
Part of subcall function 100081EF: GetCurrentProcess.KERNEL32(C000000D,?,?,00000000), ref: 100082C8
Part of subcall function 100081EF: TerminateProcess.KERNEL32(00000000,?,?,00000000), ref: 100082CF

Part of subcall function 1000A91E: TlsGetValue.KERNEL32(?,1000ACF2,00000000,00000000,10008BC3,00000000,?,?,00000001,?,?,10008C27,00000001,?,?,1001B608), ref: 1000A92B
Part of subcall function 1000A91E: TlsGetValue.KERNEL32(00000002,?,1000ACF2,00000000,00000000,10008BC3,00000000,?,?,00000001,?,?,10008C27,00000001), ref: 1000A942

Part of subcall function 1000A91E: GetModuleHandleA.KERNEL32(KERNEL32.DLL,?,1000ACF2,00000000,00000000,10008BC3,00000000,?,?,00000001,?,?,10008C27,00000001), ref: 1000A957
Part of subcall function 1000A91E: GetProcAddress.KERNEL32(00000000,DecodePointer), ref: 1000A972

GetProcAddress.KERNEL32(00000000,GetUserObjectInformationA), ref: 1000EAC2
GetProcAddress.KERNEL32(00000000,GetProcessWindowStation), ref: 1000EADA
__invoke_watson.LIBCMT ref: 1000EB4D

Strings

USER32.DLL, xrefs: 1000EA3A
GetUserObjectInformationA, xrefs: 1000EABC
MessageBoxA, xrefs: 1000EA55
GetProcessWindowStation, xrefs: 1000EAD4

Memory Dump Source

Source File: 00000019.00000002.2407428257.0000000010001000.00000020.00000001.01000000.0000000A.sdmp, Offset: 10000000, based on PE: true

Associated: 00000019.00000002.2407398545.0000000010000000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.2407457416.0000000010019000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.2407486723.000000001001E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.2407543255.0000000010022000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_10000000_nfregdrv.jbxd

Similarity

API ID: AddressProc$Value$ExceptionFilterHandleModuleProcessUnhandled__invoke_watson$CurrentDebuggerLibraryLoadPresentTerminate_memset
String ID: GetProcessWindowStation$GetUserObjectInformationA$MessageBoxA$USER32.DLL
API String ID: 2940365033-1046234306
Opcode ID: d07f4621edcdfa6a2460bf8fc81f84a922532c73ec9128826bd03ea427b93a6a
Instruction ID: 9cd623b29455d8c5ce966f6a502c8aefc0998dc8575b976e3ae0cba05518725e
Opcode Fuzzy Hash: d07f4621edcdfa6a2460bf8fc81f84a922532c73ec9128826bd03ea427b93a6a
Instruction Fuzzy Hash: 0D418C75D04299AAFF04EFA4CCC596E7BE9EF153C0B11452EE402F2155DB38EA848B62

Function 00403474 Relevance: 21.2, APIs: 8, Strings: 4, Instructions: 164libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(USER32.DLL,00000000,00000000,00000314,?,?,?,0040B040,00401917,0040B040,Microsoft Visual C++ Runtime Library,00012010), ref: 004034A1
GetProcAddress.KERNEL32(00000000,MessageBoxA), ref: 004034BD

Part of subcall function 004022B3: TlsGetValue.KERNEL32(00000000,00402328,00000000,00403482,00000000,00000000,00000314,?,?,?,0040B040,00401917,0040B040,Microsoft Visual C++ Runtime Library,00012010), ref: 004022C0
Part of subcall function 004022B3: TlsGetValue.KERNEL32(00000006,?,?,?,0040B040,00401917,0040B040,Microsoft Visual C++ Runtime Library,00012010), ref: 004022D7

GetProcAddress.KERNEL32(00000000,00000000), ref: 004034DA

Part of subcall function 004022B3: GetModuleHandleA.KERNEL32(KERNEL32.DLL,?,?,?,0040B040,00401917,0040B040,Microsoft Visual C++ Runtime Library,00012010), ref: 004022EC
Part of subcall function 004022B3: GetProcAddress.KERNEL32(00000000,EncodePointer), ref: 00402307

GetProcAddress.KERNEL32(00000000,00000000), ref: 004034EF
__invoke_watson.LIBCMT ref: 00403510

Part of subcall function 00402D4D: IsDebuggerPresent.KERNEL32(?,?,00000000), ref: 00402DF7
Part of subcall function 00402D4D: SetUnhandledExceptionFilter.KERNEL32(00000000,?,?,00000000), ref: 00402E01
Part of subcall function 00402D4D: UnhandledExceptionFilter.KERNEL32(0040B040,?,?,00000000), ref: 00402E0B
Part of subcall function 00402D4D: GetCurrentProcess.KERNEL32(C000000D,?,?,00000000), ref: 00402E26
Part of subcall function 00402D4D: TerminateProcess.KERNEL32(00000000,?,?,00000000), ref: 00402E2D

Part of subcall function 0040232A: TlsGetValue.KERNEL32(00000000,004023BF,?,004024E4,?,?,0040199A), ref: 00402337
Part of subcall function 0040232A: TlsGetValue.KERNEL32(00000006,?,004024E4,?,?,0040199A), ref: 0040234E

Part of subcall function 0040232A: GetModuleHandleA.KERNEL32(KERNEL32.DLL,?,004024E4,?,?,0040199A), ref: 00402363
Part of subcall function 0040232A: GetProcAddress.KERNEL32(00000000,DecodePointer), ref: 0040237E

GetProcAddress.KERNEL32(00000000,GetUserObjectInformationA), ref: 00403524
GetProcAddress.KERNEL32(00000000,GetProcessWindowStation), ref: 0040353C
__invoke_watson.LIBCMT ref: 004035AF

Strings

GetUserObjectInformationA, xrefs: 0040351E
MessageBoxA, xrefs: 004034B7
GetProcessWindowStation, xrefs: 00403536
USER32.DLL, xrefs: 0040349C

Memory Dump Source

Source File: 00000019.00000002.2406935891.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000019.00000002.2406895102.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000019.00000002.2406977537.0000000000408000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000019.00000002.2407008193.000000000040A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000019.00000002.2407030372.000000000040C000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_400000_nfregdrv.jbxd

Similarity

API ID: AddressProc$Value$ExceptionFilterHandleModuleProcessUnhandled__invoke_watson$CurrentDebuggerLibraryLoadPresentTerminate
String ID: GetProcessWindowStation$GetUserObjectInformationA$MessageBoxA$USER32.DLL
API String ID: 2691309996-1046234306
Opcode ID: f1db5f22bdf6dbb55a5fef3c5404ea4e20a60e7af2fc674b508acf6c650a639d
Instruction ID: 13767e751e4e8118919b7ef88e5ef330d54a0fa0e132c7187f46cb55eadbc1d1
Opcode Fuzzy Hash: f1db5f22bdf6dbb55a5fef3c5404ea4e20a60e7af2fc674b508acf6c650a639d
Instruction Fuzzy Hash: FC416271D04205BACF21AFE59E8596F7FACEB44356B14487FE401F22D0DBBD8A408A9D

Function 10017AB0 Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 161COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32 ref: 10017AF0
LeaveCriticalSection.KERNEL32(1002030C), ref: 10017CE3

Part of subcall function 10012D70: RegOpenKeyExA.KERNELBASE(80000002,SYSTEM\CurrentControlSet\Services\Tcpip6\Parameters,00000000,00000003,?,?,?,10013525,00000000), ref: 10012D86

Part of subcall function 10012D00: RegOpenKeyExA.KERNELBASE(80000002,SYSTEM\CurrentControlSet\Services\Tcpip\Parameters,00000000,00000002,00000000,00000000,00000000), ref: 10012D15

Part of subcall function 10013790: __snprintf.LIBCMT ref: 100137C7
Part of subcall function 10013790: CreateFileA.KERNEL32(?,C0000000,00000000,00000000,00000003,40000000,00000000,?,?,?,?,00000000), ref: 100137EF
Part of subcall function 10013790: GetLastError.KERNEL32(?,?,?,?,00000000), ref: 100137F9
Part of subcall function 10013790: CreateFileA.KERNEL32(?,C0000000,00000000,00000000,00000003,40000000,00000000,?,?,?,?,?,00000000), ref: 10013846
Part of subcall function 10013790: GetLastError.KERNEL32(?,?,?,?,?,00000000), ref: 1001384A
Part of subcall function 10013790: _memset.LIBCMT ref: 1001386F
Part of subcall function 10013790: GetVersionExA.KERNEL32 ref: 10013884
Part of subcall function 10013790: DeviceIoControl.KERNEL32(00000000,0022019C,00000000,00000000,?,00000004,?,00000000), ref: 100138A8

_strncpy.LIBCMT ref: 10017B59
CreateEventA.KERNEL32(00000000,00000000,00000000,00000000), ref: 10017B93
DeviceIoControl.KERNEL32(FFFFFFFF,0012C800,00000000,00000000,10020180,00000020,00000000,?), ref: 10017BD9
GetLastError.KERNEL32 ref: 10017BE3
CloseHandle.KERNEL32(FFFFFFFF), ref: 10017C01
CloseHandle.KERNEL32(00000000), ref: 10017C13
LeaveCriticalSection.KERNEL32(1002030C), ref: 10017C1A
GetOverlappedResult.KERNEL32(FFFFFFFF,?,?,00000001), ref: 10017C48
?nf_free@nfapi@@YAXXZ.NFAPI ref: 10017CC2

Strings

, xrefs: 10017C52

Memory Dump Source

Source File: 00000019.00000002.2407428257.0000000010001000.00000020.00000001.01000000.0000000A.sdmp, Offset: 10000000, based on PE: true

Associated: 00000019.00000002.2407398545.0000000010000000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.2407457416.0000000010019000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.2407486723.000000001001E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.2407543255.0000000010022000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_10000000_nfregdrv.jbxd

Similarity

API ID: CreateCriticalErrorLastSection$CloseControlDeviceFileHandleLeaveOpen$?nf_free@nfapi@@EnterEventOverlappedResultVersion__snprintf_memset_strncpy
String ID:
API String ID: 2653159964-3916222277
Opcode ID: 3f87b7c55b4061039f33afb2760d837fa2a97d9a8f10da4fd9a74bcaa174a95a
Instruction ID: 607d77e5ab761dd3358ab37ac97749732553c8b829fe0467e4f2801d9018e119
Opcode Fuzzy Hash: 3f87b7c55b4061039f33afb2760d837fa2a97d9a8f10da4fd9a74bcaa174a95a
Instruction Fuzzy Hash: 3F51C0B08043549FE341CF38CCC565A7BE9FB08364F60462DF559DB2A2D735DA858B92

Function 10014CF0 Relevance: 18.2, APIs: 12, Instructions: 157fileCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(10020324), ref: 10014D6E
WriteFile.KERNEL32(FFFFFFFF,?,00000008,00000000,?), ref: 10014DF8
GetLastError.KERNEL32 ref: 10014E02
LeaveCriticalSection.KERNEL32(10020324), ref: 10014E14

Memory Dump Source

Source File: 00000019.00000002.2407428257.0000000010001000.00000020.00000001.01000000.0000000A.sdmp, Offset: 10000000, based on PE: true

Associated: 00000019.00000002.2407398545.0000000010000000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.2407457416.0000000010019000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.2407486723.000000001001E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.2407543255.0000000010022000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_10000000_nfregdrv.jbxd

Similarity

API ID: CriticalSection$EnterErrorFileLastLeaveWrite
String ID:
API String ID: 1726892732-0
Opcode ID: 9df71c563617eb9f339eaef5488ee90d51df01b4ebf1fcf1fc522e00c65f13bd
Instruction ID: e6d18f47d42f15309a32aad744ee6051ace0a6f11929ee79e8724ce5300da237
Opcode Fuzzy Hash: 9df71c563617eb9f339eaef5488ee90d51df01b4ebf1fcf1fc522e00c65f13bd
Instruction Fuzzy Hash: 14515971A043219FD304CF68EC84A66B7E9FB88720F118A5EF959CB2A1DB30D9458B91

Function 10014ED0 Relevance: 18.1, APIs: 12, Instructions: 116filesynchronizationCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(10020324,?,?,?,?,?,?,?,?,?,1001536D), ref: 10014F3F
WriteFile.KERNEL32(FFFFFFFF,?,00000008,00000000,?), ref: 10014F8F
GetLastError.KERNEL32 ref: 10014F99
LeaveCriticalSection.KERNEL32(10020324), ref: 10014FAB
WaitForMultipleObjects.KERNEL32(00000002,?,00000000,000000FF), ref: 10014FC6
CancelIo.KERNEL32(FFFFFFFF), ref: 10014FD7
LeaveCriticalSection.KERNEL32(10020324), ref: 10014FE2
WaitForSingleObject.KERNEL32(FFFFFFFF,00000000), ref: 10014FF9
CancelIo.KERNEL32(FFFFFFFF), ref: 10015009
LeaveCriticalSection.KERNEL32(10020324), ref: 10015014
GetOverlappedResult.KERNEL32(FFFFFFFF,?,?,00000000), ref: 1001502F
LeaveCriticalSection.KERNEL32(10020324), ref: 1001504B

Memory Dump Source

Source File: 00000019.00000002.2407428257.0000000010001000.00000020.00000001.01000000.0000000A.sdmp, Offset: 10000000, based on PE: true

Associated: 00000019.00000002.2407398545.0000000010000000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.2407457416.0000000010019000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.2407486723.000000001001E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.2407543255.0000000010022000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_10000000_nfregdrv.jbxd

Similarity

API ID: CriticalSection$Leave$CancelWait$EnterErrorFileLastMultipleObjectObjectsOverlappedResultSingleWrite
String ID:
API String ID: 875271372-0
Opcode ID: 4956b33f9505844bcca6f3e2d83279b108e1b3c573e129efff33a3fba19fd776
Instruction ID: 56031a59c6608db13f70e1c4f4aa1c6cc63b7cc0fadcfe5918aabc4c2d2b60d1
Opcode Fuzzy Hash: 4956b33f9505844bcca6f3e2d83279b108e1b3c573e129efff33a3fba19fd776
Instruction Fuzzy Hash: B3418E359043209FE305CF68CCC5A6A77E5FB88760F51CA1DF9A9CA2A1DB30D9458B92

Function 1000AA38 Relevance: 15.8, APIs: 6, Strings: 3, Instructions: 49libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(KERNEL32.DLL,1001B668,0000000C,1000AB49,00000000,00000000,?,?,?,1000A968,?,1000ACF2,00000000,00000000,10008BC3,00000000), ref: 1000AA49
GetProcAddress.KERNEL32(?,EncodePointer), ref: 1000AA7D
GetProcAddress.KERNEL32(?,DecodePointer), ref: 1000AA8D
InterlockedIncrement.KERNEL32(1001E5E0), ref: 1000AAAF
__lock.LIBCMT ref: 1000AAB7
___addlocaleref.LIBCMT ref: 1000AAD6

Strings

KERNEL32.DLL, xrefs: 1000AA44
EncodePointer, xrefs: 1000AA6F
DecodePointer, xrefs: 1000AA85

Memory Dump Source

Source File: 00000019.00000002.2407428257.0000000010001000.00000020.00000001.01000000.0000000A.sdmp, Offset: 10000000, based on PE: true

Associated: 00000019.00000002.2407398545.0000000010000000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.2407457416.0000000010019000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.2407486723.000000001001E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.2407543255.0000000010022000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_10000000_nfregdrv.jbxd

Similarity

API ID: AddressProc$HandleIncrementInterlockedModule___addlocaleref__lock
String ID: DecodePointer$EncodePointer$KERNEL32.DLL
API String ID: 1036688887-2843748187
Opcode ID: 6cb8d5c28d5074f433760f6667332ab0361c674de9d04a8c3266a8bd50229b50
Instruction ID: bcf2beea3aee41d2aa15f995c6c6d73addff0134c8f7c4ab08a319bce46e109a
Opcode Fuzzy Hash: 6cb8d5c28d5074f433760f6667332ab0361c674de9d04a8c3266a8bd50229b50
Instruction Fuzzy Hash: 9F116DB49007469FEB11DF75CC45B9ABBE0EF06380F008519E5A59B291DB34EA80CB11

Function 00402410 Relevance: 15.8, APIs: 6, Strings: 3, Instructions: 49libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(KERNEL32.DLL,00409438,0000000C,00402521,00000000,00000000,?,?,0040199A), ref: 00402421
GetProcAddress.KERNEL32(?,EncodePointer), ref: 00402455
GetProcAddress.KERNEL32(?,DecodePointer), ref: 00402465
InterlockedIncrement.KERNEL32(0040A460), ref: 00402487
__lock.LIBCMT ref: 0040248F
___addlocaleref.LIBCMT ref: 004024AE

Strings

EncodePointer, xrefs: 00402447
KERNEL32.DLL, xrefs: 0040241C
DecodePointer, xrefs: 0040245D

Memory Dump Source

Source File: 00000019.00000002.2406935891.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000019.00000002.2406895102.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000019.00000002.2406977537.0000000000408000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000019.00000002.2407008193.000000000040A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000019.00000002.2407030372.000000000040C000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_400000_nfregdrv.jbxd

Similarity

API ID: AddressProc$HandleIncrementInterlockedModule___addlocaleref__lock
String ID: DecodePointer$EncodePointer$KERNEL32.DLL
API String ID: 1036688887-2843748187
Opcode ID: 492f236ed60c7165788bb238f70ef5b424b799d510fd4f5d693c5339c7311626
Instruction ID: c1e121c7a9f45585e2cf3b5064cbb5a882fb755c8da4f7f00742ea9dc2ffa3f8
Opcode Fuzzy Hash: 492f236ed60c7165788bb238f70ef5b424b799d510fd4f5d693c5339c7311626
Instruction Fuzzy Hash: C41182719407019ED710AF75DA49B5ABBE4EF44314F10853EE495B32D1CBBC9900CF19

Function 10015FC0 Relevance: 13.7, APIs: 9, Instructions: 239COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?), ref: 10015FFC
LeaveCriticalSection.KERNEL32(1002030C,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 10016018
LeaveCriticalSection.KERNEL32(1002030C), ref: 10016046

Memory Dump Source

Source File: 00000019.00000002.2407428257.0000000010001000.00000020.00000001.01000000.0000000A.sdmp, Offset: 10000000, based on PE: true

Associated: 00000019.00000002.2407398545.0000000010000000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.2407457416.0000000010019000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.2407486723.000000001001E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.2407543255.0000000010022000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_10000000_nfregdrv.jbxd

Similarity

API ID: CriticalSection$Leave$Enter
String ID:
API String ID: 2978645861-0
Opcode ID: 40f431bcfea2067bdb45210c7ca3e5ac481c5a134223d9d1211dde7a8a90e341
Instruction ID: 371fddef53dbc4fe45c556ef6c540f006288db7d7992a80969627ba83df88eb7
Opcode Fuzzy Hash: 40f431bcfea2067bdb45210c7ca3e5ac481c5a134223d9d1211dde7a8a90e341
Instruction Fuzzy Hash: C191A875A047009FD321CF28CD80A1AB7E5FF88750F418A6DF94A8B252D735E944CB92

Function 10013240 Relevance: 12.5, APIs: 3, Strings: 4, Instructions: 207registryCOMMON

Download Yara Rule

APIs

Part of subcall function 10012F40: __snprintf.LIBCMT ref: 10012F6E
Part of subcall function 10012F40: RegOpenKeyExA.KERNELBASE(80000002,?,00000000,00000003,?,?,?,?,?), ref: 10012F89

Part of subcall function 10012E20: RegOpenKeyExA.ADVAPI32(80000002,SYSTEM\CurrentControlSet\Control\GroupOrderList,00000000,00000003,?,?,00000001,?,?,00000000), ref: 10012E39

RegOpenKeyExA.ADVAPI32(80000002,SYSTEM\CurrentControlSet\Control\GroupOrderList,00000000,00000003,?), ref: 1001343E
RegSetValueExA.ADVAPI32(?,PNP_TDI,00000000,00000003,?,00000004), ref: 10013471
RegCloseKey.ADVAPI32(?,?,?,?,?,?,?,?,?,?,?,?,00000001), ref: 1001347C

Strings

Tdx, xrefs: 1001335F
Tcpip, xrefs: 10013376
SYSTEM\CurrentControlSet\Control\GroupOrderList, xrefs: 10013434
PNP_TDI, xrefs: 1001346B

Memory Dump Source

Source File: 00000019.00000002.2407428257.0000000010001000.00000020.00000001.01000000.0000000A.sdmp, Offset: 10000000, based on PE: true

Associated: 00000019.00000002.2407398545.0000000010000000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.2407457416.0000000010019000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.2407486723.000000001001E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.2407543255.0000000010022000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_10000000_nfregdrv.jbxd

Similarity

API ID: Open$CloseValue__snprintf
String ID: PNP_TDI$SYSTEM\CurrentControlSet\Control\GroupOrderList$Tcpip$Tdx
API String ID: 955868693-1105926044
Opcode ID: fda263ff1de41ce67b71e2831dee39c8819067ff8ff0548a34e60e809be7e6e4
Instruction ID: 9d99394d333599788a4544cf258fe4bbb44c0789f27ec8b116fc68fb94e8051e
Opcode Fuzzy Hash: fda263ff1de41ce67b71e2831dee39c8819067ff8ff0548a34e60e809be7e6e4
Instruction Fuzzy Hash: 236107715003019BC711DF28C881B9BB7E5FB81794F508B2CF9A59B181E732FA9AC792

Function 10003970 Relevance: 12.3, APIs: 8, Instructions: 344COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32 ref: 100039B6
EnterCriticalSection.KERNEL32(10020168), ref: 10003C89
LeaveCriticalSection.KERNEL32(10020168), ref: 10003CBA
_malloc.LIBCMT ref: 10003CBE
LeaveCriticalSection.KERNEL32(?), ref: 10003CDD
LeaveCriticalSection.KERNEL32(10020168), ref: 10003D10
LeaveCriticalSection.KERNEL32(?), ref: 10003D80
LeaveCriticalSection.KERNEL32(1001AF8C), ref: 10003DA0

Memory Dump Source

Source File: 00000019.00000002.2407428257.0000000010001000.00000020.00000001.01000000.0000000A.sdmp, Offset: 10000000, based on PE: true

Associated: 00000019.00000002.2407398545.0000000010000000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.2407457416.0000000010019000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.2407486723.000000001001E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.2407543255.0000000010022000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_10000000_nfregdrv.jbxd

Similarity

API ID: CriticalSection$Leave$Enter$_malloc
String ID:
API String ID: 2624469294-0
Opcode ID: 73d3a381d48c90c82b24558e07d01c406c18051549b067fe898d807a957dde11
Instruction ID: cb4e14372f68c81d32fb7b051c2ec7f8ea7fe710ba1d4691e8c8f5f753e74d5d
Opcode Fuzzy Hash: 73d3a381d48c90c82b24558e07d01c406c18051549b067fe898d807a957dde11
Instruction Fuzzy Hash: 84D147755043459FE721EF24C98095AB7E9FF88790F02C91DE8999B249DB31FA00CFA2

Function 10002EF0 Relevance: 12.3, APIs: 8, Instructions: 344COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32 ref: 10002F36
EnterCriticalSection.KERNEL32(10020168), ref: 10003209
LeaveCriticalSection.KERNEL32(10020168), ref: 1000323A
_malloc.LIBCMT ref: 1000323E
LeaveCriticalSection.KERNEL32(?), ref: 1000325D
LeaveCriticalSection.KERNEL32(10020168), ref: 10003290
LeaveCriticalSection.KERNEL32(?), ref: 10003300
LeaveCriticalSection.KERNEL32(1001AF8C), ref: 10003320

Memory Dump Source

Source File: 00000019.00000002.2407428257.0000000010001000.00000020.00000001.01000000.0000000A.sdmp, Offset: 10000000, based on PE: true

Associated: 00000019.00000002.2407398545.0000000010000000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.2407457416.0000000010019000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.2407486723.000000001001E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.2407543255.0000000010022000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_10000000_nfregdrv.jbxd

Similarity

API ID: CriticalSection$Leave$Enter$_malloc
String ID:
API String ID: 2624469294-0
Opcode ID: 6e5e0db70783d2082ef5619a72b906c060462fccdc8a4732c9d5e6cd8a7c2023
Instruction ID: 7535f423654ff115b8a10d663302ad89ce6d265461ec07cf54a4ab5d377fff5f
Opcode Fuzzy Hash: 6e5e0db70783d2082ef5619a72b906c060462fccdc8a4732c9d5e6cd8a7c2023
Instruction Fuzzy Hash: 35D159755043459FE721DF54C98095AB7E9FF88790F12CA2DE8998B249DB30FA00CFA2

Function 10015980 Relevance: 12.1, APIs: 8, Instructions: 98COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(1002030C,?,?,?,?,?,10015F9A,?,?,?,?,00000000,00000000), ref: 10015994
LeaveCriticalSection.KERNEL32(1002030C,?,?,?,10015F9A,?,?,?,?,00000000,00000000), ref: 100159AA
EnterCriticalSection.KERNEL32(10020168,?,?,?,10015F9A,?,?,?,?,00000000,00000000), ref: 100159BD
LeaveCriticalSection.KERNEL32(10020168,?,?,?,10015F9A,?,?,?,?,00000000,00000000), ref: 100159EA
_malloc.LIBCMT ref: 100159EE
LeaveCriticalSection.KERNEL32(1002030C), ref: 10015A0D

Memory Dump Source

Source File: 00000019.00000002.2407428257.0000000010001000.00000020.00000001.01000000.0000000A.sdmp, Offset: 10000000, based on PE: true

Associated: 00000019.00000002.2407398545.0000000010000000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.2407457416.0000000010019000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.2407486723.000000001001E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.2407543255.0000000010022000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_10000000_nfregdrv.jbxd

Similarity

API ID: CriticalSection$Leave$Enter$_malloc
String ID:
API String ID: 2624469294-0
Opcode ID: 83a868a5a413f7be5035703166637c7b296de766c062b8faf5188e187a6a0587
Instruction ID: 716dd50c4406e69af5a644168b3a8d86a91ffbed9d73fa53db93a722c9a7554d
Opcode Fuzzy Hash: 83a868a5a413f7be5035703166637c7b296de766c062b8faf5188e187a6a0587
Instruction Fuzzy Hash: 86310972601315CFD711CF6CDC80999B7E6EF94262B6A822BF558CF251DB32D8448B92

Function 10015AA0 Relevance: 12.1, APIs: 8, Instructions: 98COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(1002030C,?,?,?,?,?,1001636E,?,00000000,?,?,00000000,00000000), ref: 10015AB4
LeaveCriticalSection.KERNEL32(1002030C,?,?,?,1001636E,?,00000000,?,?,00000000,00000000), ref: 10015ACA
EnterCriticalSection.KERNEL32(10020168,?,?,?,1001636E,?,00000000,?,?,00000000,00000000), ref: 10015ADD
LeaveCriticalSection.KERNEL32(10020168,?,?,?,1001636E,?,00000000,?,?,00000000,00000000), ref: 10015B0A
_malloc.LIBCMT ref: 10015B0E
LeaveCriticalSection.KERNEL32(1002030C), ref: 10015B2D

Memory Dump Source

Source File: 00000019.00000002.2407428257.0000000010001000.00000020.00000001.01000000.0000000A.sdmp, Offset: 10000000, based on PE: true

Associated: 00000019.00000002.2407398545.0000000010000000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.2407457416.0000000010019000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.2407486723.000000001001E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.2407543255.0000000010022000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_10000000_nfregdrv.jbxd

Similarity

API ID: CriticalSection$Leave$Enter$_malloc
String ID:
API String ID: 2624469294-0
Opcode ID: 0b1f382d706e44ec0e1a58c49b7b50b2d9c2de06ca5ddb6f4ca569de45bb812b
Instruction ID: 0036e264ff8d4791e783871741635e394cc451c67550918a7cfab00ff319ecfa
Opcode Fuzzy Hash: 0b1f382d706e44ec0e1a58c49b7b50b2d9c2de06ca5ddb6f4ca569de45bb812b
Instruction Fuzzy Hash: BC310B72641355CFD311CF2CDC80999B3E5EF94262B6A422BF559CF252DB32E8448B91

Function 10014B10 Relevance: 12.1, APIs: 8, Instructions: 88COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(1002030C), ref: 10014B16
LeaveCriticalSection.KERNEL32(1002030C), ref: 10014B2B
DeviceIoControl.KERNEL32(FFFFFFFF,002201BC,00000000,00000000,00000000,00000000,?,00000000), ref: 10014B54
LeaveCriticalSection.KERNEL32(1002030C), ref: 10014B5F

Memory Dump Source

Source File: 00000019.00000002.2407428257.0000000010001000.00000020.00000001.01000000.0000000A.sdmp, Offset: 10000000, based on PE: true

Associated: 00000019.00000002.2407398545.0000000010000000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.2407457416.0000000010019000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.2407486723.000000001001E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.2407543255.0000000010022000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_10000000_nfregdrv.jbxd

Similarity

API ID: CriticalSection$Leave$ControlDeviceEnter
String ID:
API String ID: 3744975357-0
Opcode ID: 02bb3fff05f25983f8711dfb826126a47c4f04985e71065dc7fb2bdb1fcbf30f
Instruction ID: 02a2f6b1c1c0d08758aff6957e8ee0c5b887a2a9afcc407cdac575b478d4874d
Opcode Fuzzy Hash: 02bb3fff05f25983f8711dfb826126a47c4f04985e71065dc7fb2bdb1fcbf30f
Instruction Fuzzy Hash: 2521E772359311BFF210CBA8ACC6F963399EB84F71F224609F715AA0D1DF70E8448666

Function 10014C00 Relevance: 12.1, APIs: 8, Instructions: 88COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(1002030C), ref: 10014C06
LeaveCriticalSection.KERNEL32(1002030C), ref: 10014C1B
DeviceIoControl.KERNEL32(FFFFFFFF,002201BC,00000000,00000000,00000000,00000000,?,00000000), ref: 10014C44
LeaveCriticalSection.KERNEL32(1002030C), ref: 10014C4F

Memory Dump Source

Source File: 00000019.00000002.2407428257.0000000010001000.00000020.00000001.01000000.0000000A.sdmp, Offset: 10000000, based on PE: true

Associated: 00000019.00000002.2407398545.0000000010000000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.2407457416.0000000010019000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.2407486723.000000001001E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.2407543255.0000000010022000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_10000000_nfregdrv.jbxd

Similarity

API ID: CriticalSection$Leave$ControlDeviceEnter
String ID:
API String ID: 3744975357-0
Opcode ID: 19f12ee8c8cf86aad4f1a8f5e61e85f259d81ceda6a06445ab1c933b9452340a
Instruction ID: 4bb90ba6e2ddb0c313f38f00bcf08c1032174cdcc12a3aad3dba23a14210028a
Opcode Fuzzy Hash: 19f12ee8c8cf86aad4f1a8f5e61e85f259d81ceda6a06445ab1c933b9452340a
Instruction Fuzzy Hash: 4A210872351311BFF210C7A8AC85F967399EB88F71F224608F7149A0D1DFB0E94486A5

Function 100179F0 Relevance: 12.1, APIs: 8, Instructions: 55synchronizationCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(1002030C,00000000,?,10017CBE), ref: 100179F9
ResetEvent.KERNEL32(FFFFFFFF,?,10017CBE), ref: 10017A2E
ResetEvent.KERNEL32(FFFFFFFF,?,10017CBE), ref: 10017A37
ResetEvent.KERNEL32(FFFFFFFF,?,10017CBE), ref: 10017A40
SetEvent.KERNEL32(FFFFFFFF), ref: 10017A67
LeaveCriticalSection.KERNEL32(1002030C,?,10017CBE), ref: 10017A7C
WaitForSingleObject.KERNEL32(FFFFFFFF,000000FF), ref: 10017A96
LeaveCriticalSection.KERNEL32(1002030C), ref: 10017AA1

Memory Dump Source

Source File: 00000019.00000002.2407428257.0000000010001000.00000020.00000001.01000000.0000000A.sdmp, Offset: 10000000, based on PE: true

Associated: 00000019.00000002.2407398545.0000000010000000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.2407457416.0000000010019000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.2407486723.000000001001E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.2407543255.0000000010022000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_10000000_nfregdrv.jbxd

Similarity

API ID: Event$CriticalResetSection$Leave$EnterObjectSingleWait
String ID:
API String ID: 227606595-0
Opcode ID: 0af12d4d274b4158eff6cb139f5dbd0a4003279a660a605caf6bf13278f8ed7d
Instruction ID: 370ae82c3914d7338aeaefb3dba61d6cd4c1daa1705ad23ed54f4bf6628b88f1
Opcode Fuzzy Hash: 0af12d4d274b4158eff6cb139f5dbd0a4003279a660a605caf6bf13278f8ed7d
Instruction Fuzzy Hash: 93115E729103719FF315DB648C88B5937A9EB4C761F21C319FA29861E1DB30D9418F91

Function 100169E0 Relevance: 10.8, APIs: 7, Instructions: 347COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32 ref: 10016A2B
GetTickCount.KERNEL32 ref: 10016B87
GetTickCount.KERNEL32 ref: 10016CFD
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,76EBFFB0,00000000), ref: 10017214
LeaveCriticalSection.KERNEL32(1002030C), ref: 1001721F

Memory Dump Source

Source File: 00000019.00000002.2407428257.0000000010001000.00000020.00000001.01000000.0000000A.sdmp, Offset: 10000000, based on PE: true

Associated: 00000019.00000002.2407398545.0000000010000000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.2407457416.0000000010019000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.2407486723.000000001001E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.2407543255.0000000010022000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_10000000_nfregdrv.jbxd

Similarity

API ID: CriticalSection$CountEnterTick$Leave
String ID:
API String ID: 1274362258-0
Opcode ID: ef1edd5c790a106658f1642739d45defef9679afc4e8f9f2e44516cc589d5311
Instruction ID: 3fd2e9f8bc7037484baf15cc0afc36f40eff77f3799c9f8376e09abcfaaf5b27
Opcode Fuzzy Hash: ef1edd5c790a106658f1642739d45defef9679afc4e8f9f2e44516cc589d5311
Instruction Fuzzy Hash: 9BD15775A04645EFDB10CF14CC80A9AB7F5FF88354F108529F9598B252EB34FA86CBA1

Function 1000F36B Relevance: 10.7, APIs: 7, Instructions: 158COMMONLIBRARYCODE

Download Yara Rule

APIs

getSystemCP.LIBCMT ref: 1000F384

Part of subcall function 1000F2F1: _LocaleUpdate::_LocaleUpdate.LIBCMT ref: 1000F2FE
Part of subcall function 1000F2F1: GetOEMCP.KERNEL32(00000000,?,1000D589,?,00000000,7591F380), ref: 1000F318

setSBCS.LIBCMT ref: 1000F396

Part of subcall function 1000F06E: _memset.LIBCMT ref: 1000F081

IsValidCodePage.KERNEL32(-00000030,00000000,?,00000000,1001B930), ref: 1000F3DC
GetCPInfo.KERNEL32(00000000,1000F6EE), ref: 1000F3EF
_memset.LIBCMT ref: 1000F407
setSBUpLow.LIBCMT ref: 1000F4DA

Memory Dump Source

Source File: 00000019.00000002.2407428257.0000000010001000.00000020.00000001.01000000.0000000A.sdmp, Offset: 10000000, based on PE: true

Associated: 00000019.00000002.2407398545.0000000010000000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.2407457416.0000000010019000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.2407486723.000000001001E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.2407543255.0000000010022000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_10000000_nfregdrv.jbxd

Similarity

API ID: Locale_memset$CodeInfoPageSystemUpdateUpdate::_Valid
String ID:
API String ID: 2658552758-0
Opcode ID: a816b4c44936828a5225c1a25b1e8420490dbca548ce3019b9a4bf18463ab438
Instruction ID: 2d63987005470fd1933f97c79db1aac5b43ce9987930df9b1300e43a0dccfd1d
Opcode Fuzzy Hash: a816b4c44936828a5225c1a25b1e8420490dbca548ce3019b9a4bf18463ab438
Instruction Fuzzy Hash: C25112719042568BEB15CF24C8802BFBBE4EF043C1F14846EED869B54AD638DA42EB91

Function 10015830 Relevance: 10.6, APIs: 7, Instructions: 95COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(1002030C), ref: 10015845
LeaveCriticalSection.KERNEL32(1002030C), ref: 10015855
LeaveCriticalSection.KERNEL32(1002030C), ref: 1001586D
EnterCriticalSection.KERNEL32(10020168), ref: 10015874
LeaveCriticalSection.KERNEL32(10020168), ref: 100158A4
_malloc.LIBCMT ref: 100158A8

Memory Dump Source

Source File: 00000019.00000002.2407428257.0000000010001000.00000020.00000001.01000000.0000000A.sdmp, Offset: 10000000, based on PE: true

Associated: 00000019.00000002.2407398545.0000000010000000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.2407457416.0000000010019000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.2407486723.000000001001E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.2407543255.0000000010022000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_10000000_nfregdrv.jbxd

Similarity

API ID: CriticalSection$Leave$Enter$_malloc
String ID:
API String ID: 2624469294-0
Opcode ID: af66a572ff308366c586223bea1b859f2b64d82aec888bcbbc6575e257e25f9f
Instruction ID: b4838676840f3e74a045a70f2e4b7778d9ead1c68319ad0b4665687bbdc5929c
Opcode Fuzzy Hash: af66a572ff308366c586223bea1b859f2b64d82aec888bcbbc6575e257e25f9f
Instruction Fuzzy Hash: EC31E532A002148FD711DF2CDC81969B3D6FF84261B59866AE828DF291EB32DC548BD1

Function 10015510 Relevance: 10.6, APIs: 7, Instructions: 95COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(1002030C), ref: 1001551F
LeaveCriticalSection.KERNEL32(1002030C), ref: 10015533
__aullrem.LIBCMT ref: 10015558
LeaveCriticalSection.KERNEL32(1002030C,?,?,00000000,00000000), ref: 1001557E

Memory Dump Source

Source File: 00000019.00000002.2407428257.0000000010001000.00000020.00000001.01000000.0000000A.sdmp, Offset: 10000000, based on PE: true

Associated: 00000019.00000002.2407398545.0000000010000000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.2407457416.0000000010019000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.2407486723.000000001001E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.2407543255.0000000010022000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_10000000_nfregdrv.jbxd

Similarity

API ID: CriticalSection$Leave$Enter__aullrem
String ID:
API String ID: 1392406986-0
Opcode ID: d1b92c9a15aa5841480ea886cd8603e293953e3d95721df58c3ef1283f84292e
Instruction ID: eb2839e93686e6e60da02978a6273212bfb1d6ef73694f74e7e96aae41cfea2c
Opcode Fuzzy Hash: d1b92c9a15aa5841480ea886cd8603e293953e3d95721df58c3ef1283f84292e
Instruction Fuzzy Hash: 002104367006148FD310CB6DEC88A5577EBEF88672F654269FA1CCF291DB32D88486D0

Function 10015740 Relevance: 10.6, APIs: 7, Instructions: 78COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(1002030C), ref: 10015753
LeaveCriticalSection.KERNEL32(1002030C), ref: 10015763
LeaveCriticalSection.KERNEL32(1002030C), ref: 1001577A
EnterCriticalSection.KERNEL32(10020168), ref: 10015781
LeaveCriticalSection.KERNEL32(10020168), ref: 100157A8
_malloc.LIBCMT ref: 100157AC

Memory Dump Source

Source File: 00000019.00000002.2407428257.0000000010001000.00000020.00000001.01000000.0000000A.sdmp, Offset: 10000000, based on PE: true

Associated: 00000019.00000002.2407398545.0000000010000000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.2407457416.0000000010019000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.2407486723.000000001001E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.2407543255.0000000010022000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_10000000_nfregdrv.jbxd

Similarity

API ID: CriticalSection$Leave$Enter$_malloc
String ID:
API String ID: 2624469294-0
Opcode ID: 8d90196d2bee32e8d3484feec3460c9a7be0d346ac3607533073b5423734d643
Instruction ID: 49e631b63e63f54fa41d8579300819fad08862a6ee69802ca296dd5302bd9675
Opcode Fuzzy Hash: 8d90196d2bee32e8d3484feec3460c9a7be0d346ac3607533073b5423734d643
Instruction Fuzzy Hash: 0121A176A04315CBD310DB28EC02A5973D5EB84761B0A436AE8588F2D1DB72D8508BD1

Function 1000A8A7 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 36libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

TlsGetValue.KERNEL32(00000000,1000A91C,00000000,1000EA20,00000000,00000000,00000314,?,?,?,1001F3B0,1000A694,1001F3B0,Microsoft Visual C++ Runtime Library,00012010), ref: 1000A8B4
TlsGetValue.KERNEL32(00000002,?,?,?,1001F3B0,1000A694,1001F3B0,Microsoft Visual C++ Runtime Library,00012010), ref: 1000A8CB
GetModuleHandleA.KERNEL32(KERNEL32.DLL,?,?,?,1001F3B0,1000A694,1001F3B0,Microsoft Visual C++ Runtime Library,00012010), ref: 1000A8E0
GetProcAddress.KERNEL32(00000000,EncodePointer), ref: 1000A8FB

Strings

KERNEL32.DLL, xrefs: 1000A8DB
EncodePointer, xrefs: 1000A8F5

Memory Dump Source

Source File: 00000019.00000002.2407428257.0000000010001000.00000020.00000001.01000000.0000000A.sdmp, Offset: 10000000, based on PE: true

Associated: 00000019.00000002.2407398545.0000000010000000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.2407457416.0000000010019000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.2407486723.000000001001E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.2407543255.0000000010022000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_10000000_nfregdrv.jbxd

Similarity

API ID: Value$AddressHandleModuleProc
String ID: EncodePointer$KERNEL32.DLL
API String ID: 1929421221-3682587211
Opcode ID: 698cc03a02ed437f9e78c1477e8a38eecfbfb8aad5433eb0b7b92186c3789519
Instruction ID: caffd8b91c38bffb5cca897b74d77eec42bfe04cae3721fbb3b20170df584618
Opcode Fuzzy Hash: 698cc03a02ed437f9e78c1477e8a38eecfbfb8aad5433eb0b7b92186c3789519
Instruction Fuzzy Hash: D9F01D30A05626AFFA51DB24CC8895A3BD8DF467D07028624F854E71B8DF30CED29B51

Function 1000A91E Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 36libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,1000ACF2,00000000,00000000,10008BC3,00000000,?,?,00000001,?,?,10008C27,00000001,?,?,1001B608), ref: 1000A92B
TlsGetValue.KERNEL32(00000002,?,1000ACF2,00000000,00000000,10008BC3,00000000,?,?,00000001,?,?,10008C27,00000001), ref: 1000A942
GetModuleHandleA.KERNEL32(KERNEL32.DLL,?,1000ACF2,00000000,00000000,10008BC3,00000000,?,?,00000001,?,?,10008C27,00000001), ref: 1000A957
GetProcAddress.KERNEL32(00000000,DecodePointer), ref: 1000A972

Strings

KERNEL32.DLL, xrefs: 1000A952
DecodePointer, xrefs: 1000A96C

Memory Dump Source

Source File: 00000019.00000002.2407428257.0000000010001000.00000020.00000001.01000000.0000000A.sdmp, Offset: 10000000, based on PE: true

Associated: 00000019.00000002.2407398545.0000000010000000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.2407457416.0000000010019000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.2407486723.000000001001E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.2407543255.0000000010022000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_10000000_nfregdrv.jbxd

Similarity

API ID: Value$AddressHandleModuleProc
String ID: DecodePointer$KERNEL32.DLL
API String ID: 1929421221-629428536
Opcode ID: 849bf8aa20e695c811e63e4f389fbd3f38ad5f5727a41dc013945db67583cb91
Instruction ID: bd257daf5de9dee36b7a7df8f8d7f9ef99228c3852669747f2885a7cf79806d7
Opcode Fuzzy Hash: 849bf8aa20e695c811e63e4f389fbd3f38ad5f5727a41dc013945db67583cb91
Instruction Fuzzy Hash: 9FF0F930A056229EEA52DB248C8899A7BD8EF463D07028224F968D7168DB30CDD18A51

Function 004022B3 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 36libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

TlsGetValue.KERNEL32(00000000,00402328,00000000,00403482,00000000,00000000,00000314,?,?,?,0040B040,00401917,0040B040,Microsoft Visual C++ Runtime Library,00012010), ref: 004022C0
TlsGetValue.KERNEL32(00000006,?,?,?,0040B040,00401917,0040B040,Microsoft Visual C++ Runtime Library,00012010), ref: 004022D7
GetModuleHandleA.KERNEL32(KERNEL32.DLL,?,?,?,0040B040,00401917,0040B040,Microsoft Visual C++ Runtime Library,00012010), ref: 004022EC
GetProcAddress.KERNEL32(00000000,EncodePointer), ref: 00402307

Strings

EncodePointer, xrefs: 00402301
KERNEL32.DLL, xrefs: 004022E7

Memory Dump Source

Source File: 00000019.00000002.2406935891.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000019.00000002.2406895102.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000019.00000002.2406977537.0000000000408000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000019.00000002.2407008193.000000000040A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000019.00000002.2407030372.000000000040C000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_400000_nfregdrv.jbxd

Similarity

API ID: Value$AddressHandleModuleProc
String ID: EncodePointer$KERNEL32.DLL
API String ID: 1929421221-3682587211
Opcode ID: 1a385f102c7f14214112f7259b1974e6b0907a5b8e91fbf1077ec2ee8662ada9
Instruction ID: 50336ba6c918c6c116f5e3fcbab542df5951bbe2d872b07961eb55563d71e960
Opcode Fuzzy Hash: 1a385f102c7f14214112f7259b1974e6b0907a5b8e91fbf1077ec2ee8662ada9
Instruction Fuzzy Hash: BFF06D301056129BDA529B74EF08A6B7BA5AF40394B15047AB854F62F4CF78CC11DA6D

Function 0040232A Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 36libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

TlsGetValue.KERNEL32(00000000,004023BF,?,004024E4,?,?,0040199A), ref: 00402337
TlsGetValue.KERNEL32(00000006,?,004024E4,?,?,0040199A), ref: 0040234E
GetModuleHandleA.KERNEL32(KERNEL32.DLL,?,004024E4,?,?,0040199A), ref: 00402363
GetProcAddress.KERNEL32(00000000,DecodePointer), ref: 0040237E

Strings

KERNEL32.DLL, xrefs: 0040235E
DecodePointer, xrefs: 00402378

Memory Dump Source

Source File: 00000019.00000002.2406935891.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000019.00000002.2406895102.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000019.00000002.2406977537.0000000000408000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000019.00000002.2407008193.000000000040A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000019.00000002.2407030372.000000000040C000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_400000_nfregdrv.jbxd

Similarity

API ID: Value$AddressHandleModuleProc
String ID: DecodePointer$KERNEL32.DLL
API String ID: 1929421221-629428536
Opcode ID: b796f7a9d0800bb9e160982425eb8aa8e27173a6ee7dc456a018aa060cd778d7
Instruction ID: b3a0eb18012e6aadf2811430fba97e87ad444e4cba862865431688a9bf4f90a9
Opcode Fuzzy Hash: b796f7a9d0800bb9e160982425eb8aa8e27173a6ee7dc456a018aa060cd778d7
Instruction Fuzzy Hash: A1F01230501623ABD712A734DF08A5B3AA59F41390715413ABC58F62F4DB7CCD12865D

Function 10001818 Relevance: 10.2, APIs: 8, Instructions: 231COMMON

Download Yara Rule

APIs

LeaveCriticalSection.KERNEL32(1002030C), ref: 100018A4
LeaveCriticalSection.KERNEL32(1002030C), ref: 100018E0
EnterCriticalSection.KERNEL32(1002030C), ref: 10001916
LeaveCriticalSection.KERNEL32(1002030C), ref: 100019BE
LeaveCriticalSection.KERNEL32(1002030C), ref: 10001A02
EnterCriticalSection.KERNEL32(1002030C), ref: 10001A3C
EnterCriticalSection.KERNEL32(?), ref: 10001AA3
EnterCriticalSection.KERNEL32(?), ref: 10001AF7
EnterCriticalSection.KERNEL32(?), ref: 10001B76
LeaveCriticalSection.KERNEL32(1002030C), ref: 10002045

Memory Dump Source

Source File: 00000019.00000002.2407428257.0000000010001000.00000020.00000001.01000000.0000000A.sdmp, Offset: 10000000, based on PE: true

Associated: 00000019.00000002.2407398545.0000000010000000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.2407457416.0000000010019000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.2407486723.000000001001E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.2407543255.0000000010022000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_10000000_nfregdrv.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID:
API String ID: 3168844106-0
Opcode ID: 1148cbf5bdb9481604341125c06b22783845d375c7f4a15b8700bf0034355e6e
Instruction ID: 1c7db7b73577996e6f6b7cc1b13f752c77784736a4bb66c20c39e3569af504b5
Opcode Fuzzy Hash: 1148cbf5bdb9481604341125c06b22783845d375c7f4a15b8700bf0034355e6e
Instruction Fuzzy Hash: 3891D370A04384CFE710CF68C880B9AB7E6FF89384F45855DF8858B256D775E985CB62

Function 10017880 Relevance: 9.1, APIs: 6, Instructions: 119COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,10018530,000000FF), ref: 100178C1
LeaveCriticalSection.KERNEL32(1002030C,?,?,?,?,?,?,?,?,?,?,?,?,10018530,000000FF), ref: 100178DD
LeaveCriticalSection.KERNEL32(1002030C), ref: 10017906

Memory Dump Source

Source File: 00000019.00000002.2407428257.0000000010001000.00000020.00000001.01000000.0000000A.sdmp, Offset: 10000000, based on PE: true

Associated: 00000019.00000002.2407398545.0000000010000000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.2407457416.0000000010019000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.2407486723.000000001001E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.2407543255.0000000010022000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_10000000_nfregdrv.jbxd

Similarity

API ID: CriticalSection$Leave$Enter
String ID:
API String ID: 2978645861-0
Opcode ID: 4fadeff10b6c9a286b6e83259b0211dd6e584e032f721b146db71c1fbee9745d
Instruction ID: 744bdcced945026e525a1d70fd2b130064bd5c13945d0ecf707bb38ae523f875
Opcode Fuzzy Hash: 4fadeff10b6c9a286b6e83259b0211dd6e584e032f721b146db71c1fbee9745d
Instruction Fuzzy Hash: 9141BF766083488FD700CF68EC8175AB7E9FB48764F10862AFD598B391DB35EA448A91

Function 10013EE0 Relevance: 9.1, APIs: 6, Instructions: 93COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(10020168,?,?,?,?,10016A9A,?,?,?,76EBFFB0,00000000), ref: 10013EE9
LeaveCriticalSection.KERNEL32(10020168), ref: 10013F17
_malloc.LIBCMT ref: 10013F22
LeaveCriticalSection.KERNEL32(10020168), ref: 10013F69
_memset.LIBCMT ref: 10013F7C
GetTickCount.KERNEL32 ref: 10013FA6

Memory Dump Source

Source File: 00000019.00000002.2407428257.0000000010001000.00000020.00000001.01000000.0000000A.sdmp, Offset: 10000000, based on PE: true

Associated: 00000019.00000002.2407398545.0000000010000000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.2407457416.0000000010019000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.2407486723.000000001001E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.2407543255.0000000010022000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_10000000_nfregdrv.jbxd

Similarity

API ID: CriticalSection$Leave$CountEnterTick_malloc_memset
String ID:
API String ID: 3854238366-0
Opcode ID: ac07afc8388a069d4f83166ba5a0569cc62fde9cdb2ff454ac3c5f1d52a80147
Instruction ID: 4ca0d7073e46e878efecada07f93c2f81ca96af553993ca0a0a66e884ec48b02
Opcode Fuzzy Hash: ac07afc8388a069d4f83166ba5a0569cc62fde9cdb2ff454ac3c5f1d52a80147
Instruction Fuzzy Hash: E23137B59003058FD745CF28DC80A867BF9FF49340B5182BAEC099F266EB31E955CB91

Function 10015EE0 Relevance: 9.1, APIs: 6, Instructions: 82COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(1002030C), ref: 10015EEF
LeaveCriticalSection.KERNEL32(1002030C), ref: 10015F03
__aullrem.LIBCMT ref: 10015F28
LeaveCriticalSection.KERNEL32(1002030C,?,?,00000000,00000000), ref: 10015F4E

Memory Dump Source

Source File: 00000019.00000002.2407428257.0000000010001000.00000020.00000001.01000000.0000000A.sdmp, Offset: 10000000, based on PE: true

Associated: 00000019.00000002.2407398545.0000000010000000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.2407457416.0000000010019000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.2407486723.000000001001E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.2407543255.0000000010022000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_10000000_nfregdrv.jbxd

Similarity

API ID: CriticalSection$Leave$Enter__aullrem
String ID:
API String ID: 1392406986-0
Opcode ID: 7ccb25e048fed005f5e0ad39f41a19acd61739f9bb35c0086ce996b125a16670
Instruction ID: 962ddd3524da1f0e37931dc98e1f0c185814ed2e642f679040aa4322ebcbbac0
Opcode Fuzzy Hash: 7ccb25e048fed005f5e0ad39f41a19acd61739f9bb35c0086ce996b125a16670
Instruction Fuzzy Hash: 03213835300214DFC300CB69EC889A9B7DADB84572B5942B9FE18CF292E732DD4087A0

Function 100148A0 Relevance: 9.1, APIs: 6, Instructions: 71COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(1002030C,?,?,00000001,?,10016ABE,?,?,-00000067,?,?,?,76EBFFB0,00000000), ref: 100148A9
LeaveCriticalSection.KERNEL32(1002030C,?,10016ABE,?,?,-00000067,?,?,?,76EBFFB0,00000000), ref: 100148BD
_memset.LIBCMT ref: 100148E2
DeviceIoControl.KERNEL32(FFFFFFFF,00220194,00000000,0000002C,00000000,0000002C,?,00000000), ref: 10014917
LeaveCriticalSection.KERNEL32(1002030C), ref: 10014942

Memory Dump Source

Source File: 00000019.00000002.2407428257.0000000010001000.00000020.00000001.01000000.0000000A.sdmp, Offset: 10000000, based on PE: true

Associated: 00000019.00000002.2407398545.0000000010000000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.2407457416.0000000010019000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.2407486723.000000001001E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.2407543255.0000000010022000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_10000000_nfregdrv.jbxd

Similarity

API ID: CriticalSection$Leave$ControlDeviceEnter_memset
String ID:
API String ID: 589867189-0
Opcode ID: 8ebd72944f7a2a950c9ee27789203da092cdf93c9c74612e77d64f55a2891e3a
Instruction ID: c706671d47631c6094ceacd85374c5c19a88f26d1054e66b0f3edaf9514eb2f3
Opcode Fuzzy Hash: 8ebd72944f7a2a950c9ee27789203da092cdf93c9c74612e77d64f55a2891e3a
Instruction Fuzzy Hash: 971184752043119FE700DF64ECC5F5B77A9EF88765F218629F2199E1D2CB30D9498A60

Function 10015610 Relevance: 9.0, APIs: 6, Instructions: 42synchronizationCOMMON

Download Yara Rule

APIs

SetEvent.KERNEL32(FFFFFFFF,?,?,?,100156AB), ref: 1001561F
WaitForSingleObject.KERNEL32(FFFFFFFF,000000FF,?,?,?,100156AB), ref: 1001563F
CloseHandle.KERNEL32(FFFFFFFF,?,?,?,100156AB), ref: 1001564C
SetEvent.KERNEL32(?,?,?,?,100156AB), ref: 1001566D
WaitForSingleObject.KERNEL32(?,000000FF,?,?,?,100156AB), ref: 1001567C
CloseHandle.KERNEL32(?,?,?,?,100156AB), ref: 10015684

Memory Dump Source

Source File: 00000019.00000002.2407428257.0000000010001000.00000020.00000001.01000000.0000000A.sdmp, Offset: 10000000, based on PE: true

Associated: 00000019.00000002.2407398545.0000000010000000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.2407457416.0000000010019000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.2407486723.000000001001E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.2407543255.0000000010022000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_10000000_nfregdrv.jbxd

Similarity

API ID: CloseEventHandleObjectSingleWait
String ID:
API String ID: 2055531096-0
Opcode ID: 2b52fc261705a2240190288487bb20031f43a560c2463843fdaa4baee3aae0d6
Instruction ID: f07f506387550c76cd1d2b3446689fb9bb28019f0ffc834db263f1ad7541274e
Opcode Fuzzy Hash: 2b52fc261705a2240190288487bb20031f43a560c2463843fdaa4baee3aae0d6
Instruction Fuzzy Hash: F7014B719003A19BE710DB69CCC4A1973A9A749374BB0C708F1348B6F1CB34E8828F24

Function 10016427 Relevance: 9.0, APIs: 4, Strings: 1, Instructions: 211COMMON

Download Yara Rule

APIs

QueryDosDeviceW.KERNEL32 ref: 1001646C
GetDriveTypeW.KERNEL32(?,?,?,?,?,?), ref: 100165A1
EnterCriticalSection.KERNEL32(10020484), ref: 10016726
LeaveCriticalSection.KERNEL32(10020484), ref: 10016742

Strings

:, xrefs: 1001645A

Memory Dump Source

Source File: 00000019.00000002.2407428257.0000000010001000.00000020.00000001.01000000.0000000A.sdmp, Offset: 10000000, based on PE: true

Associated: 00000019.00000002.2407398545.0000000010000000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.2407457416.0000000010019000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.2407486723.000000001001E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.2407543255.0000000010022000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_10000000_nfregdrv.jbxd

Similarity

API ID: CriticalSection$DeviceDriveEnterLeaveQueryType
String ID: :
API String ID: 2472114325-336475711
Opcode ID: 5d0bb1d3aef29e5e2cf54168e896612a3619c67b40a50f6bad3d4d47fe3ea62b
Instruction ID: 266c0d949fe9e03b7784f1c108ca597e8a181d292a197a77467f75c32d12edc8
Opcode Fuzzy Hash: 5d0bb1d3aef29e5e2cf54168e896612a3619c67b40a50f6bad3d4d47fe3ea62b
Instruction Fuzzy Hash: 829149B54083818BE720CB64CC95B9BB7E5FF88344F44891EE6C98B255DB71E688CB53

Function 10010975 Relevance: 7.7, APIs: 5, Instructions: 188COMMONLIBRARYCODE

Download Yara Rule

APIs

__flsbuf.LIBCMT ref: 10010A43
__flsbuf.LIBCMT ref: 10010A70
_wctomb_s.LIBCMT ref: 10010AD3
__flsbuf.LIBCMT ref: 10010B08
__flswbuf.LIBCMT ref: 10010B3D

Memory Dump Source

Source File: 00000019.00000002.2407428257.0000000010001000.00000020.00000001.01000000.0000000A.sdmp, Offset: 10000000, based on PE: true

Associated: 00000019.00000002.2407398545.0000000010000000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.2407457416.0000000010019000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.2407486723.000000001001E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.2407543255.0000000010022000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_10000000_nfregdrv.jbxd

Similarity

API ID: __flsbuf$__flswbuf_wctomb_s
String ID:
API String ID: 3257920507-0
Opcode ID: a75cccfa23d7aea3e5714c7e6dfbd81455f4b56c440ddb5dee57a86975d0e6af
Instruction ID: aaf0d67127a989ff9fc8068fecdd25abf0f0f1beb550e9f4a5d15db8321f0729
Opcode Fuzzy Hash: a75cccfa23d7aea3e5714c7e6dfbd81455f4b56c440ddb5dee57a86975d0e6af
Instruction Fuzzy Hash: B351F43A3046559BD724CF2898829AE77A4EF063B4B60060AF4E59F2D2DBB4E9C1C751

Function 100172B0 Relevance: 7.7, APIs: 5, Instructions: 164COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32 ref: 10017308
DeviceIoControl.KERNEL32(FFFFFFFF,00220198,?,00000004,?,?,1002030C,00000000), ref: 10017352

Part of subcall function 10015070: EnterCriticalSection.KERNEL32 ref: 100150AF
Part of subcall function 10015070: LeaveCriticalSection.KERNEL32(10020484,00000000,000000FF,00000000,000000FF,?,00000000), ref: 1001517C

LeaveCriticalSection.KERNEL32(1002030C,?), ref: 100174C8
SetLastError.KERNEL32(00000008), ref: 100174EB
LeaveCriticalSection.KERNEL32(1002030C), ref: 100174F6

Memory Dump Source

Source File: 00000019.00000002.2407428257.0000000010001000.00000020.00000001.01000000.0000000A.sdmp, Offset: 10000000, based on PE: true

Associated: 00000019.00000002.2407398545.0000000010000000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.2407457416.0000000010019000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.2407486723.000000001001E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.2407543255.0000000010022000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_10000000_nfregdrv.jbxd

Similarity

API ID: CriticalSection$Leave$Enter$ControlDeviceErrorLast
String ID:
API String ID: 4103992608-0
Opcode ID: 0c15b7dd3d47d1301ec5051b298948f62488c9d0a0b22cccd62178c255bc7e81
Instruction ID: 069ed3d1de4671eec97c8a091bf5bc0cd7826cd6fef9fe84e4e00e0bd1a0d2d6
Opcode Fuzzy Hash: 0c15b7dd3d47d1301ec5051b298948f62488c9d0a0b22cccd62178c255bc7e81
Instruction Fuzzy Hash: 6B519B755183819FD320CB24C841B9BBBE8FF85750F408A1DF5998B291DB74E949CB93

Function 00403CA8 Relevance: 7.7, APIs: 5, Instructions: 158COMMONLIBRARYCODE

Download Yara Rule

APIs

getSystemCP.LIBCMT ref: 00403CC1

Part of subcall function 00403C2E: _LocaleUpdate::_LocaleUpdate.LIBCMT ref: 00403C3B
Part of subcall function 00403C2E: GetOEMCP.KERNEL32(00000000,?,00401DD5), ref: 00403C55

setSBCS.LIBCMT ref: 00403CD3
IsValidCodePage.KERNEL32(-00000030,00000000,?,00000000,00409560), ref: 00403D19
GetCPInfo.KERNEL32(00000000,0040402B), ref: 00403D2C
setSBUpLow.LIBCMT ref: 00403E17

Memory Dump Source

Source File: 00000019.00000002.2406935891.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000019.00000002.2406895102.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000019.00000002.2406977537.0000000000408000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000019.00000002.2407008193.000000000040A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000019.00000002.2407030372.000000000040C000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_400000_nfregdrv.jbxd

Similarity

API ID: Locale$CodeInfoPageSystemUpdateUpdate::_Valid
String ID:
API String ID: 364485666-0
Opcode ID: f8562f73fbf6c12a93af662bf149bbf5becb5a351e9a22bc92b3aca215f4718f
Instruction ID: 7ec157c4a63f4bee73c0373c95dbc61b6731b50ec73e293603ddc6fd57e301c6
Opcode Fuzzy Hash: f8562f73fbf6c12a93af662bf149bbf5becb5a351e9a22bc92b3aca215f4718f
Instruction Fuzzy Hash: 8451E5719042549BDB15DF29C8806BABFA8EF05306F14817BD885BB2C2D63CDA46CBD9

Function 10016860 Relevance: 7.6, APIs: 5, Instructions: 111COMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 10016897
EnterCriticalSection.KERNEL32 ref: 100168B8
?nf_tcpPostReceive@nfapi@@YA?AW4_NF_STATUS@@_KPBDH@Z.NFAPI(?,?,00000000,00000000), ref: 10016931
LeaveCriticalSection.KERNEL32(1002030C), ref: 10016948
SetEvent.KERNEL32(?), ref: 100169C9

Memory Dump Source

Source File: 00000019.00000002.2407428257.0000000010001000.00000020.00000001.01000000.0000000A.sdmp, Offset: 10000000, based on PE: true

Associated: 00000019.00000002.2407398545.0000000010000000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.2407457416.0000000010019000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.2407486723.000000001001E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.2407543255.0000000010022000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_10000000_nfregdrv.jbxd

Similarity

API ID: CriticalSection$?nf_tcpCountEnterEventLeavePostReceive@nfapi@@S@@_Tick
String ID:
API String ID: 2201467506-0
Opcode ID: 3b8d782bd27df50b16dfc65a62725b0131aeeeb5184073b4607cf5be4256a305
Instruction ID: 742bec59b4eacf5a62cee880053408559a72dd2c9328244c4bf56ef4399b46ed
Opcode Fuzzy Hash: 3b8d782bd27df50b16dfc65a62725b0131aeeeb5184073b4607cf5be4256a305
Instruction Fuzzy Hash: E0418B709087819FE310CF24CC84A6ABBEAFB88754F50491DF8D68B651D735ED858B42

Function 10013D10 Relevance: 7.6, APIs: 5, Instructions: 90COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(10020168), ref: 10013D19
LeaveCriticalSection.KERNEL32(10020168), ref: 10013D47
_malloc.LIBCMT ref: 10013D52
LeaveCriticalSection.KERNEL32(10020168), ref: 10013D99
_memset.LIBCMT ref: 10013DAC

Memory Dump Source

Source File: 00000019.00000002.2407428257.0000000010001000.00000020.00000001.01000000.0000000A.sdmp, Offset: 10000000, based on PE: true

Associated: 00000019.00000002.2407398545.0000000010000000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.2407457416.0000000010019000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.2407486723.000000001001E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.2407543255.0000000010022000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_10000000_nfregdrv.jbxd

Similarity

API ID: CriticalSection$Leave$Enter_malloc_memset
String ID:
API String ID: 923394041-0
Opcode ID: d2436b13b8ff33d81ad853f571cd7b4f84e6fc360ee8814cc5edca94589bfc8a
Instruction ID: 7167e3c78dd255bc3be61e05a3690e11657a4ad0a516055890c14454ff31153c
Opcode Fuzzy Hash: d2436b13b8ff33d81ad853f571cd7b4f84e6fc360ee8814cc5edca94589bfc8a
Instruction Fuzzy Hash: D4319CB15013018FE749CF18ECC1A567BA5FF98304B2582AEE8099F366DB31E959CF90

Function 10014090 Relevance: 7.6, APIs: 5, Instructions: 73COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(1002030C), ref: 10014096
LeaveCriticalSection.KERNEL32(1002030C), ref: 100140AA
DeviceIoControl.KERNEL32(FFFFFFFF,00000000,?,0000025B,00000000,00000000,?,00000000), ref: 10014137
LeaveCriticalSection.KERNEL32(1002030C), ref: 10014147

Memory Dump Source

Source File: 00000019.00000002.2407428257.0000000010001000.00000020.00000001.01000000.0000000A.sdmp, Offset: 10000000, based on PE: true

Associated: 00000019.00000002.2407398545.0000000010000000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.2407457416.0000000010019000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.2407486723.000000001001E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.2407543255.0000000010022000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_10000000_nfregdrv.jbxd

Similarity

API ID: CriticalSection$Leave$ControlDeviceEnter
String ID:
API String ID: 3744975357-0
Opcode ID: c7db852ffef9afacecec687bb358ebba848a58d4b521bdcfc675cc6101f49ccd
Instruction ID: 943a08fe69652d90c9d1f998fde71af210911f062dc05d4fd50d64c2a8c94902
Opcode Fuzzy Hash: c7db852ffef9afacecec687bb358ebba848a58d4b521bdcfc675cc6101f49ccd
Instruction Fuzzy Hash: BE110A76500210AFE705CB68DC89ADB33D9EF88760F118219F6128B1E1EF70DA84C690

Function 100162D0 Relevance: 7.6, APIs: 5, Instructions: 73COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(1002030C), ref: 100162DF
__aullrem.LIBCMT ref: 100162F8
LeaveCriticalSection.KERNEL32(1002030C,?,?,00000000,00000000), ref: 1001631E
LeaveCriticalSection.KERNEL32(1002030C,?,?,00000000,00000000), ref: 10016346
LeaveCriticalSection.KERNEL32(1002030C), ref: 10016378

Memory Dump Source

Source File: 00000019.00000002.2407428257.0000000010001000.00000020.00000001.01000000.0000000A.sdmp, Offset: 10000000, based on PE: true

Associated: 00000019.00000002.2407398545.0000000010000000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.2407457416.0000000010019000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.2407486723.000000001001E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.2407543255.0000000010022000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_10000000_nfregdrv.jbxd

Similarity

API ID: CriticalSection$Leave$Enter__aullrem
String ID:
API String ID: 1392406986-0
Opcode ID: a12b99a6437fde0b1fddeed73491248cb1b45896119e412d513d9bd3dbe0284c
Instruction ID: 8b44c5907cacb563da89275e12a7b823dc438703cb38c6685e6cf52fab2f5aee
Opcode Fuzzy Hash: a12b99a6437fde0b1fddeed73491248cb1b45896119e412d513d9bd3dbe0284c
Instruction Fuzzy Hash: E3115B313002059FD700CB69EC88DAEB3DEEF89561B5581A5FD08CF292E732ED5083A0

Function 10014970 Relevance: 7.6, APIs: 5, Instructions: 67COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(1002030C), ref: 1001497F
LeaveCriticalSection.KERNEL32(1002030C), ref: 10014993
__aullrem.LIBCMT ref: 100149B8
LeaveCriticalSection.KERNEL32(1002030C,?,?,00000000,00000000), ref: 100149DE

Memory Dump Source

Source File: 00000019.00000002.2407428257.0000000010001000.00000020.00000001.01000000.0000000A.sdmp, Offset: 10000000, based on PE: true

Associated: 00000019.00000002.2407398545.0000000010000000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.2407457416.0000000010019000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.2407486723.000000001001E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.2407543255.0000000010022000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_10000000_nfregdrv.jbxd

Similarity

API ID: CriticalSection$Leave$Enter__aullrem
String ID:
API String ID: 1392406986-0
Opcode ID: 2404607320ef2a75d0717d5302f9e8fa9c4f34ddd1540ab3d998488c8b00b57d
Instruction ID: 4e2cb47ff58eaee26e2a48776ae77e93d28fc32bba7de68dc87d4d27a697fb70
Opcode Fuzzy Hash: 2404607320ef2a75d0717d5302f9e8fa9c4f34ddd1540ab3d998488c8b00b57d
Instruction Fuzzy Hash: 441104317002449FD310CB68EC88F9A77DAEF85671F524295FA588B2A2DB31DC848691

Function 100152E0 Relevance: 7.6, APIs: 4, Strings: 1, Instructions: 62COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(1002030C), ref: 100152EF
LeaveCriticalSection.KERNEL32(1002030C), ref: 10015303
LeaveCriticalSection.KERNEL32(1002030C), ref: 10015321

Strings

B, xrefs: 10015353

Memory Dump Source

Source File: 00000019.00000002.2407428257.0000000010001000.00000020.00000001.01000000.0000000A.sdmp, Offset: 10000000, based on PE: true

Associated: 00000019.00000002.2407398545.0000000010000000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.2407457416.0000000010019000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.2407486723.000000001001E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.2407543255.0000000010022000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_10000000_nfregdrv.jbxd

Similarity

API ID: CriticalSection$Leave$Enter
String ID: B
API String ID: 2978645861-1255198513
Opcode ID: d389180647d33e7fd7909b68b13a63dafe69a50724e4bfe4741239f59ea6ff70
Instruction ID: 5862e67234fadea20cb6fb71e4dcca28f21175ac499c2c8a774871cc376374ad
Opcode Fuzzy Hash: d389180647d33e7fd7909b68b13a63dafe69a50724e4bfe4741239f59ea6ff70
Instruction Fuzzy Hash: C711C2327002188BDB01CF69ECC4599B7A5FF443B1B54826AFE2CCF292DB71D94486D0

Function 100144A0 Relevance: 7.5, APIs: 5, Instructions: 49COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(1002030C), ref: 100144A8
LeaveCriticalSection.KERNEL32(1002030C), ref: 100144EC
DeviceIoControl.KERNEL32(FFFFFFFF,002201B4,?,00000014,00000000,00000000,00000000,00000000), ref: 10014513
LeaveCriticalSection.KERNEL32(1002030C), ref: 10014522
LeaveCriticalSection.KERNEL32(1002030C), ref: 10014533

Memory Dump Source

Source File: 00000019.00000002.2407428257.0000000010001000.00000020.00000001.01000000.0000000A.sdmp, Offset: 10000000, based on PE: true

Associated: 00000019.00000002.2407398545.0000000010000000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.2407457416.0000000010019000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.2407486723.000000001001E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.2407543255.0000000010022000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_10000000_nfregdrv.jbxd

Similarity

API ID: CriticalSection$Leave$ControlDeviceEnter
String ID:
API String ID: 3744975357-0
Opcode ID: a308096551d9751a7049de7f445834c6eeaff320b8b2092d6412a4f98500842a
Instruction ID: a46a0420c4f18f8497baad094036f26d02c65c78e58f58d61c697df38c55562f
Opcode Fuzzy Hash: a308096551d9751a7049de7f445834c6eeaff320b8b2092d6412a4f98500842a
Instruction Fuzzy Hash: C7113C746147019FE304DF28DC85B5677E6FF88B21F81C64CF9598B2A2D770D908CA92

Function 100146D0 Relevance: 7.5, APIs: 5, Instructions: 46COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(1002030C), ref: 100146D6
LeaveCriticalSection.KERNEL32(1002030C), ref: 100146EC
DeviceIoControl.KERNEL32(FFFFFFFF,002201A4,?,00000010,?,00000004,?,00000000), ref: 1001471D
LeaveCriticalSection.KERNEL32(1002030C), ref: 10014738

Memory Dump Source

Source File: 00000019.00000002.2407428257.0000000010001000.00000020.00000001.01000000.0000000A.sdmp, Offset: 10000000, based on PE: true

Associated: 00000019.00000002.2407398545.0000000010000000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.2407457416.0000000010019000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.2407486723.000000001001E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.2407543255.0000000010022000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_10000000_nfregdrv.jbxd

Similarity

API ID: CriticalSection$Leave$ControlDeviceEnter
String ID:
API String ID: 3744975357-0
Opcode ID: b6876661e5ff2c24c9972b30366f10f5fdaa2126c1ee03cc0ae946e3fb77ca8f
Instruction ID: 2fba52e4ee8d058ba920c3b194ab9f094fa0f14e2d16636bf92fac5c4c939877
Opcode Fuzzy Hash: b6876661e5ff2c24c9972b30366f10f5fdaa2126c1ee03cc0ae946e3fb77ca8f
Instruction Fuzzy Hash: 7701D630715320AFE301CB24DC48BA633DAEF85B71F128609F6598B0E1CF70C984C6A1

Function 10001210 Relevance: 7.5, APIs: 5, Instructions: 44synchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 10001340: EnterCriticalSection.KERNEL32(?,?,?,?,100156AB), ref: 10001378
Part of subcall function 10001340: LeaveCriticalSection.KERNEL32(10020350,?,?,?,?,?,?,?,100156AB), ref: 100013BF

SetEvent.KERNEL32(?,DF9D727A,?,?,?,1001885B,000000FF), ref: 1000124D
WaitForSingleObject.KERNEL32(?,000000FF,?,?,?,1001885B,000000FF), ref: 10001266
CloseHandle.KERNEL32(?,?,?,?,1001885B,000000FF), ref: 10001273
DeleteCriticalSection.KERNEL32(10020350,?,?,?,1001885B,000000FF), ref: 10001284
CloseHandle.KERNEL32(?,?,?,?,1001885B,000000FF), ref: 10001295

Memory Dump Source

Source File: 00000019.00000002.2407428257.0000000010001000.00000020.00000001.01000000.0000000A.sdmp, Offset: 10000000, based on PE: true

Associated: 00000019.00000002.2407398545.0000000010000000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.2407457416.0000000010019000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.2407486723.000000001001E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.2407543255.0000000010022000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_10000000_nfregdrv.jbxd

Similarity

API ID: CriticalSection$CloseHandle$DeleteEnterEventLeaveObjectSingleWait
String ID:
API String ID: 2474944948-0
Opcode ID: 1e9d32bd37262b913d57dc8945bf0fb53b1a93de7becb73826e872e3e5311905
Instruction ID: 64c5f76c38a82e9d846c98533c0514a9f92b4564d6453463f8853accf3b8306c
Opcode Fuzzy Hash: 1e9d32bd37262b913d57dc8945bf0fb53b1a93de7becb73826e872e3e5311905
Instruction Fuzzy Hash: E2015B71504760DFE750DF28CC88A4A77A9EB48730F608B09F439D76E1D734AA418B61

Function 10007B2F Relevance: 7.5, APIs: 5, Instructions: 44memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

__lock.LIBCMT ref: 10007B4D

Part of subcall function 10009513: __mtinitlocknum.LIBCMT ref: 10009527
Part of subcall function 10009513: __amsg_exit.LIBCMT ref: 10009533
Part of subcall function 10009513: EnterCriticalSection.KERNEL32(?,?,?,1000F77D,00000004,1001B950,0000000C,1000B1A8,?,?,00000000,00000000,00000000,1000AB20,00000001,00000214), ref: 1000953B

___sbh_find_block.LIBCMT ref: 10007B58
___sbh_free_block.LIBCMT ref: 10007B67
HeapFree.KERNEL32(00000000,00000001,1001B588,0000000C,100094F4,00000000,1001B628,0000000C,1000952C,00000001,?,?,1000F77D,00000004,1001B950,0000000C), ref: 10007B97
GetLastError.KERNEL32(?,1000F77D,00000004,1001B950,0000000C,1000B1A8,?,?,00000000,00000000,00000000,1000AB20,00000001,00000214), ref: 10007BA8

Memory Dump Source

Source File: 00000019.00000002.2407428257.0000000010001000.00000020.00000001.01000000.0000000A.sdmp, Offset: 10000000, based on PE: true

Associated: 00000019.00000002.2407398545.0000000010000000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.2407457416.0000000010019000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.2407486723.000000001001E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.2407543255.0000000010022000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_10000000_nfregdrv.jbxd

Similarity

API ID: CriticalEnterErrorFreeHeapLastSection___sbh_find_block___sbh_free_block__amsg_exit__lock__mtinitlocknum
String ID:
API String ID: 2714421763-0
Opcode ID: a001902257452df3a09ef7874541bacfe911b9a4d4b91542b9a5e470de5e31ec
Instruction ID: 4bde7f342c64e4d2018f3ae2fc3c74ed1e6debbda6c59ac2aa0521a4ba985f47
Opcode Fuzzy Hash: a001902257452df3a09ef7874541bacfe911b9a4d4b91542b9a5e470de5e31ec
Instruction Fuzzy Hash: 8501D639C00715AAFB21DBB18C09B5E36A4FF003E1F204209F518A6098CF3CEA40CB65

Function 00404039 Relevance: 7.5, APIs: 5, Instructions: 44memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

__lock.LIBCMT ref: 00404057

Part of subcall function 00402D12: __mtinitlocknum.LIBCMT ref: 00402D26
Part of subcall function 00402D12: __amsg_exit.LIBCMT ref: 00402D32
Part of subcall function 00402D12: EnterCriticalSection.KERNEL32(?,?,?,00405EA1,00000004,00409600,0000000C,0040411A,?,?,00000000,00000000,00000000,004024F8,00000001,00000214), ref: 00402D3A

___sbh_find_block.LIBCMT ref: 00404062
___sbh_free_block.LIBCMT ref: 00404071
HeapFree.KERNEL32(00000000,?,00409580,0000000C,00402CF3,00000000,004094A0,0000000C,00402D2B,?,?,?,00405EA1,00000004,00409600,0000000C), ref: 004040A1
GetLastError.KERNEL32(?,00405EA1,00000004,00409600,0000000C,0040411A,?,?,00000000,00000000,00000000,004024F8,00000001,00000214), ref: 004040B2

Memory Dump Source

Source File: 00000019.00000002.2406935891.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000019.00000002.2406895102.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000019.00000002.2406977537.0000000000408000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000019.00000002.2407008193.000000000040A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000019.00000002.2407030372.000000000040C000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_400000_nfregdrv.jbxd

Similarity

API ID: CriticalEnterErrorFreeHeapLastSection___sbh_find_block___sbh_free_block__amsg_exit__lock__mtinitlocknum
String ID:
API String ID: 2714421763-0
Opcode ID: c53e33b7dcff97c89c7848c55f26829c9334c78826d435bd8598ab40913ee6d4
Instruction ID: bb3a9ea6063299376b196d4342a46263de040b943687fa37fdfcb015542456c3
Opcode Fuzzy Hash: c53e33b7dcff97c89c7848c55f26829c9334c78826d435bd8598ab40913ee6d4
Instruction Fuzzy Hash: 540184B2941301AADB207BB29E0AB5E37649F80324F10423FF7047A2D2CB7C89449A9C

Function 10014420 Relevance: 7.5, APIs: 5, Instructions: 41COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(1002030C), ref: 10014426
LeaveCriticalSection.KERNEL32(1002030C), ref: 1001443C
DeviceIoControl.KERNEL32(FFFFFFFF,002201B8,?,00000004,?,00000010,?,00000000), ref: 1001446F
LeaveCriticalSection.KERNEL32(1002030C), ref: 10014484

Memory Dump Source

Source File: 00000019.00000002.2407428257.0000000010001000.00000020.00000001.01000000.0000000A.sdmp, Offset: 10000000, based on PE: true

Associated: 00000019.00000002.2407398545.0000000010000000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.2407457416.0000000010019000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.2407486723.000000001001E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.2407543255.0000000010022000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_10000000_nfregdrv.jbxd

Similarity

API ID: CriticalSection$Leave$ControlDeviceEnter
String ID:
API String ID: 3744975357-0
Opcode ID: d5d1587f7f7b2bd1b6f3903fe53ac465cdd8ad77325049dbc3963d326160d6bd
Instruction ID: a8c769179fd60e2bf6cd89700ffbf8ba4d12cccd7724cdc3fecdfc68b2935979
Opcode Fuzzy Hash: d5d1587f7f7b2bd1b6f3903fe53ac465cdd8ad77325049dbc3963d326160d6bd
Instruction Fuzzy Hash: 58F03C74214311AFE314DBA49D84B6633DAEF88B61F628608F666C94E1DB70C884DA62

Function 10014540 Relevance: 7.5, APIs: 5, Instructions: 39COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(1002030C), ref: 10014548
LeaveCriticalSection.KERNEL32(1002030C), ref: 10014575
DeviceIoControl.KERNEL32(FFFFFFFF,002201B0,?,0000000C,00000000,00000000,00000000,00000000), ref: 1001459C
LeaveCriticalSection.KERNEL32(1002030C), ref: 100145AB

Memory Dump Source

Source File: 00000019.00000002.2407428257.0000000010001000.00000020.00000001.01000000.0000000A.sdmp, Offset: 10000000, based on PE: true

Associated: 00000019.00000002.2407398545.0000000010000000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.2407457416.0000000010019000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.2407486723.000000001001E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.2407543255.0000000010022000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_10000000_nfregdrv.jbxd

Similarity

API ID: CriticalSection$Leave$ControlDeviceEnter
String ID:
API String ID: 3744975357-0
Opcode ID: cf9b4901ff1e343b7e26287a133ebef74e919893ac441ab88bcd06e640e03855
Instruction ID: 0eff3ab3fb06489d6740a8c9915ab30779d44775857bedc5cb99c14d77079b55
Opcode Fuzzy Hash: cf9b4901ff1e343b7e26287a133ebef74e919893ac441ab88bcd06e640e03855
Instruction Fuzzy Hash: 73016774514311AFE301DF28CD45B5A77E5EF98B10F918A08F964862E2E774D5048A52

Function 100145D0 Relevance: 7.5, APIs: 5, Instructions: 39COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(1002030C), ref: 100145D8
LeaveCriticalSection.KERNEL32(1002030C), ref: 10014605
DeviceIoControl.KERNEL32(FFFFFFFF,002201AC,?,0000000C,00000000,00000000,00000000,00000000), ref: 1001462C
LeaveCriticalSection.KERNEL32(1002030C), ref: 1001463B

Memory Dump Source

Source File: 00000019.00000002.2407428257.0000000010001000.00000020.00000001.01000000.0000000A.sdmp, Offset: 10000000, based on PE: true

Associated: 00000019.00000002.2407398545.0000000010000000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.2407457416.0000000010019000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.2407486723.000000001001E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.2407543255.0000000010022000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_10000000_nfregdrv.jbxd

Similarity

API ID: CriticalSection$Leave$ControlDeviceEnter
String ID:
API String ID: 3744975357-0
Opcode ID: 6e4f1e0d7d0e21a89da46d87f902386311073b00f14cfb2b082e5294dee19481
Instruction ID: 42d7f987a94a52d01ef36b35c772b808b674778ff1b5ba1bc601a11ad0b11856
Opcode Fuzzy Hash: 6e4f1e0d7d0e21a89da46d87f902386311073b00f14cfb2b082e5294dee19481
Instruction Fuzzy Hash: 6A016274A14311AFF300DF28CD85B5A77E5EF98B10F918A08F968862E2E774D5088A92

Function 100038F0 Relevance: 7.5, APIs: 5, Instructions: 34synchronizationCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(10020458,0000000A,?,00000000,1001783B), ref: 100038FE
LeaveCriticalSection.KERNEL32(10020458), ref: 1000392C
WaitForSingleObject.KERNEL32(?,00002710), ref: 1000393A
EnterCriticalSection.KERNEL32(10020458), ref: 10003941
LeaveCriticalSection.KERNEL32(10020458), ref: 10003963

Memory Dump Source

Source File: 00000019.00000002.2407428257.0000000010001000.00000020.00000001.01000000.0000000A.sdmp, Offset: 10000000, based on PE: true

Associated: 00000019.00000002.2407398545.0000000010000000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.2407457416.0000000010019000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.2407486723.000000001001E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.2407543255.0000000010022000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_10000000_nfregdrv.jbxd

Similarity

API ID: CriticalSection$EnterLeave$ObjectSingleWait
String ID:
API String ID: 1755037574-0
Opcode ID: 3bb25a39c071496a06b616590bfd4f65b77da877f5bd338bfbeae23c9fbe291f
Instruction ID: 4c8c2d80ac1b079380655c5ec4cbb732bc282f0004f1aa78e3f82d5ff21842fc
Opcode Fuzzy Hash: 3bb25a39c071496a06b616590bfd4f65b77da877f5bd338bfbeae23c9fbe291f
Instruction Fuzzy Hash: 8FF090B1B402655FF704FB98ECD0CA533EAEBCC354760C019FB0593613CA7068069B61

Function 10002E70 Relevance: 7.5, APIs: 5, Instructions: 34synchronizationCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(100203D8,0000000A,?,00000000,10017836), ref: 10002E7E
LeaveCriticalSection.KERNEL32(100203D8), ref: 10002EAC
WaitForSingleObject.KERNEL32(?,00002710), ref: 10002EBA
EnterCriticalSection.KERNEL32(100203D8), ref: 10002EC1
LeaveCriticalSection.KERNEL32(100203D8), ref: 10002EE3

Memory Dump Source

Source File: 00000019.00000002.2407428257.0000000010001000.00000020.00000001.01000000.0000000A.sdmp, Offset: 10000000, based on PE: true

Associated: 00000019.00000002.2407398545.0000000010000000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.2407457416.0000000010019000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.2407486723.000000001001E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.2407543255.0000000010022000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_10000000_nfregdrv.jbxd

Similarity

API ID: CriticalSection$EnterLeave$ObjectSingleWait
String ID:
API String ID: 1755037574-0
Opcode ID: 1c097af206b97876061b063052c6263d78874f6a138238f18bb0d2092e23d612
Instruction ID: e43171a4669c4619fb34f8ae264f673014ca4388743921c5762645a7f44c2943
Opcode Fuzzy Hash: 1c097af206b97876061b063052c6263d78874f6a138238f18bb0d2092e23d612
Instruction Fuzzy Hash: 66F03A757103249FF304D7A8DCD0CA973AEEBC8794764405AF741A3226C7B4BA428B61

Function 10014660 Relevance: 7.5, APIs: 5, Instructions: 33COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(1002030C), ref: 10014666
LeaveCriticalSection.KERNEL32(1002030C), ref: 1001467B
DeviceIoControl.KERNEL32(FFFFFFFF,002201A8,?,00000004,00000000,00000000,?,00000000), ref: 100146A0
LeaveCriticalSection.KERNEL32(1002030C), ref: 100146AF

Memory Dump Source

Source File: 00000019.00000002.2407428257.0000000010001000.00000020.00000001.01000000.0000000A.sdmp, Offset: 10000000, based on PE: true

Associated: 00000019.00000002.2407398545.0000000010000000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.2407457416.0000000010019000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.2407486723.000000001001E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.2407543255.0000000010022000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_10000000_nfregdrv.jbxd

Similarity

API ID: CriticalSection$Leave$ControlDeviceEnter
String ID:
API String ID: 3744975357-0
Opcode ID: 1ae83451541ad7b1658e7e77a32fbb5fc71b43354f710eefe43c36ccfaec8dcc
Instruction ID: 3db9b80ac07a141cc6bafe2479cacd36b1aa32743546a89e3ddafa96da967a27
Opcode Fuzzy Hash: 1ae83451541ad7b1658e7e77a32fbb5fc71b43354f710eefe43c36ccfaec8dcc
Instruction Fuzzy Hash: 84F08270251310AFF201C7749C89F553399DF48B22F628708F326C90E1DF70D4049A51

Function 100131B0 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 37registryCOMMON

Download Yara Rule

APIs

__snprintf.LIBCMT ref: 100131DB
RegOpenKeyExA.ADVAPI32(80000002,?,00000000,00000001), ref: 100131F5
RegCloseKey.ADVAPI32(00000000), ref: 1001321A

Strings

SYSTEM\CurrentControlSet\Services\%s, xrefs: 100131CC

Memory Dump Source

Source File: 00000019.00000002.2407428257.0000000010001000.00000020.00000001.01000000.0000000A.sdmp, Offset: 10000000, based on PE: true

Associated: 00000019.00000002.2407398545.0000000010000000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.2407457416.0000000010019000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.2407486723.000000001001E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.2407543255.0000000010022000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_10000000_nfregdrv.jbxd

Similarity

API ID: CloseOpen__snprintf
String ID: SYSTEM\CurrentControlSet\Services\%s
API String ID: 2649323954-2757632955
Opcode ID: 84ec4fc234ded0ec1746a26bb0a01dea6608cb65e603b7f2fafd6f762602d5c4
Instruction ID: 0e6c5bb0a140b4fe4a8a9fd12908ebb5e2cd1ecdda7a5af6ef08cdde4ffb9b5c
Opcode Fuzzy Hash: 84ec4fc234ded0ec1746a26bb0a01dea6608cb65e603b7f2fafd6f762602d5c4
Instruction Fuzzy Hash: 37F0E6B5A143005BF764DB54C856FEA73E5EB99700F80480CF5D986181DAB59584CA52

Function 100189E0 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 7libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(kernel32,QueryFullProcessImageNameW), ref: 100189EA
GetProcAddress.KERNEL32(00000000), ref: 100189F1

Strings

kernel32, xrefs: 100189E5
QueryFullProcessImageNameW, xrefs: 100189E0

Memory Dump Source

Source File: 00000019.00000002.2407428257.0000000010001000.00000020.00000001.01000000.0000000A.sdmp, Offset: 10000000, based on PE: true

Associated: 00000019.00000002.2407398545.0000000010000000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.2407457416.0000000010019000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.2407486723.000000001001E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.2407543255.0000000010022000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_10000000_nfregdrv.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: QueryFullProcessImageNameW$kernel32
API String ID: 1646373207-4169370628
Opcode ID: 80ead79f867b9c70acc418535677702e5c57cb3ae286bb14f1603a2e4be25d81
Instruction ID: d4b750a60ec6c6cb5d585284b623d2f8c151284af6f3ea71f4c867148f187fbc
Opcode Fuzzy Hash: 80ead79f867b9c70acc418535677702e5c57cb3ae286bb14f1603a2e4be25d81
Instruction Fuzzy Hash: 7BB092B8400320AFEB01DBE08C8C8953AEEE74E2027008400F60585120CB30C1E0CF15

Function 10018A00 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 7libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(kernel32,QueryFullProcessImageNameA), ref: 10018A0A
GetProcAddress.KERNEL32(00000000), ref: 10018A11

Strings

QueryFullProcessImageNameA, xrefs: 10018A00
kernel32, xrefs: 10018A05

Memory Dump Source

Source File: 00000019.00000002.2407428257.0000000010001000.00000020.00000001.01000000.0000000A.sdmp, Offset: 10000000, based on PE: true

Associated: 00000019.00000002.2407398545.0000000010000000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.2407457416.0000000010019000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.2407486723.000000001001E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.2407543255.0000000010022000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_10000000_nfregdrv.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: QueryFullProcessImageNameA$kernel32
API String ID: 1646373207-3526589867
Opcode ID: bfb67a8b5cc4ef26928f28fcb801f94734c3672f5e5d78a8aa3062b54429a572
Instruction ID: 98f50a63cd48d57722deb6357d66e02bf387ff61662be34999bf1d136a449764
Opcode Fuzzy Hash: bfb67a8b5cc4ef26928f28fcb801f94734c3672f5e5d78a8aa3062b54429a572
Instruction Fuzzy Hash: FAB092F14013209FE702ABB08C8C8853AE9EB1A202B108100FB0186121CB38C0D18A12

Function 10018A50 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 7libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(ntdll,NtQuerySymbolicLinkObject), ref: 10018A5A
GetProcAddress.KERNEL32(00000000), ref: 10018A61

Strings

NtQuerySymbolicLinkObject, xrefs: 10018A50
ntdll, xrefs: 10018A55

Memory Dump Source

Source File: 00000019.00000002.2407428257.0000000010001000.00000020.00000001.01000000.0000000A.sdmp, Offset: 10000000, based on PE: true

Associated: 00000019.00000002.2407398545.0000000010000000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.2407457416.0000000010019000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.2407486723.000000001001E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.2407543255.0000000010022000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_10000000_nfregdrv.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: NtQuerySymbolicLinkObject$ntdll
API String ID: 1646373207-3146753317
Opcode ID: 61b53181ddc3a0468bf9acf94f72e8e6d06d1798f52acba3e2d3b8d08e6a28da
Instruction ID: b543b7ade083403f1789f1f0de2ce02b86dca8d31286e88a7640a01fa307330f
Opcode Fuzzy Hash: 61b53181ddc3a0468bf9acf94f72e8e6d06d1798f52acba3e2d3b8d08e6a28da
Instruction Fuzzy Hash: B4B092F0400320AFE701EBA18C8C8863AEAE70A2223008010F70585125CB34C1D48F11

Function 10018A70 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 7libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(ntdll,NtOpenSymbolicLinkObject), ref: 10018A7A
GetProcAddress.KERNEL32(00000000), ref: 10018A81

Strings

NtOpenSymbolicLinkObject, xrefs: 10018A70
ntdll, xrefs: 10018A75

Memory Dump Source

Source File: 00000019.00000002.2407428257.0000000010001000.00000020.00000001.01000000.0000000A.sdmp, Offset: 10000000, based on PE: true

Associated: 00000019.00000002.2407398545.0000000010000000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.2407457416.0000000010019000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.2407486723.000000001001E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.2407543255.0000000010022000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_10000000_nfregdrv.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: NtOpenSymbolicLinkObject$ntdll
API String ID: 1646373207-699678798
Opcode ID: fdd8a5cfbd6b08d661b471b0597a721e8dc6ba82253e6c59f24492ff2366b510
Instruction ID: ebc436c54efd9b5b1c1cf879c4817285fbe182f6251ddbece40f41faf484d1d2
Opcode Fuzzy Hash: fdd8a5cfbd6b08d661b471b0597a721e8dc6ba82253e6c59f24492ff2366b510
Instruction Fuzzy Hash: 07B092F14403219FE702EBA08D8C8863AEAE70E2037008015F70185122CB34C0D1CA11

Function 10015C80 Relevance: 6.4, APIs: 5, Instructions: 190COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?), ref: 10015CBC
LeaveCriticalSection.KERNEL32(1002030C,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 10015CD8
LeaveCriticalSection.KERNEL32(1002030C), ref: 10015D3B

Memory Dump Source

Source File: 00000019.00000002.2407428257.0000000010001000.00000020.00000001.01000000.0000000A.sdmp, Offset: 10000000, based on PE: true

Associated: 00000019.00000002.2407398545.0000000010000000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.2407457416.0000000010019000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.2407486723.000000001001E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.2407543255.0000000010022000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_10000000_nfregdrv.jbxd

Similarity

API ID: CriticalSection$Leave$Enter
String ID:
API String ID: 2978645861-0
Opcode ID: 31d074460ceac946c0d193caf96497102455dab9f53a976f00f18180bc0b4a95
Instruction ID: 6b063e24d70fe8b42fc37b21e784bd8b66a1ec8045d673d45357853a068beb0b
Opcode Fuzzy Hash: 31d074460ceac946c0d193caf96497102455dab9f53a976f00f18180bc0b4a95
Instruction Fuzzy Hash: B861AA76905700CFC314CF28D980A5AB7F6FB88661F548A2DF9598B341D736EA44CBA2

Function 10015400 Relevance: 6.3, APIs: 5, Instructions: 92COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(1002030C), ref: 1001540F
LeaveCriticalSection.KERNEL32(1002030C), ref: 10015423
LeaveCriticalSection.KERNEL32(1002030C), ref: 1001546A

Memory Dump Source

Source File: 00000019.00000002.2407428257.0000000010001000.00000020.00000001.01000000.0000000A.sdmp, Offset: 10000000, based on PE: true

Associated: 00000019.00000002.2407398545.0000000010000000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.2407457416.0000000010019000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.2407486723.000000001001E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.2407543255.0000000010022000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_10000000_nfregdrv.jbxd

Similarity

API ID: CriticalSection$Leave$Enter
String ID:
API String ID: 2978645861-0
Opcode ID: f884fb650ff68b9350361ec3a5e3420faf4578eaab12f6148c9d3cfc54674c03
Instruction ID: 3b9cdc21f64611186a4f192bef5eff766ae51078ef50db3d8a9c348abcb55b80
Opcode Fuzzy Hash: f884fb650ff68b9350361ec3a5e3420faf4578eaab12f6148c9d3cfc54674c03
Instruction Fuzzy Hash: 2531D1756007149BC710CF2DEC8499A77E5EF88336F10432AF95D8B691D731E9848BD0

Function 10017D00 Relevance: 6.3, APIs: 5, Instructions: 66COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(10020168,00000010,00000000,10015376), ref: 10017D12
LeaveCriticalSection.KERNEL32(10020168), ref: 10017D7B
LeaveCriticalSection.KERNEL32(10020168), ref: 10017DAE
LeaveCriticalSection.KERNEL32(10020168), ref: 10017DC5
LeaveCriticalSection.KERNEL32(10020168), ref: 10017DCE

Part of subcall function 10007B2F: __lock.LIBCMT ref: 10007B4D
Part of subcall function 10007B2F: ___sbh_find_block.LIBCMT ref: 10007B58
Part of subcall function 10007B2F: ___sbh_free_block.LIBCMT ref: 10007B67
Part of subcall function 10007B2F: HeapFree.KERNEL32(00000000,00000001,1001B588,0000000C,100094F4,00000000,1001B628,0000000C,1000952C,00000001,?,?,1000F77D,00000004,1001B950,0000000C), ref: 10007B97
Part of subcall function 10007B2F: GetLastError.KERNEL32(?,1000F77D,00000004,1001B950,0000000C,1000B1A8,?,?,00000000,00000000,00000000,1000AB20,00000001,00000214), ref: 10007BA8

Memory Dump Source

Source File: 00000019.00000002.2407428257.0000000010001000.00000020.00000001.01000000.0000000A.sdmp, Offset: 10000000, based on PE: true

Associated: 00000019.00000002.2407398545.0000000010000000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.2407457416.0000000010019000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.2407486723.000000001001E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.2407543255.0000000010022000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_10000000_nfregdrv.jbxd

Similarity

API ID: CriticalSection$Leave$EnterErrorFreeHeapLast___sbh_find_block___sbh_free_block__lock
String ID:
API String ID: 2683178029-0
Opcode ID: 745b44e389e3eb57d002cadd99901bb83912b5949676a4bdb36c585caf9445f7
Instruction ID: b4225b4be6f6f7a218a50a7cc17e3f5341257b43a51e5c7c058e521d2863d70b
Opcode Fuzzy Hash: 745b44e389e3eb57d002cadd99901bb83912b5949676a4bdb36c585caf9445f7
Instruction Fuzzy Hash: C5219D765003158FD755CF14ED45AAA77B1FF9431570244BEF909CB222DB36D492CB81

Function 100142C0 Relevance: 6.3, APIs: 5, Instructions: 60COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(1002030C), ref: 100142CD
LeaveCriticalSection.KERNEL32(1002030C), ref: 100142E1
LeaveCriticalSection.KERNEL32(1002030C), ref: 100142FE

Memory Dump Source

Source File: 00000019.00000002.2407428257.0000000010001000.00000020.00000001.01000000.0000000A.sdmp, Offset: 10000000, based on PE: true

Associated: 00000019.00000002.2407398545.0000000010000000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.2407457416.0000000010019000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.2407486723.000000001001E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.2407543255.0000000010022000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_10000000_nfregdrv.jbxd

Similarity

API ID: CriticalSection$Leave$Enter
String ID:
API String ID: 2978645861-0
Opcode ID: 91475d05e9af95ed88a2ca98d537037db2de0cf6f2e51c315e4e122b3160fcb0
Instruction ID: 0688acbf623d954f04115705206b7a5878359c5d24a5a52100af0231af46e52b
Opcode Fuzzy Hash: 91475d05e9af95ed88a2ca98d537037db2de0cf6f2e51c315e4e122b3160fcb0
Instruction Fuzzy Hash: F411A0356102159FC700CF2DEC4489577AAEF89231712835AFD2C877A1EB31E8508AD0

Function 10014370 Relevance: 6.3, APIs: 5, Instructions: 60COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(1002030C), ref: 1001437D
LeaveCriticalSection.KERNEL32(1002030C), ref: 10014391
LeaveCriticalSection.KERNEL32(1002030C), ref: 100143AE

Memory Dump Source

Source File: 00000019.00000002.2407428257.0000000010001000.00000020.00000001.01000000.0000000A.sdmp, Offset: 10000000, based on PE: true

Associated: 00000019.00000002.2407398545.0000000010000000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.2407457416.0000000010019000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.2407486723.000000001001E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.2407543255.0000000010022000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_10000000_nfregdrv.jbxd

Similarity

API ID: CriticalSection$Leave$Enter
String ID:
API String ID: 2978645861-0
Opcode ID: af989e02686470c58158b9f9546e3ca7512020e02bc5ed8235ce539b5489efd8
Instruction ID: 4d93d7c43a49986c58b60d74623ea931e304e01d20275fc7b50258dea019b724
Opcode Fuzzy Hash: af989e02686470c58158b9f9546e3ca7512020e02bc5ed8235ce539b5489efd8
Instruction Fuzzy Hash: 2F11A0396102149FC700CF6DEC4489977A9EF88231711835AFD2CC77A1EB31E9118AD1

Function 10014800 Relevance: 6.3, APIs: 5, Instructions: 57COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(1002030C), ref: 1001480D
LeaveCriticalSection.KERNEL32(1002030C), ref: 10014821
LeaveCriticalSection.KERNEL32(1002030C), ref: 1001483E

Memory Dump Source

Source File: 00000019.00000002.2407428257.0000000010001000.00000020.00000001.01000000.0000000A.sdmp, Offset: 10000000, based on PE: true

Associated: 00000019.00000002.2407398545.0000000010000000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.2407457416.0000000010019000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.2407486723.000000001001E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.2407543255.0000000010022000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_10000000_nfregdrv.jbxd

Similarity

API ID: CriticalSection$Leave$Enter
String ID:
API String ID: 2978645861-0
Opcode ID: 5b0c05bd3bb3b5db66ab5481f23a3e4c1540d4302acacb0ddc367f69b30fcab4
Instruction ID: 77183064e41a1e9205efc12c9dcf8d440c153a8ee4ed2ed3b95b76763cc59ffb
Opcode Fuzzy Hash: 5b0c05bd3bb3b5db66ab5481f23a3e4c1540d4302acacb0ddc367f69b30fcab4
Instruction Fuzzy Hash: 8401B5366102149FD701DF7CAC04899379AEB89632B114366FE2C872E1DF31D95586D1

Function 10014760 Relevance: 6.3, APIs: 5, Instructions: 56COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(1002030C), ref: 1001476D
LeaveCriticalSection.KERNEL32(1002030C), ref: 10014781
LeaveCriticalSection.KERNEL32(1002030C), ref: 1001479E

Memory Dump Source

Source File: 00000019.00000002.2407428257.0000000010001000.00000020.00000001.01000000.0000000A.sdmp, Offset: 10000000, based on PE: true

Associated: 00000019.00000002.2407398545.0000000010000000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.2407457416.0000000010019000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.2407486723.000000001001E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.2407543255.0000000010022000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_10000000_nfregdrv.jbxd

Similarity

API ID: CriticalSection$Leave$Enter
String ID:
API String ID: 2978645861-0
Opcode ID: 315757dbfcfbb32eb6690a5904ae741756b3478989afcffcdb4784ba547c2fca
Instruction ID: c8b4f41cc937fb26e74b5d9e0f7055d815144c6c2631823094905784c4cc0ea4
Opcode Fuzzy Hash: 315757dbfcfbb32eb6690a5904ae741756b3478989afcffcdb4784ba547c2fca
Instruction Fuzzy Hash: 0D01F5366242148FD700DB7CAC44499339AEF89231B124356FE3C872E1DF31D91186D1

Function 10010B53 Relevance: 6.1, APIs: 4, Instructions: 101COMMONLIBRARYCODE

Download Yara Rule

APIs

_LocaleUpdate::_LocaleUpdate.LIBCMT ref: 10010B83
__isleadbyte_l.LIBCMT ref: 10010BB7
MultiByteToWideChar.KERNEL32(840FFFF8,00000009,?,FF000002,?,00000000,?,?,?,1000FF83,?,?,00000001), ref: 10010BE8
MultiByteToWideChar.KERNEL32(840FFFF8,00000009,?,00000001,?,00000000,?,?,?,1000FF83,?,?,00000001), ref: 10010C56

Memory Dump Source

Source File: 00000019.00000002.2407428257.0000000010001000.00000020.00000001.01000000.0000000A.sdmp, Offset: 10000000, based on PE: true

Associated: 00000019.00000002.2407398545.0000000010000000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.2407457416.0000000010019000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.2407486723.000000001001E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.2407543255.0000000010022000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_10000000_nfregdrv.jbxd

Similarity

API ID: ByteCharLocaleMultiWide$UpdateUpdate::___isleadbyte_l
String ID:
API String ID: 3058430110-0
Opcode ID: d976dae8849e1df09a0b0c0d7ef9455a66fad74b5674ac6a6004c55bf6a0fbc5
Instruction ID: a1dc6150c0cefba4fc0e341efb8d7f9e4622e53aa43daf027c921bb7a998826d
Opcode Fuzzy Hash: d976dae8849e1df09a0b0c0d7ef9455a66fad74b5674ac6a6004c55bf6a0fbc5
Instruction Fuzzy Hash: B0319D31B08246EFDB10DFA4C8849AA7BE5FF00255F1586A9F4A08F1A1D3B0D9C0DB51

Function 100014C0 Relevance: 6.1, APIs: 4, Instructions: 75synchronizationCOMMON

Download Yara Rule

APIs

SetEvent.KERNEL32(?,0000000A,759230B0,00000000,?,76EBFFB0,10017857), ref: 100014D0
WaitForSingleObject.KERNEL32(?,000000FF,?,76EBFFB0,10017857), ref: 1000150F
CloseHandle.KERNEL32(?,?,000000FF,?,76EBFFB0,10017857), ref: 10001522
_memmove_s.LIBCMT ref: 10001573

Memory Dump Source

Source File: 00000019.00000002.2407428257.0000000010001000.00000020.00000001.01000000.0000000A.sdmp, Offset: 10000000, based on PE: true

Associated: 00000019.00000002.2407398545.0000000010000000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.2407457416.0000000010019000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.2407486723.000000001001E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.2407543255.0000000010022000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_10000000_nfregdrv.jbxd

Similarity

API ID: CloseEventHandleObjectSingleWait_memmove_s
String ID:
API String ID: 3037655736-0
Opcode ID: a16a9262e8a1ed26482d417ee0d5e11f3f8b9f0b5b5de5088259525e283d6dc5
Instruction ID: c65eb985cd46562ea4b9b3fa780de754e17b39af8a735433f2001fa7709411ec
Opcode Fuzzy Hash: a16a9262e8a1ed26482d417ee0d5e11f3f8b9f0b5b5de5088259525e283d6dc5
Instruction Fuzzy Hash: 1D217171904A028FB730EB59C88545EB3E6FBC4691711851DE5AB47559DB30FE808BA1

Function 10007E33 Relevance: 6.1, APIs: 4, Instructions: 70threadCOMMON

Download Yara Rule

APIs

__calloc_crt.LIBCMT ref: 10007E6E
CreateThread.KERNEL32(?,?,10007DB3,00000000,?,?), ref: 10007EB2
GetLastError.KERNEL32(?,00003001,?,?,10017A59,00000000,00000000,10017590,00000000,00000000,?,?,10017CBE), ref: 10007EBC
__dosmaperr.LIBCMT ref: 10007ED4

Memory Dump Source

Source File: 00000019.00000002.2407428257.0000000010001000.00000020.00000001.01000000.0000000A.sdmp, Offset: 10000000, based on PE: true

Associated: 00000019.00000002.2407398545.0000000010000000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.2407457416.0000000010019000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.2407486723.000000001001E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.2407543255.0000000010022000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_10000000_nfregdrv.jbxd

Similarity

API ID: CreateErrorLastThread__calloc_crt__dosmaperr
String ID:
API String ID: 84609068-0
Opcode ID: 96a702f07e20c8fc08ba84a89f2686319f8a34372d6dff5ac5e6610c97b7c4f9
Instruction ID: 960ca24b8c0fd74316a4ffc7f982722606d32842def4c8c8f75851161ce74b88
Opcode Fuzzy Hash: 96a702f07e20c8fc08ba84a89f2686319f8a34372d6dff5ac5e6610c97b7c4f9
Instruction Fuzzy Hash: 2B113636902249BFFB01EFA4DC8288E77E5FF083E0B214569F509A3095DB34AE018B60

Function 10002B30 Relevance: 6.1, APIs: 4, Instructions: 68COMMON

Download Yara Rule

APIs

DeleteCriticalSection.KERNEL32(100203D8,DF9D727A,?,?,?,?,1001875C,000000FF), ref: 10002B72

Part of subcall function 100014C0: SetEvent.KERNEL32(?,0000000A,759230B0,00000000,?,76EBFFB0,10017857), ref: 100014D0
Part of subcall function 100014C0: WaitForSingleObject.KERNEL32(?,000000FF,?,76EBFFB0,10017857), ref: 1000150F
Part of subcall function 100014C0: CloseHandle.KERNEL32(?,?,000000FF,?,76EBFFB0,10017857), ref: 10001522
Part of subcall function 100014C0: _memmove_s.LIBCMT ref: 10001573

CloseHandle.KERNEL32(?,?,?,?,?,1001875C,000000FF), ref: 10002B93
CloseHandle.KERNEL32(?,?,?,?,?,1001875C,000000FF), ref: 10002BAA
CloseHandle.KERNEL32(?,?,?,?,?,1001875C,000000FF), ref: 10002BE7

Memory Dump Source

Source File: 00000019.00000002.2407428257.0000000010001000.00000020.00000001.01000000.0000000A.sdmp, Offset: 10000000, based on PE: true

Associated: 00000019.00000002.2407398545.0000000010000000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.2407457416.0000000010019000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.2407486723.000000001001E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.2407543255.0000000010022000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_10000000_nfregdrv.jbxd

Similarity

API ID: CloseHandle$CriticalDeleteEventObjectSectionSingleWait_memmove_s
String ID:
API String ID: 3715746028-0
Opcode ID: 76179a229a830d2f9d329135d3ac3756b66c2c4d1d0f11458de3c9b5cfab1ecf
Instruction ID: cfe803f662d768d14c2dfa4e60897070c9f65bc5c6aa7f7d02d73ff30c3c2152
Opcode Fuzzy Hash: 76179a229a830d2f9d329135d3ac3756b66c2c4d1d0f11458de3c9b5cfab1ecf
Instruction Fuzzy Hash: 80217CB05043A18FF300DF688C8560A7BDEFB042B4FA04B19F465D72E7C779AA058B91

Function 100035B0 Relevance: 6.1, APIs: 4, Instructions: 68COMMON

Download Yara Rule

APIs

DeleteCriticalSection.KERNEL32(10020458,DF9D727A,?,?,?,?,1001875C,000000FF), ref: 100035F2

Part of subcall function 100014C0: SetEvent.KERNEL32(?,0000000A,759230B0,00000000,?,76EBFFB0,10017857), ref: 100014D0
Part of subcall function 100014C0: WaitForSingleObject.KERNEL32(?,000000FF,?,76EBFFB0,10017857), ref: 1000150F
Part of subcall function 100014C0: CloseHandle.KERNEL32(?,?,000000FF,?,76EBFFB0,10017857), ref: 10001522
Part of subcall function 100014C0: _memmove_s.LIBCMT ref: 10001573

CloseHandle.KERNEL32(?,?,?,?,?,1001875C,000000FF), ref: 10003613
CloseHandle.KERNEL32(?,?,?,?,?,1001875C,000000FF), ref: 1000362A
CloseHandle.KERNEL32(?,?,?,?,?,1001875C,000000FF), ref: 10003667

Memory Dump Source

Source File: 00000019.00000002.2407428257.0000000010001000.00000020.00000001.01000000.0000000A.sdmp, Offset: 10000000, based on PE: true

Associated: 00000019.00000002.2407398545.0000000010000000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.2407457416.0000000010019000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.2407486723.000000001001E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.2407543255.0000000010022000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_10000000_nfregdrv.jbxd

Similarity

API ID: CloseHandle$CriticalDeleteEventObjectSectionSingleWait_memmove_s
String ID:
API String ID: 3715746028-0
Opcode ID: 63cec45596fa0ece01aef7757e97c95d257c6fcde774a1e3c521d25e9a1047f9
Instruction ID: e4b86ddf39c1be931d4e7214d39989b71f3d296ab9120b50707eace9ea249c52
Opcode Fuzzy Hash: 63cec45596fa0ece01aef7757e97c95d257c6fcde774a1e3c521d25e9a1047f9
Instruction Fuzzy Hash: 9621A1F49043919FE310EF6C8C8860A7BDAF704274FE08719F565872E7C739A9058BA2

Function 10003340 Relevance: 6.1, APIs: 4, Instructions: 58COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,10018648,000000FF), ref: 1000337E
SetEvent.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,10018648,000000FF), ref: 100033BD
SetEvent.KERNEL32(?), ref: 100033CF
LeaveCriticalSection.KERNEL32(?), ref: 100033D2

Memory Dump Source

Source File: 00000019.00000002.2407428257.0000000010001000.00000020.00000001.01000000.0000000A.sdmp, Offset: 10000000, based on PE: true

Associated: 00000019.00000002.2407398545.0000000010000000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.2407457416.0000000010019000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.2407486723.000000001001E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.2407543255.0000000010022000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_10000000_nfregdrv.jbxd

Similarity

API ID: CriticalEventSection$EnterLeave
String ID:
API String ID: 2034477713-0
Opcode ID: 26d7926c99e25f810d7718daa53f3b713310baac375bc8a9718a81a7c18c5246
Instruction ID: e5964f4e11a61a5ceb4984cd574a80e3950d02b8ad30e80ede868aa41323114b
Opcode Fuzzy Hash: 26d7926c99e25f810d7718daa53f3b713310baac375bc8a9718a81a7c18c5246
Instruction Fuzzy Hash: A5119D71504B44DFD321CF25C884B5BB7E8FB48260F008A2AE49A83A90DB79FA44CB91

Function 10017DE0 Relevance: 6.1, APIs: 4, Instructions: 58COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(10020168,?,?,1001533B), ref: 10017DFF
LeaveCriticalSection.KERNEL32(10020168,?,1001533B), ref: 10017E29
_malloc.LIBCMT ref: 10017E33

Memory Dump Source

Source File: 00000019.00000002.2407428257.0000000010001000.00000020.00000001.01000000.0000000A.sdmp, Offset: 10000000, based on PE: true

Associated: 00000019.00000002.2407398545.0000000010000000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.2407457416.0000000010019000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.2407486723.000000001001E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.2407543255.0000000010022000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_10000000_nfregdrv.jbxd

Similarity

API ID: CriticalSection$EnterLeave_malloc
String ID:
API String ID: 4242827099-0
Opcode ID: d9080a10b4345808967dd27d92c9b69f056f69c068306372603454a2a88374c5
Instruction ID: 61feaa6bcb75b8102a09506a810e75e671a35ffd5e85a93e1235847fc3054c73
Opcode Fuzzy Hash: d9080a10b4345808967dd27d92c9b69f056f69c068306372603454a2a88374c5
Instruction Fuzzy Hash: 66118276A002138BD755CB2CFD4199673F6FFD42A035582BEE80DCB225EA31DC918B80

Function 1000F24D Relevance: 6.0, APIs: 4, Instructions: 47COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 1000AB6E: __amsg_exit.LIBCMT ref: 1000AB7C

__amsg_exit.LIBCMT ref: 1000F279
__lock.LIBCMT ref: 1000F289
InterlockedDecrement.KERNEL32(?), ref: 1000F2A6
InterlockedIncrement.KERNEL32(005C16B8), ref: 1000F2D1

Memory Dump Source

Source File: 00000019.00000002.2407428257.0000000010001000.00000020.00000001.01000000.0000000A.sdmp, Offset: 10000000, based on PE: true

Associated: 00000019.00000002.2407398545.0000000010000000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.2407457416.0000000010019000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.2407486723.000000001001E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.2407543255.0000000010022000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_10000000_nfregdrv.jbxd

Similarity

API ID: Interlocked__amsg_exit$DecrementIncrement__lock
String ID:
API String ID: 4129207761-0
Opcode ID: 688ec18e88f5c39b8294586d72f857720aa36dea6ca6f4b7078c97f8e49bdce4
Instruction ID: fffc615c0fb4f66862dac9a19bb85b947d9e820b5dc1b207d8f39025125812c1
Opcode Fuzzy Hash: 688ec18e88f5c39b8294586d72f857720aa36dea6ca6f4b7078c97f8e49bdce4
Instruction Fuzzy Hash: AE01923AD01762ABFB11DB64884576DB3A0FF057E0F118109F80067A89CB38BD81EBD5

Function 00403B8A Relevance: 6.0, APIs: 4, Instructions: 47COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00402546: __amsg_exit.LIBCMT ref: 00402554

__amsg_exit.LIBCMT ref: 00403BB6
__lock.LIBCMT ref: 00403BC6
InterlockedDecrement.KERNEL32(?), ref: 00403BE3
InterlockedIncrement.KERNEL32(009816C0), ref: 00403C0E

Memory Dump Source

Source File: 00000019.00000002.2406935891.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000019.00000002.2406895102.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000019.00000002.2406977537.0000000000408000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000019.00000002.2407008193.000000000040A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000019.00000002.2407030372.000000000040C000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_400000_nfregdrv.jbxd

Similarity

API ID: Interlocked__amsg_exit$DecrementIncrement__lock
String ID:
API String ID: 4129207761-0
Opcode ID: 52a3e7971e82fb72f830ee4ccc85c939e43fcece51e1a5e76106840384332467
Instruction ID: 4c552d2baa94243f91659daba1be32444af7e91f1612fcd78746f7470628c05b
Opcode Fuzzy Hash: 52a3e7971e82fb72f830ee4ccc85c939e43fcece51e1a5e76106840384332467
Instruction Fuzzy Hash: 8B01A532900721ABD711BF269906B5ABF74AB00759F14403BE800772D2CB7CAE81DB9E

Function 1000AAF7 Relevance: 6.0, APIs: 4, Instructions: 45threadCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(00000001,00000000,10009235,1000A326,00000001,1000A856,00000000,00000000,00000001,?,?,?,1000A968,?,1000ACF2,00000000), ref: 1000AAF9

Part of subcall function 1000A9B0: TlsGetValue.KERNEL32(00000000,1000AB0C,?,?,?,1000A968,?,1000ACF2,00000000,00000000,10008BC3,00000000,?,?,00000001), ref: 1000A9B7
Part of subcall function 1000A9B0: TlsSetValue.KERNEL32(00000000,?,?,1000A968,?,1000ACF2,00000000,00000000,10008BC3,00000000,?,?,00000001,?,?,10008C27), ref: 1000A9D8

__calloc_crt.LIBCMT ref: 1000AB1B

Part of subcall function 1000B195: __calloc_impl.LIBCMT ref: 1000B1A3
Part of subcall function 1000B195: Sleep.KERNEL32(00000000), ref: 1000B1BA

Part of subcall function 1000A91E: TlsGetValue.KERNEL32(?,1000ACF2,00000000,00000000,10008BC3,00000000,?,?,00000001,?,?,10008C27,00000001,?,?,1001B608), ref: 1000A92B
Part of subcall function 1000A91E: TlsGetValue.KERNEL32(00000002,?,1000ACF2,00000000,00000000,10008BC3,00000000,?,?,00000001,?,?,10008C27,00000001), ref: 1000A942

Part of subcall function 1000AA38: GetModuleHandleA.KERNEL32(KERNEL32.DLL,1001B668,0000000C,1000AB49,00000000,00000000,?,?,?,1000A968,?,1000ACF2,00000000,00000000,10008BC3,00000000), ref: 1000AA49
Part of subcall function 1000AA38: GetProcAddress.KERNEL32(?,EncodePointer), ref: 1000AA7D
Part of subcall function 1000AA38: GetProcAddress.KERNEL32(?,DecodePointer), ref: 1000AA8D
Part of subcall function 1000AA38: InterlockedIncrement.KERNEL32(1001E5E0), ref: 1000AAAF
Part of subcall function 1000AA38: __lock.LIBCMT ref: 1000AAB7
Part of subcall function 1000AA38: ___addlocaleref.LIBCMT ref: 1000AAD6

GetCurrentThreadId.KERNEL32 ref: 1000AB4B
SetLastError.KERNEL32(00000000,?,?,?,1000A968,?,1000ACF2,00000000,00000000,10008BC3,00000000,?,?,00000001), ref: 1000AB63

Memory Dump Source

Source File: 00000019.00000002.2407428257.0000000010001000.00000020.00000001.01000000.0000000A.sdmp, Offset: 10000000, based on PE: true

Associated: 00000019.00000002.2407398545.0000000010000000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.2407457416.0000000010019000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.2407486723.000000001001E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.2407543255.0000000010022000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_10000000_nfregdrv.jbxd

Similarity

API ID: Value$AddressErrorLastProc$CurrentHandleIncrementInterlockedModuleSleepThread___addlocaleref__calloc_crt__calloc_impl__lock
String ID:
API String ID: 1081334783-0
Opcode ID: 47baad0c142978dd281d06efe9ff58a8f45b381e9549035b39ead8b204b2342f
Instruction ID: 6fb4e631f38a478814a727dc28711fd6a3486464b3ce86ddb14d750e3725a89c
Opcode Fuzzy Hash: 47baad0c142978dd281d06efe9ff58a8f45b381e9549035b39ead8b204b2342f
Instruction Fuzzy Hash: 0BF028329016325EF726AB746C09B9E3A91DF067F07118318F540D70E5CF34DC808690

Function 004024CF Relevance: 6.0, APIs: 4, Instructions: 45threadCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,0040199A), ref: 004024D1

Part of subcall function 004023A1: TlsGetValue.KERNEL32(?,004024E4,?,?,0040199A), ref: 004023A8
Part of subcall function 004023A1: TlsSetValue.KERNEL32(00000000,004024E4,?,?,0040199A), ref: 004023C9

__calloc_crt.LIBCMT ref: 004024F3

Part of subcall function 00404107: __calloc_impl.LIBCMT ref: 00404115
Part of subcall function 00404107: Sleep.KERNEL32(00000000), ref: 0040412C

Part of subcall function 0040232A: TlsGetValue.KERNEL32(00000000,004023BF,?,004024E4,?,?,0040199A), ref: 00402337
Part of subcall function 0040232A: TlsGetValue.KERNEL32(00000006,?,004024E4,?,?,0040199A), ref: 0040234E

Part of subcall function 00402410: GetModuleHandleA.KERNEL32(KERNEL32.DLL,00409438,0000000C,00402521,00000000,00000000,?,?,0040199A), ref: 00402421
Part of subcall function 00402410: GetProcAddress.KERNEL32(?,EncodePointer), ref: 00402455
Part of subcall function 00402410: GetProcAddress.KERNEL32(?,DecodePointer), ref: 00402465
Part of subcall function 00402410: InterlockedIncrement.KERNEL32(0040A460), ref: 00402487
Part of subcall function 00402410: __lock.LIBCMT ref: 0040248F
Part of subcall function 00402410: ___addlocaleref.LIBCMT ref: 004024AE

GetCurrentThreadId.KERNEL32 ref: 00402523
SetLastError.KERNEL32(00000000,?,?,0040199A), ref: 0040253B

Memory Dump Source

Source File: 00000019.00000002.2406935891.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000019.00000002.2406895102.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000019.00000002.2406977537.0000000000408000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000019.00000002.2407008193.000000000040A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000019.00000002.2407030372.000000000040C000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_400000_nfregdrv.jbxd

Similarity

API ID: Value$AddressErrorLastProc$CurrentHandleIncrementInterlockedModuleSleepThread___addlocaleref__calloc_crt__calloc_impl__lock
String ID:
API String ID: 1081334783-0
Opcode ID: 5ab9714a243f0ffc41694fcd0ac968f58e359ad798ea549c5e95678d0f806d4d
Instruction ID: 6e150c00b90b0de194aaa4e6d30466842cabbf0b81775d3192f362ebb9054922
Opcode Fuzzy Hash: 5ab9714a243f0ffc41694fcd0ac968f58e359ad798ea549c5e95678d0f806d4d
Instruction Fuzzy Hash: B3F0F432000621AAC63227757E0D64B2B50AF50775B21413EF985B61E1CEB88940869D

Function 10013A80 Relevance: 6.0, APIs: 4, Instructions: 42COMMON

Download Yara Rule

APIs

OpenProcess.KERNEL32(001F0FFF,00000000,?), ref: 10013A8F
CloseHandle.KERNEL32(00000000), ref: 10013AB5
GetModuleFileNameExW.PSAPI(00000000,00000000,?,?), ref: 10013ACD
CloseHandle.KERNEL32(00000000,00000000,00000000,?,?), ref: 10013AD5

Memory Dump Source

Source File: 00000019.00000002.2407428257.0000000010001000.00000020.00000001.01000000.0000000A.sdmp, Offset: 10000000, based on PE: true

Associated: 00000019.00000002.2407398545.0000000010000000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.2407457416.0000000010019000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.2407486723.000000001001E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.2407543255.0000000010022000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_10000000_nfregdrv.jbxd

Similarity

API ID: CloseHandle$FileModuleNameOpenProcess
String ID:
API String ID: 3706008839-0
Opcode ID: 77a01a2355183141ac97614d7ed4b7053512745596251045c5cd6b166a56d9cf
Instruction ID: 9d03786ab276ef560676e71944a6f241f9687970605c8b5740b5995641b249e1
Opcode Fuzzy Hash: 77a01a2355183141ac97614d7ed4b7053512745596251045c5cd6b166a56d9cf
Instruction Fuzzy Hash: BEF090363042216FE211CB6AEC88D6F37EDEFC9A11B054818F544C3200DA30DC0AC6B2

Function 10013AE0 Relevance: 6.0, APIs: 4, Instructions: 42COMMON

Download Yara Rule

APIs

OpenProcess.KERNEL32(001F0FFF,00000000,?), ref: 10013AEF
CloseHandle.KERNEL32(00000000), ref: 10013B15
GetModuleFileNameExA.PSAPI(00000000,00000000,?,?), ref: 10013B2D
CloseHandle.KERNEL32(00000000,00000000,00000000,?,?), ref: 10013B35

Memory Dump Source

Source File: 00000019.00000002.2407428257.0000000010001000.00000020.00000001.01000000.0000000A.sdmp, Offset: 10000000, based on PE: true

Associated: 00000019.00000002.2407398545.0000000010000000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.2407457416.0000000010019000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.2407486723.000000001001E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.2407543255.0000000010022000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_10000000_nfregdrv.jbxd

Similarity

API ID: CloseHandle$FileModuleNameOpenProcess
String ID:
API String ID: 3706008839-0
Opcode ID: 8cc178218c7d8c3221216592da3333f16c171a7615b685b5cff0377258111b15
Instruction ID: 8e40d057b3745753bf0ea22a452f5ad3ee9e323a75b10f58dd7a4a987a81d136
Opcode Fuzzy Hash: 8cc178218c7d8c3221216592da3333f16c171a7615b685b5cff0377258111b15
Instruction Fuzzy Hash: 00F06D763053616BE211DB29EC88E6B37A9EBC9A11B054919F604C3200DB30EC4AC6B1

Function 10007DB3 Relevance: 6.0, APIs: 4, Instructions: 39threadCOMMON

Download Yara Rule

APIs

Part of subcall function 1000A9B0: TlsGetValue.KERNEL32(00000000,1000AB0C,?,?,?,1000A968,?,1000ACF2,00000000,00000000,10008BC3,00000000,?,?,00000001), ref: 1000A9B7
Part of subcall function 1000A9B0: TlsSetValue.KERNEL32(00000000,?,?,1000A968,?,1000ACF2,00000000,00000000,10008BC3,00000000,?,?,00000001,?,?,10008C27), ref: 1000A9D8

Part of subcall function 1000A995: TlsGetValue.KERNEL32(?,10007DC4,00000000), ref: 1000A99F

GetLastError.KERNEL32(00000000,?,00000000), ref: 10007DDC
ExitThread.KERNEL32 ref: 10007DE3
GetCurrentThreadId.KERNEL32 ref: 10007DE9
__freefls@4.LIBCMT ref: 10007E0A

Memory Dump Source

Source File: 00000019.00000002.2407428257.0000000010001000.00000020.00000001.01000000.0000000A.sdmp, Offset: 10000000, based on PE: true

Associated: 00000019.00000002.2407398545.0000000010000000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.2407457416.0000000010019000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.2407486723.000000001001E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.2407543255.0000000010022000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_10000000_nfregdrv.jbxd

Similarity

API ID: Value$Thread$CurrentErrorExitLast__freefls@4
String ID:
API String ID: 3657912857-0
Opcode ID: 64a50246a69103428987866c6c5c24afc67ad888acb03d37522b74bef4819570
Instruction ID: 77834a4035ff60ce0f3138a5f24efa19d5a290510d67734f4d47669ef0895791
Opcode Fuzzy Hash: 64a50246a69103428987866c6c5c24afc67ad888acb03d37522b74bef4819570
Instruction Fuzzy Hash: CC01D67C9016519FF305EB70CC48A4E37F9FF492C0B228569F9098712ADB38E882CB52

Function 10007AF0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 17COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 10007AF7
__CxxThrowException@8.LIBCMT ref: 10007B29

Part of subcall function 10008D7B: RaiseException.KERNEL32(?,?,10008876,?,?,?,?,?,10008876,?,1001BB8C,1001F1E4), ref: 10008DBB

Strings

invalid string position, xrefs: 10007AFC

Memory Dump Source

Source File: 00000019.00000002.2407428257.0000000010001000.00000020.00000001.01000000.0000000A.sdmp, Offset: 10000000, based on PE: true

Associated: 00000019.00000002.2407398545.0000000010000000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.2407457416.0000000010019000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.2407486723.000000001001E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.2407543255.0000000010022000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_10000000_nfregdrv.jbxd

Similarity

API ID: ExceptionException@8H_prolog3RaiseThrow
String ID: invalid string position
API String ID: 1961742612-1799206989
Opcode ID: 65eb9927a461a61c6ced63933107e4e21b974b836ce3081774b1cc0b4902cc7c
Instruction ID: d17f9ad7a6bda8f05d9bf2ec8c2e610a9defb4f0618d30455176f24681aaa848
Opcode Fuzzy Hash: 65eb9927a461a61c6ced63933107e4e21b974b836ce3081774b1cc0b4902cc7c
Instruction Fuzzy Hash: E1E0E275900458ABEB00DBD4CC45BDEB778FB18350F400129E245BB48AEFB8A688CB61

Analysis Process: FastestVPN.WindowsService.exePID: 6276, Parent PID: 6632COMMON

Execution Graph

Execution Coverage:	3.9%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	26
Total number of Limit Nodes:	1

Executed Functions

Function 01751F08 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 62
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

OpenSCManagerW.SECHOST(00000000,00000000,?), ref: 01751F89

Strings

")DE, xrefs: 01751F32

Memory Dump Source

Source File: 0000001D.00000002.2583250826.0000000001750000.00000040.00000800.00020000.00000000.sdmp, Offset: 01750000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_1750000_FastestVPN.jbxd

Similarity

API ID: ManagerOpen
String ID: ")DE
API String ID: 1889721586-2386623192
Opcode ID: 6786aeec4c8033a717af439e92c6ede4f3d9f788cc7ef2b4032d581115a51551
Instruction ID: 6e79cd18e48162ba4d6a901b97fca356b1f31f1c6b05cafc06c0a1526b6e8155
Opcode Fuzzy Hash: 6786aeec4c8033a717af439e92c6ede4f3d9f788cc7ef2b4032d581115a51551
Instruction Fuzzy Hash: 672154B6D013089FDB14CF9AC884ADEFBF5BF99310F14852EE819A7200C378A541CBA0

Function 017514E0 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 61
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

OpenSCManagerW.SECHOST(00000000,00000000,?), ref: 01751F89

Strings

")DE, xrefs: 01751F32

Memory Dump Source

Source File: 0000001D.00000002.2583250826.0000000001750000.00000040.00000800.00020000.00000000.sdmp, Offset: 01750000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_1750000_FastestVPN.jbxd

Similarity

API ID: ManagerOpen
String ID: ")DE
API String ID: 1889721586-2386623192
Opcode ID: 7aa407e409df9a19291c28d8d51d354e6d793ab8ca91f8fe78823a3504ef5a0e
Instruction ID: 2ad8af7061a2872a239f9a887bf77fac6c57643749c7a5483121f306558cff19
Opcode Fuzzy Hash: 7aa407e409df9a19291c28d8d51d354e6d793ab8ca91f8fe78823a3504ef5a0e
Instruction Fuzzy Hash: 572152B58013089FDB10CF9AC884ADEFBF5FB58310F10852EE919A7240C3B8A544CBA0

Analysis Process: FastestVPN.exePID: 6020, Parent PID: 1028COMMON

Execution Graph

Execution Coverage:	9.8%
Dynamic/Decrypted Code Coverage:	87.8%
Signature Coverage:	4.1%
Total number of Nodes:	74
Total number of Limit Nodes:	7

Executed Functions

Function 0BDF04A1 Relevance: 4.3, Strings: 3, Instructions: 542
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

\;]q, xrefs: 0BDF0590
(aq, xrefs: 0BDF04C1
(aq, xrefs: 0BDF0519

Memory Dump Source

Source File: 00000022.00000002.3350571102.000000000BDF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0BDF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_34_2_bdf0000_FastestVPN.jbxd

Similarity

API ID:
String ID: (aq$(aq$\;]q
API String ID: 0-1792380333
Opcode ID: 24037593946fd0bb4630c08f4c5988c3aedc8471d8d877c4588157657c8aa48e
Instruction ID: 1d5eac911c97ce241b24787e7e6b4692478c44d7c9c4a17a78f4a58c14fe2917
Opcode Fuzzy Hash: 24037593946fd0bb4630c08f4c5988c3aedc8471d8d877c4588157657c8aa48e
Instruction Fuzzy Hash: 05328F30A1461ACFDB14EF78C854A9DFBB2FF89310F1181A9D945AB351EB70EA85CB50

Function 0BD62A40 Relevance: .3, Instructions: 287COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000022.00000002.3349809863.000000000BD60000.00000040.00000800.00020000.00000000.sdmp, Offset: 0BD60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_34_2_bd60000_FastestVPN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 38991529ef0a0aa5f7f16c26c2b16c74629d1ed588a7158bf8e8965fe77e6f87
Instruction ID: 3b8bf0525674574e51ecd36036fc6cc17ef770ed60d6b7f7c94fc46a8633a425
Opcode Fuzzy Hash: 38991529ef0a0aa5f7f16c26c2b16c74629d1ed588a7158bf8e8965fe77e6f87
Instruction Fuzzy Hash: ABC12B71D006598FCB11CF68C8446CDFBB2BF85320F6A8295E858BB255DB70AD8ACF50

Function 0BC00100 Relevance: 11.8, Strings: 9, Instructions: 550COMMON

Download Yara Rule

Strings

`]bq, xrefs: 0BC00275
`]bq, xrefs: 0BC0057F
d>]q, xrefs: 0BC00181
`]bq, xrefs: 0BC00281
d>]q, xrefs: 0BC00421
d>]q, xrefs: 0BC00431
`]bq, xrefs: 0BC00573
$&^q, xrefs: 0BC006A6
d>]q, xrefs: 0BC00175

Memory Dump Source

Source File: 00000022.00000002.3348680506.000000000BC00000.00000040.00000800.00020000.00000000.sdmp, Offset: 0BC00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_34_2_bc00000_FastestVPN.jbxd

Similarity

API ID:
String ID: $&^q$`]bq$`]bq$`]bq$`]bq$d>]q$d>]q$d>]q$d>]q
API String ID: 0-3184770417
Opcode ID: e7cc6e62a289fd368be33934bc9df4abdb7b472eaffd6576174e40e1ad046579
Instruction ID: 706ee07ee9e1f9d1f0667174d82e2a28c3ba1257d288410334731cc256fe6c18
Opcode Fuzzy Hash: e7cc6e62a289fd368be33934bc9df4abdb7b472eaffd6576174e40e1ad046579
Instruction Fuzzy Hash: 8702453172930DCFCB158FA9D850B6A7BA6EFC1221B1A846AD845CB2E1DF31CD45CB64

Function 0BDFA808 Relevance: 4.2, Strings: 3, Instructions: 447
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

(aq, xrefs: 0BDFAF39
(aq, xrefs: 0BDFAE7C
(aq, xrefs: 0BDFB00D

Memory Dump Source

Source File: 00000022.00000002.3350571102.000000000BDF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0BDF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_34_2_bdf0000_FastestVPN.jbxd

Similarity

API ID:
String ID: (aq$(aq$(aq
API String ID: 0-2593664646
Opcode ID: 8803488619487ee111505552e071b1cf0d4e674a4b346024e34f6c87f49e5743
Instruction ID: 8b11739458686dceb48c38c18d7495133241d1752ea3fd3240254dd45f18a6bd
Opcode Fuzzy Hash: 8803488619487ee111505552e071b1cf0d4e674a4b346024e34f6c87f49e5743
Instruction Fuzzy Hash: 8B025D70A046168FCB14DFA9C4906AEF7F2EF88310F21856AE94AE7350DB35DD42DB51

Function 0BDF44A0 Relevance: 3.0, Strings: 2, Instructions: 476
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

d, xrefs: 0BDF46F5
(aq, xrefs: 0BDF44B4

Memory Dump Source

Source File: 00000022.00000002.3350571102.000000000BDF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0BDF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_34_2_bdf0000_FastestVPN.jbxd

Similarity

API ID:
String ID: (aq$d
API String ID: 0-3557608343
Opcode ID: f18a04a0263d51dcfee2ddf45d03000066a779c2a03848d8348bd4cf1994eff6
Instruction ID: 10f345ec2dc8d1177223797ad5421f5932b4d58a79b5eefc667f6766318086f5
Opcode Fuzzy Hash: f18a04a0263d51dcfee2ddf45d03000066a779c2a03848d8348bd4cf1994eff6
Instruction Fuzzy Hash: EE029B34A046068FCB14CF59C48096AFBF2FF89324B16C669D56A9B765DB30F846CF90

Function 0BDFB7D4 Relevance: 2.8, Strings: 2, Instructions: 330
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

(aq, xrefs: 0BDFBB0E
(aq, xrefs: 0BDFBB7D

Memory Dump Source

Source File: 00000022.00000002.3350571102.000000000BDF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0BDF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_34_2_bdf0000_FastestVPN.jbxd

Similarity

API ID:
String ID: (aq$(aq
API String ID: 0-3916115647
Opcode ID: 2b306a281ec57279a5a9d9e2ee86e0ec687e1fca1aa9738ea8b2503c6c7770e1
Instruction ID: ac7f3bce44719fa7bdd20b89df4007c5f6a917a1cd2f13a9c7cb1b8d332751b6
Opcode Fuzzy Hash: 2b306a281ec57279a5a9d9e2ee86e0ec687e1fca1aa9738ea8b2503c6c7770e1
Instruction Fuzzy Hash: 5CD1A330B04216CFCB44EF69D4909AEBBF6FF89210B128599D506EB365DB70ED05CB91

Function 0BD68610 Relevance: 2.8, Strings: 2, Instructions: 292
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

d, xrefs: 0BD68865
(aq, xrefs: 0BD68624

Memory Dump Source

Source File: 00000022.00000002.3349809863.000000000BD60000.00000040.00000800.00020000.00000000.sdmp, Offset: 0BD60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_34_2_bd60000_FastestVPN.jbxd

Similarity

API ID:
String ID: (aq$d
API String ID: 0-3557608343
Opcode ID: 552c69039c79b37d80fc411cd49d797a3c7ab32bd37edc9322a1569e2506a0b4
Instruction ID: 1634c367a873b36a1ccee5eff3e4baf87b8cdd5b623754442689772270374633
Opcode Fuzzy Hash: 552c69039c79b37d80fc411cd49d797a3c7ab32bd37edc9322a1569e2506a0b4
Instruction Fuzzy Hash: BAB14934A006018FD728CF19C58096AFBF2FF88364725CA6AD45A9B765DB31FC46DB90

Function 0BDF5057 Relevance: 2.7, Strings: 2, Instructions: 200COMMON

Download Yara Rule

Strings

,aq, xrefs: 0BDF506B
4']q, xrefs: 0BDF51C7

Memory Dump Source

Source File: 00000022.00000002.3350571102.000000000BDF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0BDF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_34_2_bdf0000_FastestVPN.jbxd

Similarity

API ID:
String ID: ,aq$4']q
API String ID: 0-1214544875
Opcode ID: 24999a6850cad52b03cfd27de9f82c5c3cda4ea67b1c17007c7c0249d9a698dd
Instruction ID: 65d8ceaa43957448e65dc68a3cd8d0ee053a7a9c46db049b96de2e713fd4865a
Opcode Fuzzy Hash: 24999a6850cad52b03cfd27de9f82c5c3cda4ea67b1c17007c7c0249d9a698dd
Instruction Fuzzy Hash: C061D135B041159FCB18EF6DD89496EBBE6EFD83607118069E90ACB365DE30DD02C790

Function 0BD64840 Relevance: 2.7, Strings: 2, Instructions: 161COMMON

Download Yara Rule

Strings

(aq, xrefs: 0BD649F0
4']q, xrefs: 0BD648B0

Memory Dump Source

Source File: 00000022.00000002.3349809863.000000000BD60000.00000040.00000800.00020000.00000000.sdmp, Offset: 0BD60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_34_2_bd60000_FastestVPN.jbxd

Similarity

API ID:
String ID: (aq$4']q
API String ID: 0-4173138025
Opcode ID: 5833cf0b13c79de5c9cbcfcb39ca08c787a535d9954913ae7ad1151c6ba45fe8
Instruction ID: 57603e91195e9968d7730196ef5d126d0ef14b39e5a549b6605880f79152ff15
Opcode Fuzzy Hash: 5833cf0b13c79de5c9cbcfcb39ca08c787a535d9954913ae7ad1151c6ba45fe8
Instruction Fuzzy Hash: 6D5105307042958FCB09DF6C98A06AF7FA6FF966507118999C405CF396DE34CD06C7A2

Function 0BDF9E29 Relevance: 2.6, Strings: 2, Instructions: 61COMMON

Download Yara Rule

Strings

$]q, xrefs: 0BDF9ED5
$]q, xrefs: 0BDF9EE1

Memory Dump Source

Source File: 00000022.00000002.3350571102.000000000BDF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0BDF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_34_2_bdf0000_FastestVPN.jbxd

Similarity

API ID:
String ID: $]q$$]q
API String ID: 0-127220927
Opcode ID: d209725c8ff60a3fc2d0ee47d7d134e8adce7cc07948e663fc41aa9431aeb2f5
Instruction ID: fe619673ee7357c8f656c8b5aae2b40dfc81c819965e2faeb47446798742b2d8
Opcode Fuzzy Hash: d209725c8ff60a3fc2d0ee47d7d134e8adce7cc07948e663fc41aa9431aeb2f5
Instruction Fuzzy Hash: C611A230A0E1119BD7185F95D02436AF6FAEF84B11F25892BE4838B665CBF9CA048BC5

Function 0BDF61DB Relevance: 2.6, Strings: 2, Instructions: 58COMMON

Download Yara Rule

Strings

4c]q, xrefs: 0BDF61EF
4c]q, xrefs: 0BDF61E4

Memory Dump Source

Source File: 00000022.00000002.3350571102.000000000BDF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0BDF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_34_2_bdf0000_FastestVPN.jbxd

Similarity

API ID:
String ID: 4c]q$4c]q
API String ID: 0-1614972355
Opcode ID: e18b35b2f169561defb4d8b2677ca9950a65a315797bace6dd2768fa3883320e
Instruction ID: ba528d4c28ae61bb4a6c4dbbdae29863a40de7e1ce7bd5a7c2cf7d7de9a7fefc
Opcode Fuzzy Hash: e18b35b2f169561defb4d8b2677ca9950a65a315797bace6dd2768fa3883320e
Instruction Fuzzy Hash: 68213A32D14A0ACBCB11DF68CC401D8F772FF99301F668695E6487B121EB30AA95CB90

Function 0BDF67D1 Relevance: 2.5, Strings: 2, Instructions: 24COMMON

Download Yara Rule

Strings

$]q, xrefs: 0BDF67DA
$]q, xrefs: 0BDF67EA

Memory Dump Source

Source File: 00000022.00000002.3350571102.000000000BDF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0BDF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_34_2_bdf0000_FastestVPN.jbxd

Similarity

API ID:
String ID: $]q$$]q
API String ID: 0-127220927
Opcode ID: d0c0feec18eb597ba8e269efc97d48c9014345dc85e7c0852e7d264083f6ee4b
Instruction ID: a5d17c9589a0b54114ac10aed89bdc151ac4e9ed8c86893a76f2e29dafd48cc2
Opcode Fuzzy Hash: d0c0feec18eb597ba8e269efc97d48c9014345dc85e7c0852e7d264083f6ee4b
Instruction Fuzzy Hash: 35F06D38708049DFCB18CF18D588C9AB7B1FB847A0F6280A5EA564FA19C330DD45DBD0

Function 0BD66C68 Relevance: 1.6, Strings: 1, Instructions: 383COMMON

Download Yara Rule

Strings

(aq, xrefs: 0BD66E82

Memory Dump Source

Source File: 00000022.00000002.3349809863.000000000BD60000.00000040.00000800.00020000.00000000.sdmp, Offset: 0BD60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_34_2_bd60000_FastestVPN.jbxd

Similarity

API ID:
String ID: (aq
API String ID: 0-600464949
Opcode ID: 9f8dcc55332fc1e5ec5969ee3e4b14622afe6c1b842dd2d0d75d6d1e8f8ca4c6
Instruction ID: bdb825787089213c63d002c2740ab6a195490359c480bb8675b2370832d482c5
Opcode Fuzzy Hash: 9f8dcc55332fc1e5ec5969ee3e4b14622afe6c1b842dd2d0d75d6d1e8f8ca4c6
Instruction Fuzzy Hash: A5D18030B002558FCB14DF7DC490AAABBF6FF89750B258969D8569B365DE30EC02CB91

Function 0BD69E08 Relevance: 1.6, Strings: 1, Instructions: 355COMMON

Download Yara Rule

Strings

(aq, xrefs: 0BD6A1A5

Memory Dump Source

Source File: 00000022.00000002.3349809863.000000000BD60000.00000040.00000800.00020000.00000000.sdmp, Offset: 0BD60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_34_2_bd60000_FastestVPN.jbxd

Similarity

API ID:
String ID: (aq
API String ID: 0-600464949
Opcode ID: 56752c1ff75e08e2cc7585a2e022a78cad53948e8050d58d12e290fa6f370906
Instruction ID: 9fa27fb28e8f01f1b0d94e87476c1fc38fe0585db5936eeafa672e299a467b94
Opcode Fuzzy Hash: 56752c1ff75e08e2cc7585a2e022a78cad53948e8050d58d12e290fa6f370906
Instruction Fuzzy Hash: 40F12634A003598FCB15CFA8C898A9DFBF2BF89310F1581A5D845AB365DB74ED46CB50

Function 0BDF5888 Relevance: 1.6, Strings: 1, Instructions: 332COMMON

Download Yara Rule

Strings

Xaq, xrefs: 0BDF6830

Memory Dump Source

Source File: 00000022.00000002.3350571102.000000000BDF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0BDF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_34_2_bdf0000_FastestVPN.jbxd

Similarity

API ID:
String ID: Xaq
API String ID: 0-686314484
Opcode ID: 410277b96a108d759dd4e819b93f093ad40bd0fca6107c39fe7db9ef5a2a47ef
Instruction ID: 0bdfae0bf6189fc4bd17c616b10741716861e0a3b82f3de55216bfbe7bf94047
Opcode Fuzzy Hash: 410277b96a108d759dd4e819b93f093ad40bd0fca6107c39fe7db9ef5a2a47ef
Instruction Fuzzy Hash: BDE1153460461ADFCB18CF69C4C89A8BBF1FF49754F5684A5E9499B260DB30EE84CF90

Function 0BD6E790 Relevance: 1.6, Strings: 1, Instructions: 328COMMON

Download Yara Rule

Strings

(Abq, xrefs: 0BD6EB19

Memory Dump Source

Source File: 00000022.00000002.3349809863.000000000BD60000.00000040.00000800.00020000.00000000.sdmp, Offset: 0BD60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_34_2_bd60000_FastestVPN.jbxd

Similarity

API ID:
String ID: (Abq
API String ID: 0-1163130805
Opcode ID: 71ea8846601e98356c12e7ef10b3dbfd4063490dc6404e916a10574d12c732c8
Instruction ID: 1284fc5d20266f5ce791440f5c9050ec0b2f81ebdb5442018c55837cc89f0f3a
Opcode Fuzzy Hash: 71ea8846601e98356c12e7ef10b3dbfd4063490dc6404e916a10574d12c732c8
Instruction Fuzzy Hash: DFC16C34B002198FDB14DFA9D894AAEBBB2BF88650F148429D406EB394DF749D06CB91

Function 0BD6D978 Relevance: 1.5, Strings: 1, Instructions: 282COMMON

Download Yara Rule

Strings

false,"dns":"us-ash-stream.jumptoserver.com","iso":"US","country_sort":1000,"lt":null,"lg":null,"ip":"108.181.56.100","address":null,"port":4443,"protocol":"IKEV2","ipsec":"psk123","remote_id":"jumptoserver.com","is_trial":false,"active":true,"flag":"https:\/\, xrefs: 0BD6D978, 0BD6D98D

Memory Dump Source

Source File: 00000022.00000002.3349809863.000000000BD60000.00000040.00000800.00020000.00000000.sdmp, Offset: 0BD60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_34_2_bd60000_FastestVPN.jbxd

Similarity

API ID:
String ID: false,"dns":"us-ash-stream.jumptoserver.com","iso":"US","country_sort":1000,"lt":null,"lg":null,"ip":"108.181.56.100","address":null,"port":4443,"protocol":"IKEV2","ipsec":"psk123","remote_id":"jumptoserver.com","is_trial":false,"active":true,"flag":"https:\/\
API String ID: 0-1507960788
Opcode ID: ded776ec01ab1d7c08b627ed9af7dcc3615265a50327d1b96b384ee8ae589778
Instruction ID: 61b1783cc338b9dc71ef19889e2b2f8fe6ed13f17b0b07babb24b35d29a91e33
Opcode Fuzzy Hash: ded776ec01ab1d7c08b627ed9af7dcc3615265a50327d1b96b384ee8ae589778
Instruction Fuzzy Hash: 1DB10874B0061ACFCB04DFA9D59499EBBF6BF89350B108469E806EB364EB70DD42CB51

Function 0BD6D988 Relevance: 1.5, Strings: 1, Instructions: 279COMMON

Download Yara Rule

Strings

false,"dns":"us-ash-stream.jumptoserver.com","iso":"US","country_sort":1000,"lt":null,"lg":null,"ip":"108.181.56.100","address":null,"port":4443,"protocol":"IKEV2","ipsec":"psk123","remote_id":"jumptoserver.com","is_trial":false,"active":true,"flag":"https:\/\, xrefs: 0BD6D98D

Memory Dump Source

Source File: 00000022.00000002.3349809863.000000000BD60000.00000040.00000800.00020000.00000000.sdmp, Offset: 0BD60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_34_2_bd60000_FastestVPN.jbxd

Similarity

API ID:
String ID: false,"dns":"us-ash-stream.jumptoserver.com","iso":"US","country_sort":1000,"lt":null,"lg":null,"ip":"108.181.56.100","address":null,"port":4443,"protocol":"IKEV2","ipsec":"psk123","remote_id":"jumptoserver.com","is_trial":false,"active":true,"flag":"https:\/\
API String ID: 0-1507960788
Opcode ID: 6613196993d0ea63aed9ce1064ce303f01d41939b02f4f7782f7b8ad92c26675
Instruction ID: 1ac30f3ad7d4a711cfd9a7d7edee79037ee911c06364fe7bfe2a625486adb4b3
Opcode Fuzzy Hash: 6613196993d0ea63aed9ce1064ce303f01d41939b02f4f7782f7b8ad92c26675
Instruction Fuzzy Hash: B0B11974B0060ACFCB04DFA9D59499EBBF6BF89340B108469E806EB364EB70DD41CB51

Function 0BDF93E8 Relevance: 1.5, Strings: 1, Instructions: 275COMMON

Download Yara Rule

Strings

(aq, xrefs: 0BDF94A7

Memory Dump Source

Source File: 00000022.00000002.3350571102.000000000BDF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0BDF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_34_2_bdf0000_FastestVPN.jbxd

Similarity

API ID:
String ID: (aq
API String ID: 0-600464949
Opcode ID: 132f6dc429083e6c55b39fe90850e9e8b8cbb2d0521da381151dfe14354784bf
Instruction ID: 26528f129cc9eedbe5c9e7ae4e1feaf4d810b5992328fd06e5ed2129edc86deb
Opcode Fuzzy Hash: 132f6dc429083e6c55b39fe90850e9e8b8cbb2d0521da381151dfe14354784bf
Instruction Fuzzy Hash: 87A18E34B082068FCB149F79D468B7EBBF2EF85710F668869D502CB391DA38DD458B91

Function 0BDFA248 Relevance: 1.5, Strings: 1, Instructions: 246COMMON

Download Yara Rule

Strings

(aq, xrefs: 0BDFA343

Memory Dump Source

Source File: 00000022.00000002.3350571102.000000000BDF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0BDF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_34_2_bdf0000_FastestVPN.jbxd

Similarity

API ID:
String ID: (aq
API String ID: 0-600464949
Opcode ID: 8c646a3bfb095fa826f8108a7ec4a9e3369ae1d87bc89b55cd5c813f098ae642
Instruction ID: 6ec195ce3d1bcf99e8fe05e746035e10aef6b1bf126fd869e4cc54258aa10fb7
Opcode Fuzzy Hash: 8c646a3bfb095fa826f8108a7ec4a9e3369ae1d87bc89b55cd5c813f098ae642
Instruction Fuzzy Hash: 0E719F31B042168FCB05DFADD894A6EBBF6FFC4720B15856AE619CB3A5DA70DC018790

Function 0BDFC771 Relevance: 1.5, Strings: 1, Instructions: 213COMMON

Download Yara Rule

Strings

4c]q, xrefs: 0BDFC941

Memory Dump Source

Source File: 00000022.00000002.3350571102.000000000BDF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0BDF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_34_2_bdf0000_FastestVPN.jbxd

Similarity

API ID:
String ID: 4c]q
API String ID: 0-1015785248
Opcode ID: 152131e78a72779f0dde2cdb5f1afdd3e95b78b35598598da0bd17f751d06a89
Instruction ID: efb5c47c07475e136830b4ed2dc1b633ac5f0944b3445c7bb888b55563a6399f
Opcode Fuzzy Hash: 152131e78a72779f0dde2cdb5f1afdd3e95b78b35598598da0bd17f751d06a89
Instruction Fuzzy Hash: 3081E431A1410ADFCF14DF64D480B99FBB6FF88320F1A8669EA059B256D730DD55CB90

Function 0BD66938 Relevance: 1.4, Strings: 1, Instructions: 191COMMON

Download Yara Rule

Strings

(aq, xrefs: 0BD669AB

Memory Dump Source

Source File: 00000022.00000002.3349809863.000000000BD60000.00000040.00000800.00020000.00000000.sdmp, Offset: 0BD60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_34_2_bd60000_FastestVPN.jbxd

Similarity

API ID:
String ID: (aq
API String ID: 0-600464949
Opcode ID: c6f9d846d55ac4212b2341be32520c6482b21ed1b4c15b609a2f2a64774cc6a8
Instruction ID: a8c194cbdd72c14b5ee8c67e18adabf330e8fa7005e13a26c5fbb7b1dac57d7f
Opcode Fuzzy Hash: c6f9d846d55ac4212b2341be32520c6482b21ed1b4c15b609a2f2a64774cc6a8
Instruction Fuzzy Hash: 8F613B3AB002159FCB01CF69D88099ABBF6FF8D350B1581A9E509DB325DB31ED15DB90

Function 0BD6C550 Relevance: 1.4, Strings: 1, Instructions: 145COMMON

Download Yara Rule

Strings

(aq, xrefs: 0BD6C59D

Memory Dump Source

Source File: 00000022.00000002.3349809863.000000000BD60000.00000040.00000800.00020000.00000000.sdmp, Offset: 0BD60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_34_2_bd60000_FastestVPN.jbxd

Similarity

API ID:
String ID: (aq
API String ID: 0-600464949
Opcode ID: e0aac7c52a0955b0b8b340c1c7eea84b59685cdc9fe56c9e064458492951eb83
Instruction ID: d616ede2881dab0fb37df259747cdddce0b7103d2e44f2fbf173977594eec1ab
Opcode Fuzzy Hash: e0aac7c52a0955b0b8b340c1c7eea84b59685cdc9fe56c9e064458492951eb83
Instruction Fuzzy Hash: 7051B2313046418FC725DF38D454A56FFF6EF99350708C6A9D48A8B766DA30E806CB90

Function 0BD6A6B8 Relevance: 1.4, Strings: 1, Instructions: 120COMMON

Download Yara Rule

Strings

(aq, xrefs: 0BD6A80A

Memory Dump Source

Source File: 00000022.00000002.3349809863.000000000BD60000.00000040.00000800.00020000.00000000.sdmp, Offset: 0BD60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_34_2_bd60000_FastestVPN.jbxd

Similarity

API ID:
String ID: (aq
API String ID: 0-600464949
Opcode ID: 49872dc06cc1e39519298796708af322f9a90133fe5296f144b1f8756b14c458
Instruction ID: 2d4eb1e0291b5815db70cc52af1b7f360e92ddff425152debe0f518d0b26dac7
Opcode Fuzzy Hash: 49872dc06cc1e39519298796708af322f9a90133fe5296f144b1f8756b14c458
Instruction Fuzzy Hash: D541C234B00215DFDB18CF68C894B9ABBF5EF89760F258099E445BB355CA31DD06CBA0

Function 0BD68600 Relevance: 1.4, Strings: 1, Instructions: 119COMMON

Download Yara Rule

Strings

(aq, xrefs: 0BD68624

Memory Dump Source

Source File: 00000022.00000002.3349809863.000000000BD60000.00000040.00000800.00020000.00000000.sdmp, Offset: 0BD60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_34_2_bd60000_FastestVPN.jbxd

Similarity

API ID:
String ID: (aq
API String ID: 0-600464949
Opcode ID: 664287ff5717c6a1460264802914b5a90dba728c1b7662600f2570e673e8bce1
Instruction ID: e795cfc6fb4db9b14cde5aea0f55b0f6aa55577692e1816423097c9e6b6540aa
Opcode Fuzzy Hash: 664287ff5717c6a1460264802914b5a90dba728c1b7662600f2570e673e8bce1
Instruction Fuzzy Hash: 93417D34B00605CFCB14CF59C484A6AF7F2FF89360B25C95AD41AAB365DB31E845DB94

Function 0BD685DF Relevance: 1.4, Strings: 1, Instructions: 111COMMON

Download Yara Rule

Strings

(aq, xrefs: 0BD68624

Memory Dump Source

Source File: 00000022.00000002.3349809863.000000000BD60000.00000040.00000800.00020000.00000000.sdmp, Offset: 0BD60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_34_2_bd60000_FastestVPN.jbxd

Similarity

API ID:
String ID: (aq
API String ID: 0-600464949
Opcode ID: 21aa95f55779bed08a23366288680aadf4f04370f9f7db38b7922ac5c3c4846c
Instruction ID: ef57c1084511e06110e4efd9f2d04436ef3cc4f30db141a22c5f37ca8dd43648
Opcode Fuzzy Hash: 21aa95f55779bed08a23366288680aadf4f04370f9f7db38b7922ac5c3c4846c
Instruction Fuzzy Hash: F7417935B006458FCB14CF58C480A6AFBF2FF89360B25C99AD45AEB365DB31E845DB50

Function 0BD685EF Relevance: 1.4, Strings: 1, Instructions: 111COMMON

Download Yara Rule

Strings

(aq, xrefs: 0BD68624

Memory Dump Source

Source File: 00000022.00000002.3349809863.000000000BD60000.00000040.00000800.00020000.00000000.sdmp, Offset: 0BD60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_34_2_bd60000_FastestVPN.jbxd

Similarity

API ID:
String ID: (aq
API String ID: 0-600464949
Opcode ID: 6b2e479fd6acacd82882c7d37e7ad02d336f910a6a545fdf2733bb589581f7ff
Instruction ID: fb5ecf7a9a1571e599b568037ae4f540c7e30f484886e737afc68c0cac4f546d
Opcode Fuzzy Hash: 6b2e479fd6acacd82882c7d37e7ad02d336f910a6a545fdf2733bb589581f7ff
Instruction Fuzzy Hash: 27418B35B006058FCB14CF58C080A6AF7F2FF88360B25C95AD45A9B355DB31E842DB50

Function 0BD68B08 Relevance: 1.4, Strings: 1, Instructions: 103COMMON

Download Yara Rule

Strings

,aq, xrefs: 0BD68BAC

Memory Dump Source

Source File: 00000022.00000002.3349809863.000000000BD60000.00000040.00000800.00020000.00000000.sdmp, Offset: 0BD60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_34_2_bd60000_FastestVPN.jbxd

Similarity

API ID:
String ID: ,aq
API String ID: 0-3092978723
Opcode ID: 62c90dd37b33fde77f3729b6cbef08f73866b5095516df9360de24c88cf33eb9
Instruction ID: e570e3a34442e18cd1d3b40a5856f6cf97762cff63ac75dc0cf2aa060af2487c
Opcode Fuzzy Hash: 62c90dd37b33fde77f3729b6cbef08f73866b5095516df9360de24c88cf33eb9
Instruction Fuzzy Hash: 19318B35B0020ACFDB04DF78E8407AEBBF5FB88764F1444AAD109D7291EB759905CB91

Function 0BDFC7E0 Relevance: 1.4, Strings: 1, Instructions: 101COMMON

Download Yara Rule

Strings

4c]q, xrefs: 0BDFC941

Memory Dump Source

Source File: 00000022.00000002.3350571102.000000000BDF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0BDF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_34_2_bdf0000_FastestVPN.jbxd

Similarity

API ID:
String ID: 4c]q
API String ID: 0-1015785248
Opcode ID: e548b896724064a56f24bfb8f5b3afb42ad3c47be34f1667e10186b30e459a18
Instruction ID: 8f331a9a08b9f841a02e0e3fbff6d84eb16d67d5503dc1d91107ca286a140755
Opcode Fuzzy Hash: e548b896724064a56f24bfb8f5b3afb42ad3c47be34f1667e10186b30e459a18
Instruction Fuzzy Hash: D031C331A1810ADFDF14DF55D490BA9FBB2FF48320F198269EA44AB242D770DD55CB90

Function 0BC004BC Relevance: 1.3, Strings: 1, Instructions: 89COMMON

Download Yara Rule

Strings

`]bq, xrefs: 0BC00573

Memory Dump Source

Source File: 00000022.00000002.3348680506.000000000BC00000.00000040.00000800.00020000.00000000.sdmp, Offset: 0BC00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_34_2_bc00000_FastestVPN.jbxd

Similarity

API ID:
String ID: `]bq
API String ID: 0-248503667
Opcode ID: 5f7b36cd9b75330146c9f0c22fe3f72bd76e36e82a95f8c1fc3c4b064aabfae6
Instruction ID: 27ba6e4972e6549dd9d250953b049e2d02ffc204bfefca039c3003c3c240cbfc
Opcode Fuzzy Hash: 5f7b36cd9b75330146c9f0c22fe3f72bd76e36e82a95f8c1fc3c4b064aabfae6
Instruction Fuzzy Hash: 8A318D3163A30CDFDF258E49C444BB937B5AF81665F1B8066E8198B2D1CB34DA81CF69

Function 0BDF5198 Relevance: 1.3, Strings: 1, Instructions: 89COMMON

Download Yara Rule

Strings

4']q, xrefs: 0BDF51C7

Memory Dump Source

Source File: 00000022.00000002.3350571102.000000000BDF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0BDF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_34_2_bdf0000_FastestVPN.jbxd

Similarity

API ID:
String ID: 4']q
API String ID: 0-1259897404
Opcode ID: fb024a9033c60a3e930f0a5c88ace85657efdca202de01ec87346c8f0c880457
Instruction ID: 605b2e08d1521611c175a52faaeb3ecb86b891b720036e843968852885ba6324
Opcode Fuzzy Hash: fb024a9033c60a3e930f0a5c88ace85657efdca202de01ec87346c8f0c880457
Instruction Fuzzy Hash: 02318E34B402159FC708DF6CD494AAEBBE6AFCC760B158169E90ADB364DA30ED01CB90

Function 0BDFBF50 Relevance: 1.3, Strings: 1, Instructions: 84COMMON

Download Yara Rule

Strings

PH]q, xrefs: 0BDFBFFB

Memory Dump Source

Source File: 00000022.00000002.3350571102.000000000BDF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0BDF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_34_2_bdf0000_FastestVPN.jbxd

Similarity

API ID:
String ID: PH]q
API String ID: 0-3168235125
Opcode ID: e84dd497332d0e46a2b1a1527c1416bbe17562f603007b781033ca7e32b49b17
Instruction ID: 47b12008093901944403a98bc670126047157fe48c4cbe6d96654028b018a400
Opcode Fuzzy Hash: e84dd497332d0e46a2b1a1527c1416bbe17562f603007b781033ca7e32b49b17
Instruction Fuzzy Hash: B721B131B0400A8FCB14DEA5D858AAEFBE9FF88311F14406AF916D7294DA758D02DBA0

Function 0BD64388 Relevance: 1.3, Strings: 1, Instructions: 81COMMON

Download Yara Rule

Strings

(aq, xrefs: 0BD643D2

Memory Dump Source

Source File: 00000022.00000002.3349809863.000000000BD60000.00000040.00000800.00020000.00000000.sdmp, Offset: 0BD60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_34_2_bd60000_FastestVPN.jbxd

Similarity

API ID:
String ID: (aq
API String ID: 0-600464949
Opcode ID: 7c61dae2924a0a19691d4f2f5e9a6096a8c547f498143c261bf8fcb25925d5d0
Instruction ID: 1690062aae62a76e8ab6d2c9beee395b651dda567f80302f30a6f44ecb246cff
Opcode Fuzzy Hash: 7c61dae2924a0a19691d4f2f5e9a6096a8c547f498143c261bf8fcb25925d5d0
Instruction Fuzzy Hash: E621F2317002059FD704DB6DE4A4D6ABBEAEFC922071484A9E14ACB366DE70EC06DB51

Function 0BD65F88 Relevance: 1.3, Strings: 1, Instructions: 75COMMON

Download Yara Rule

Strings

LR]q, xrefs: 0BD65FB6

Memory Dump Source

Source File: 00000022.00000002.3349809863.000000000BD60000.00000040.00000800.00020000.00000000.sdmp, Offset: 0BD60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_34_2_bd60000_FastestVPN.jbxd

Similarity

API ID:
String ID: LR]q
API String ID: 0-3081347316
Opcode ID: 5cbc658d2a721237de747dbe487e71901ad30788b4dfef1fe7ced98dbc8ded48
Instruction ID: 62386f13f1f5be3dcb9f4fc997528fa29bfd5293b979a073962f78936c4f177b
Opcode Fuzzy Hash: 5cbc658d2a721237de747dbe487e71901ad30788b4dfef1fe7ced98dbc8ded48
Instruction Fuzzy Hash: F5219234F00109DFDB08DF69D458AAEBBF6EF88750F108159E506A7364DEB09C05CBA5

Function 0BD6B3B0 Relevance: 1.3, Strings: 1, Instructions: 70COMMON

Download Yara Rule

Strings

\;]q, xrefs: 0BD6B3F8

Memory Dump Source

Source File: 00000022.00000002.3349809863.000000000BD60000.00000040.00000800.00020000.00000000.sdmp, Offset: 0BD60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_34_2_bd60000_FastestVPN.jbxd

Similarity

API ID:
String ID: \;]q
API String ID: 0-2696284100
Opcode ID: d8b0f92d3431d5891abe1ebda9d2068139b520c5d0ba8cb8aa7bcc8fd6e060fc
Instruction ID: b7452d79d0ea727a1139c39a14cf2b496f3c896cacf29b5e485b6e142a085ea8
Opcode Fuzzy Hash: d8b0f92d3431d5891abe1ebda9d2068139b520c5d0ba8cb8aa7bcc8fd6e060fc
Instruction Fuzzy Hash: BD1173327542024F97149AAEA48596BF7DEEFC42B8314803FE50EC7759EE71EC019350

Function 0BDFBE88 Relevance: 1.3, Strings: 1, Instructions: 66COMMON

Download Yara Rule

Strings

(aq, xrefs: 0BDFBEBF

Memory Dump Source

Source File: 00000022.00000002.3350571102.000000000BDF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0BDF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_34_2_bdf0000_FastestVPN.jbxd

Similarity

API ID:
String ID: (aq
API String ID: 0-600464949
Opcode ID: f66ce1108e22ebcef03a6b2fb770e9bba0072f001d12c0adabc95df1fa29a01d
Instruction ID: 96decac5d58d4890792fc8be21098029ca29f1ebf675560a263ecd66d6e8d6a7
Opcode Fuzzy Hash: f66ce1108e22ebcef03a6b2fb770e9bba0072f001d12c0adabc95df1fa29a01d
Instruction Fuzzy Hash: FB115731B082404FC315AB78A44499DBFB2EFC6710B0546ABD509CB2A6EE708C0A83A1

Function 0BD61B90 Relevance: 1.3, Strings: 1, Instructions: 64COMMON

Download Yara Rule

Strings

8aq, xrefs: 0BD61BF9

Memory Dump Source

Source File: 00000022.00000002.3349809863.000000000BD60000.00000040.00000800.00020000.00000000.sdmp, Offset: 0BD60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_34_2_bd60000_FastestVPN.jbxd

Similarity

API ID:
String ID: 8aq
API String ID: 0-538729646
Opcode ID: de657f4aba878aec4afd188e924ed24a64268f1a8018a4f8ab6d654b4219cc91
Instruction ID: d4f22fe53d5678a63eb4ebf6d95b478a1e39b6df5058215479dc01db251881be
Opcode Fuzzy Hash: de657f4aba878aec4afd188e924ed24a64268f1a8018a4f8ab6d654b4219cc91
Instruction Fuzzy Hash: FA21C635A04129CFDB14EF66E450AEEFBB2FF89760F004229D801B7384DB74A905DBA1

Function 0BDF9E30 Relevance: 1.3, Strings: 1, Instructions: 55COMMON

Download Yara Rule

Strings

$]q, xrefs: 0BDF9ED5

Memory Dump Source

Source File: 00000022.00000002.3350571102.000000000BDF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0BDF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_34_2_bdf0000_FastestVPN.jbxd

Similarity

API ID:
String ID: $]q
API String ID: 0-1007455737
Opcode ID: 4f7e017f9c579511c7b82cebe5ee3337c48424804d9fbcef17c978702907d1b0
Instruction ID: fd377a32515602b56e3faf8856060c3579edf84a08e17d4f6a4c3d18806c5050
Opcode Fuzzy Hash: 4f7e017f9c579511c7b82cebe5ee3337c48424804d9fbcef17c978702907d1b0
Instruction Fuzzy Hash: 1C11C430A1E211DBD7185F55D02836AF7FAEF44B11F25882BE18387A55CBF9CA048BC1

Function 0BD66098 Relevance: 1.3, Strings: 1, Instructions: 52COMMON

Download Yara Rule

Strings

(aq, xrefs: 0BD660F1

Memory Dump Source

Source File: 00000022.00000002.3349809863.000000000BD60000.00000040.00000800.00020000.00000000.sdmp, Offset: 0BD60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_34_2_bd60000_FastestVPN.jbxd

Similarity

API ID:
String ID: (aq
API String ID: 0-600464949
Opcode ID: 23a4c5cc77af38875175839f06bf4982ef29afd816a618efcff1958e2cd87fe6
Instruction ID: 533595f90ced33ed1429b280a0f180f028546059eb81918521a2017c49911445
Opcode Fuzzy Hash: 23a4c5cc77af38875175839f06bf4982ef29afd816a618efcff1958e2cd87fe6
Instruction Fuzzy Hash: 911125322187908FC3268B68A41459ABFE2EF8235470548ADC08287796DFE8A90AC352

Function 0BD6A848 Relevance: 1.3, Strings: 1, Instructions: 43COMMON

Download Yara Rule

Strings

(aq, xrefs: 0BD6A865

Memory Dump Source

Source File: 00000022.00000002.3349809863.000000000BD60000.00000040.00000800.00020000.00000000.sdmp, Offset: 0BD60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_34_2_bd60000_FastestVPN.jbxd

Similarity

API ID:
String ID: (aq
API String ID: 0-600464949
Opcode ID: 8b2fdc301ccb13cd51816c8b84eb21babfe336079ac8862181b90a3502130d09
Instruction ID: b9686aca4456c86e407bc07865451145122740795788cf9730a599923e0f6314
Opcode Fuzzy Hash: 8b2fdc301ccb13cd51816c8b84eb21babfe336079ac8862181b90a3502130d09
Instruction Fuzzy Hash: 5B014931B092918FD70A46788450029BF62EB9259035C80DDC5899F293CE1ADD03C392

Function 0BD6B2B1 Relevance: 1.3, Strings: 1, Instructions: 40COMMON

Download Yara Rule

Strings

,aq, xrefs: 0BD6B324

Memory Dump Source

Source File: 00000022.00000002.3349809863.000000000BD60000.00000040.00000800.00020000.00000000.sdmp, Offset: 0BD60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_34_2_bd60000_FastestVPN.jbxd

Similarity

API ID:
String ID: ,aq
API String ID: 0-3092978723
Opcode ID: aec43dde05700947c3cfcd1f3d52c1f370dd5253ad2b92fa496a3c5681cb83ee
Instruction ID: 033baec87ba5919bbd412c561244ae1ce134b539e05d7c2f727b4dfc3ea0341d
Opcode Fuzzy Hash: aec43dde05700947c3cfcd1f3d52c1f370dd5253ad2b92fa496a3c5681cb83ee
Instruction Fuzzy Hash: 9CF0B4313045218FCB049F79C8456AABBE8FF456A1F1604DBE085CB1A1DF34C840E722

Function 0BDF6E08 Relevance: .6, Instructions: 564COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000022.00000002.3350571102.000000000BDF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0BDF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_34_2_bdf0000_FastestVPN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b534ba49d59b596fa22cbeb40ea9babb6615b0326c4da4065ebec6df56089e79
Instruction ID: 0a783424350a862b490a2bdfd00bb6732f9199e899a627a5591e8a601fc87361
Opcode Fuzzy Hash: b534ba49d59b596fa22cbeb40ea9babb6615b0326c4da4065ebec6df56089e79
Instruction Fuzzy Hash: 6622C331E0420A9FCB15CF68C8809EEBBF6EF89314F158629E915A7394E731ED45CB91

Function 0BDFDF47 Relevance: .5, Instructions: 452COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000022.00000002.3350571102.000000000BDF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0BDF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_34_2_bdf0000_FastestVPN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 03fa133da5b3649738abf4610faa8275ffe10418e86145d2409b16611c4f3994
Instruction ID: d9a903b7937dce3a4fe1cb0ec4f221ad10528f8ae76aa47f54066a436c87beb2
Opcode Fuzzy Hash: 03fa133da5b3649738abf4610faa8275ffe10418e86145d2409b16611c4f3994
Instruction Fuzzy Hash: 1FE1D531B042148FDB64EFA9D4947AEB7F2EB85321F2284A9D507D7390DE70CE918B91

Function 0BDF32F8 Relevance: .3, Instructions: 322COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000022.00000002.3350571102.000000000BDF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0BDF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_34_2_bdf0000_FastestVPN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 716dce7bd9fc7e30c849c3d578ef88bffde090b836a67c99bec1f7461029b4f8
Instruction ID: 25afbf8ae64f070860d60514fe98b74d01cfd8ccd692bed1ef612372c1bca99f
Opcode Fuzzy Hash: 716dce7bd9fc7e30c849c3d578ef88bffde090b836a67c99bec1f7461029b4f8
Instruction Fuzzy Hash: A7D10A35B01119DFCB15DFA4D894DADBBB2FF88720B168069E906AB360DB31ED12CB54

Function 0BDFE71A Relevance: .3, Instructions: 305COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000022.00000002.3350571102.000000000BDF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0BDF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_34_2_bdf0000_FastestVPN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 165b8aed5213561539bcb0c07c6ee0279896994f6f3c0941c4b09650639fd948
Instruction ID: d9bc341d20036cca2691cb6c1d225e94f1e9e3fa026b00aca000ce5e07086a3b
Opcode Fuzzy Hash: 165b8aed5213561539bcb0c07c6ee0279896994f6f3c0941c4b09650639fd948
Instruction Fuzzy Hash: 3AC14C35A042158FDB54AF69D8587AEBBF6EB88310F2145A9D90AE7390DF308E81CF50

Function 0BD69DF8 Relevance: .3, Instructions: 300COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000022.00000002.3349809863.000000000BD60000.00000040.00000800.00020000.00000000.sdmp, Offset: 0BD60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_34_2_bd60000_FastestVPN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 78e501697ad723c9ceca6c6448d94700739e4518f877b3beb6c811df89cd6b13
Instruction ID: cb455239bf4abfcc089030e3a4f9de707f1b5ed2081ba836d6a89ba725c8e81f
Opcode Fuzzy Hash: 78e501697ad723c9ceca6c6448d94700739e4518f877b3beb6c811df89cd6b13
Instruction Fuzzy Hash: 0BD12534A00359CFCB05CFA8C898A9DFBF2BF49310F1581A5E848AB269DB74ED45CB50

Function 0BDFCC08 Relevance: .3, Instructions: 279COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000022.00000002.3350571102.000000000BDF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0BDF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_34_2_bdf0000_FastestVPN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e063a7fa20f74eeba05772ae50ba4dcb00994be264149b5f5c012f5b21a59a5f
Instruction ID: 2db6a9b171b762f2b8968f6f31d084af8213b869a2be66b4c2b4df2b170b142d
Opcode Fuzzy Hash: e063a7fa20f74eeba05772ae50ba4dcb00994be264149b5f5c012f5b21a59a5f
Instruction Fuzzy Hash: BDB15D32E1065A8FCF11CF98C8509DDFB72FF88320F298615E919BB254E771A956CB81

Function 0BD6BEB8 Relevance: .3, Instructions: 273COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000022.00000002.3349809863.000000000BD60000.00000040.00000800.00020000.00000000.sdmp, Offset: 0BD60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_34_2_bd60000_FastestVPN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ae1214acb21e4df7d5a96215688e62830ce646152506c6d1dbbf44c41f145aae
Instruction ID: e9482fc40c5d3048e000eca7bc9637d7f8c8afdc4c9e8046e36edfccbe2d9c16
Opcode Fuzzy Hash: ae1214acb21e4df7d5a96215688e62830ce646152506c6d1dbbf44c41f145aae
Instruction Fuzzy Hash: FFB15A34B006018FCB15EF79D59496EFBF2FF88210B048669D95A8B365EB34ED06CB91

Function 0BDF20B8 Relevance: .3, Instructions: 253COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000022.00000002.3350571102.000000000BDF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0BDF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_34_2_bdf0000_FastestVPN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 43dee8cb23408848522b9990bc50449ca6bc58cb3ee38c33d87a4467002a7fca
Instruction ID: 8ef88b5f72e1e45d5368fa0043e3a6c3ff471907ec6eb733744f14fadb04d787
Opcode Fuzzy Hash: 43dee8cb23408848522b9990bc50449ca6bc58cb3ee38c33d87a4467002a7fca
Instruction Fuzzy Hash: BD917F74A0821ADFCB149F55C8549AEFBFAFF88770B114429FA569B324DA30DD40DBA0

Function 0BDF3D18 Relevance: .2, Instructions: 240COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000022.00000002.3350571102.000000000BDF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0BDF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_34_2_bdf0000_FastestVPN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d2ea1a21466f6d598e551d68c00ef7d4e2a8490c43ebbfbb4f52c838943db563
Instruction ID: 44e31ca58c208e41f1c2c3f3a340d61fc8964d1b4435cecd0e14e4ba50123e0e
Opcode Fuzzy Hash: d2ea1a21466f6d598e551d68c00ef7d4e2a8490c43ebbfbb4f52c838943db563
Instruction Fuzzy Hash: 7C81AF35704206DFCB14DF68D894AAAFBB6EF89320B118569EA06CB360DB31DD15DB90

Function 0BDFBC58 Relevance: .2, Instructions: 219COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000022.00000002.3350571102.000000000BDF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0BDF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_34_2_bdf0000_FastestVPN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d18fadcdba4f97333a80e7712679a4125cace46e88649d5eb2eab68df13e6b6e
Instruction ID: ca49de46a5bd5f4b3b0a761c874523a71a0130ba97158079104d3fd4623af160
Opcode Fuzzy Hash: d18fadcdba4f97333a80e7712679a4125cace46e88649d5eb2eab68df13e6b6e
Instruction Fuzzy Hash: A271B335B0820ACFCB10DFA9D8549AEFBB6FF84220B15856BD616DB351DB30D905CB91

Function 0BDF6CDB Relevance: .2, Instructions: 214COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000022.00000002.3350571102.000000000BDF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0BDF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_34_2_bdf0000_FastestVPN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a49a6a9065c10e51ed1a818cc9d8e188f0b7c961118a7705a803a4697f7fd487
Instruction ID: 322363f7135dfbea80bf408508d4f1fcf378b415375befb7680a422ecf78b0a7
Opcode Fuzzy Hash: a49a6a9065c10e51ed1a818cc9d8e188f0b7c961118a7705a803a4697f7fd487
Instruction Fuzzy Hash: F6818231E04209EFCB05DFA9D8909AEFBB5FF88310F11C559E959AB254E730AD41CB90

Function 0BDFC1A0 Relevance: .2, Instructions: 197COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000022.00000002.3350571102.000000000BDF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0BDF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_34_2_bdf0000_FastestVPN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7f5dda36a03a50d34b338ea6df0798a2d304668866cf1f5bd9f4e9702c2874e5
Instruction ID: f8f357421d266daa91465de1ce58249832c332b86a8f39df5cfb32e6b2fca42b
Opcode Fuzzy Hash: 7f5dda36a03a50d34b338ea6df0798a2d304668866cf1f5bd9f4e9702c2874e5
Instruction Fuzzy Hash: CA61C130B1420A9FCB14DFA9D444AAEBBF6FF84310F158569E505DB3A5DB349E05CB90

Function 0BD6BEA8 Relevance: .2, Instructions: 197COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000022.00000002.3349809863.000000000BD60000.00000040.00000800.00020000.00000000.sdmp, Offset: 0BD60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_34_2_bd60000_FastestVPN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0b8358cb82581b5010cfad722a3bae94540e0a03d6460d21a4bd8182c1692020
Instruction ID: 6eb1fa5f6318d0b433e4b0aaa06184cb83de74487ff05603b25913daaf8c0fc1
Opcode Fuzzy Hash: 0b8358cb82581b5010cfad722a3bae94540e0a03d6460d21a4bd8182c1692020
Instruction Fuzzy Hash: 21818B34B006018FCB15DF79D59496EFBF2FF89210B048669D9568B355DB34E80ACBA1

Function 0BD6ED68 Relevance: .2, Instructions: 186COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000022.00000002.3349809863.000000000BD60000.00000040.00000800.00020000.00000000.sdmp, Offset: 0BD60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_34_2_bd60000_FastestVPN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ce05350d2481c5bfd6204c697255c7b27d7614e8d0990b37e6da9b54280922d0
Instruction ID: 02261769c15db907f4d3b817b1d38e4fb6528cf4e4ec0364970d847e2a5bcd41
Opcode Fuzzy Hash: ce05350d2481c5bfd6204c697255c7b27d7614e8d0990b37e6da9b54280922d0
Instruction Fuzzy Hash: 2861A035B012058FDB14DF65E554A6EFBF6BF88A50B208429E406EB394EF70DC06CB92

Function 0BDF9C40 Relevance: .2, Instructions: 183COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000022.00000002.3350571102.000000000BDF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0BDF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_34_2_bdf0000_FastestVPN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 65ae7b8261829beedb908383974d98d184c88ad1daa89b2fbe277db5eddeaf11
Instruction ID: 538d981055ac56756d10848b1c1a5119e37ff63c5ad35d54483b2070a16580c2
Opcode Fuzzy Hash: 65ae7b8261829beedb908383974d98d184c88ad1daa89b2fbe277db5eddeaf11
Instruction Fuzzy Hash: 83519F71B047069FCB24CFAAD890A6BF7E6FF84224B24892DE646C7714D775E805CB90

Function 0BD66C58 Relevance: .2, Instructions: 150COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000022.00000002.3349809863.000000000BD60000.00000040.00000800.00020000.00000000.sdmp, Offset: 0BD60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_34_2_bd60000_FastestVPN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7956a27483f6b687a5bd2ca1ad8a85108bc85bffd205b67df44507815d9a486a
Instruction ID: d1dad33898ed76102cedb90d13a1ceabf42d833c1160a6210be1e8267164e5fc
Opcode Fuzzy Hash: 7956a27483f6b687a5bd2ca1ad8a85108bc85bffd205b67df44507815d9a486a
Instruction Fuzzy Hash: 5B515C34B002068FCB04DF69D950AAEBBE6FF84360B15C569E4099B365EB30ED05CB91

Function 0BDF1890 Relevance: .1, Instructions: 149COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000022.00000002.3350571102.000000000BDF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0BDF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_34_2_bdf0000_FastestVPN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 44f963b8f793dbb37a41c95cff166df9bd4346b86e9d925d94eec5450d20402c
Instruction ID: 6c68515f4c8c0ce950f92bd4838c84d2de8c9a7800e982339446672692266cc9
Opcode Fuzzy Hash: 44f963b8f793dbb37a41c95cff166df9bd4346b86e9d925d94eec5450d20402c
Instruction Fuzzy Hash: 3751D630704202CFDB14DF75E984A6AFBF6EFC5210B0445AAC956DB3A5DB30D816D7A2

Function 0BD66529 Relevance: .1, Instructions: 149COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000022.00000002.3349809863.000000000BD60000.00000040.00000800.00020000.00000000.sdmp, Offset: 0BD60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_34_2_bd60000_FastestVPN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4f8522a73d3217ac0e8b19a464b4a31ddc3ab959c2bb227dbad49c4692b5ba32
Instruction ID: dad9a67a928bde64df8967326e44033942a21221e6ae858c2f3b097edfc2a9d7
Opcode Fuzzy Hash: 4f8522a73d3217ac0e8b19a464b4a31ddc3ab959c2bb227dbad49c4692b5ba32
Instruction Fuzzy Hash: F851E770A00219DFDB05DBE4D550AEFFBB7EF88310F104129D6066B3A5EA395D05DB92

Function 0BDF2417 Relevance: .1, Instructions: 145COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000022.00000002.3350571102.000000000BDF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0BDF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_34_2_bdf0000_FastestVPN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 69265313d0a4928dc20224681860ab70e3dab7e5d0e5e34de275ca75fa60048c
Instruction ID: e9361711015c4703f838c64c52f921a9f29dab24aaeb8220b8e85801a618a41f
Opcode Fuzzy Hash: 69265313d0a4928dc20224681860ab70e3dab7e5d0e5e34de275ca75fa60048c
Instruction Fuzzy Hash: 30516A35304206DFDB15EF64E854A6ABBB6EF88315B20452DE606C73A4CB72EC02DB61

Function 0BDF5708 Relevance: .1, Instructions: 144COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000022.00000002.3350571102.000000000BDF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0BDF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_34_2_bdf0000_FastestVPN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 85c3fcc2c700618730f5f1755fec93a612afc951954969fd49de5ff7817b2d53
Instruction ID: ed5d69f01cb964d824b4b96ed987439aaa3747821cece8afac26def5ef1e2b05
Opcode Fuzzy Hash: 85c3fcc2c700618730f5f1755fec93a612afc951954969fd49de5ff7817b2d53
Instruction Fuzzy Hash: BD51D031705212DFCF05CF68D88496ABBB6FF49724B1580AAEA05CB366D731DC41CBA0

Function 0BD66538 Relevance: .1, Instructions: 142COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000022.00000002.3349809863.000000000BD60000.00000040.00000800.00020000.00000000.sdmp, Offset: 0BD60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_34_2_bd60000_FastestVPN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 231bef235838c87292dc99b9290adf86e190ebe6dae3175a5c3801012aea5e17
Instruction ID: 04aea6798d5e562e05e3d31ec9659e97ad388d0f30ffdf30952de4a5738711c2
Opcode Fuzzy Hash: 231bef235838c87292dc99b9290adf86e190ebe6dae3175a5c3801012aea5e17
Instruction Fuzzy Hash: 4C51D474A002099FDB05DBE4D950AEFFBB7EF88310F108129D606673A4EA395E05DB92

Function 0BD64E29 Relevance: .1, Instructions: 141COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000022.00000002.3349809863.000000000BD60000.00000040.00000800.00020000.00000000.sdmp, Offset: 0BD60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_34_2_bd60000_FastestVPN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f823b95a257e32a989fa30460d6cc2b865469870d50d07413bfd5c0d16fab32a
Instruction ID: 363145cad9bfdd4bbc830ef968b1d940e8a13ef625659657197678f377b89c92
Opcode Fuzzy Hash: f823b95a257e32a989fa30460d6cc2b865469870d50d07413bfd5c0d16fab32a
Instruction Fuzzy Hash: B9514974A00209DFDB05EFA5E854AEEFBB6FF88300F10882CD916673A4DA355D04CB65

Function 0BDFA658 Relevance: .1, Instructions: 138COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000022.00000002.3350571102.000000000BDF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0BDF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_34_2_bdf0000_FastestVPN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3113766ebf1e953631132700ebf3e974507a4ddedffef7c6c7d26a933f4ff181
Instruction ID: 661efe971a1121f5bb9f2766519d89dcbb1097e52f9dc9af41586f43ae70f4f9
Opcode Fuzzy Hash: 3113766ebf1e953631132700ebf3e974507a4ddedffef7c6c7d26a933f4ff181
Instruction Fuzzy Hash: 27518E34704A129FC715DF69C49492EF7F2FF887107228959D50A8B7A1DB74ED82CB90

Function 0BD64E38 Relevance: .1, Instructions: 136COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000022.00000002.3349809863.000000000BD60000.00000040.00000800.00020000.00000000.sdmp, Offset: 0BD60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_34_2_bd60000_FastestVPN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1d42b1e2c8d3d1e3b46dad7027190c16ac455a3112e32ca3aca1381bf28411c2
Instruction ID: 9a45f7eb24610ed9b0dc637a81d0d63df3e89f8230b63b4fa2f6530a40514101
Opcode Fuzzy Hash: 1d42b1e2c8d3d1e3b46dad7027190c16ac455a3112e32ca3aca1381bf28411c2
Instruction Fuzzy Hash: D4511875A00209DFDB04EFA5E954AEEFBB6FF88300F108828D916673A4DA355D05CB65

Function 0BDF0040 Relevance: .1, Instructions: 135COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000022.00000002.3350571102.000000000BDF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0BDF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_34_2_bdf0000_FastestVPN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e10cd639568a90ad02185c8bfa35fb81d6f4ffe26f68bc49a7cedd963f86f769
Instruction ID: 0dbd6864786d04c9a708e240f4e263aa62985f684fe28eace1d0effd6267f144
Opcode Fuzzy Hash: e10cd639568a90ad02185c8bfa35fb81d6f4ffe26f68bc49a7cedd963f86f769
Instruction Fuzzy Hash: 3741A179B001068FCB14DF68C9819AEF7F6EF88260B118175DA09D7356EB31EC42CBA1

Function 0BD622C0 Relevance: .1, Instructions: 135COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000022.00000002.3349809863.000000000BD60000.00000040.00000800.00020000.00000000.sdmp, Offset: 0BD60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_34_2_bd60000_FastestVPN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1653ecab0dafddaf5539e3c48ae355d0f80a6cfc796dddc03b51cc693f6b8bb3
Instruction ID: 78375328f019f1110c27d2756f6e7bb9e5bf7420243592274f3337f60a3f52b5
Opcode Fuzzy Hash: 1653ecab0dafddaf5539e3c48ae355d0f80a6cfc796dddc03b51cc693f6b8bb3
Instruction Fuzzy Hash: BD518034A01225DFCB04EF66E454BAEBBF6EB88350F148229D805A7359DB34DC46CB90

Function 0BD6CAF3 Relevance: .1, Instructions: 120COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000022.00000002.3349809863.000000000BD60000.00000040.00000800.00020000.00000000.sdmp, Offset: 0BD60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_34_2_bd60000_FastestVPN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 31952c911186c3cb51614e6727c7a9377c1780d34c1a06fa2f0596218447331e
Instruction ID: a3242cad3a13208fc377499fd9ab4c46ba113bac11788d0ba15e306172d49b83
Opcode Fuzzy Hash: 31952c911186c3cb51614e6727c7a9377c1780d34c1a06fa2f0596218447331e
Instruction Fuzzy Hash: F931902260E3E05FDB039B7CACA45957FB5DF83264B0E00E7C084DF1A7D659984AC3A6

Function 0BD6E770 Relevance: .1, Instructions: 116COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000022.00000002.3349809863.000000000BD60000.00000040.00000800.00020000.00000000.sdmp, Offset: 0BD60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_34_2_bd60000_FastestVPN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 472f14b8c547767ed64bf10f2cbb7b357d835c7438da4361a25aceae336e1eac
Instruction ID: 6aa44ac31c512a1745f1664e4b8905307ab9a944c63b671094984176242dd000
Opcode Fuzzy Hash: 472f14b8c547767ed64bf10f2cbb7b357d835c7438da4361a25aceae336e1eac
Instruction Fuzzy Hash: BD416B35E002598FCB05DFA9D59099EFBB2FF89350F15816AE801AB365DB30ED46CB90

Function 0BDFC190 Relevance: .1, Instructions: 110COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000022.00000002.3350571102.000000000BDF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0BDF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_34_2_bdf0000_FastestVPN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 055817a6c82b66b881ec94f4d17e49e8248e5b75fc4bb7f86222ebca82ed3762
Instruction ID: 15d7704c33ab720a604bc955d15d6d7f010d301cb927c7416ac3f253571ab7b7
Opcode Fuzzy Hash: 055817a6c82b66b881ec94f4d17e49e8248e5b75fc4bb7f86222ebca82ed3762
Instruction Fuzzy Hash: DE416D30A1020A8FCB14DFA8D888AAEBBF6FF84310F158569E515DB3A5DB74DD45CB90

Function 0BD6675F Relevance: .1, Instructions: 109COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000022.00000002.3349809863.000000000BD60000.00000040.00000800.00020000.00000000.sdmp, Offset: 0BD60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_34_2_bd60000_FastestVPN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aac0a4e246c86dc4f86ba299f08b5379c7f4b00b56353b194a94f659b01d409f
Instruction ID: c07b7f455900275ed7fb01b72d0d24a93b878e6e4d32b4c7bbc39dd3d3d453bf
Opcode Fuzzy Hash: aac0a4e246c86dc4f86ba299f08b5379c7f4b00b56353b194a94f659b01d409f
Instruction Fuzzy Hash: 50418E30A01209DFCB05DFA8E590AAEFBF6FF89354F50866AD0059B345EB30E945CB91

Function 0BDF01B9 Relevance: .1, Instructions: 107COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000022.00000002.3350571102.000000000BDF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0BDF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_34_2_bdf0000_FastestVPN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0242f0e2b5502fe9a2a0c06da9c1b660619939b305d6cd5057f4647d9bee788e
Instruction ID: cdad699ee1344d5581a0eaf29717d52253afdfc7d71d65585c26c8f29692b37a
Opcode Fuzzy Hash: 0242f0e2b5502fe9a2a0c06da9c1b660619939b305d6cd5057f4647d9bee788e
Instruction Fuzzy Hash: F141AE307042558FCB15DF69D888A6EFBFAAF89210B044869E146CB366DB34E909CB61

Function 0BDFA4F6 Relevance: .1, Instructions: 107COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000022.00000002.3350571102.000000000BDF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0BDF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_34_2_bdf0000_FastestVPN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b335c1473c1047a813f6dfd509cd3d563a28cca87c80476d3215bc57af14a1d3
Instruction ID: de7d5d925a73f07f82da4afc6f9bd20ac80a2c99fe62c44959645fa38b6f4769
Opcode Fuzzy Hash: b335c1473c1047a813f6dfd509cd3d563a28cca87c80476d3215bc57af14a1d3
Instruction Fuzzy Hash: 61318134618B138FD7248B58D09473AF7F1FB44725F12C81ADA8F86B81D7B8E8819A40

Function 0BD6D810 Relevance: .1, Instructions: 107COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000022.00000002.3349809863.000000000BD60000.00000040.00000800.00020000.00000000.sdmp, Offset: 0BD60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_34_2_bd60000_FastestVPN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ed716538b8bc32af3de0c9b4dc3e6309f3b2e36bd515acdd168b7fcd11196a95
Instruction ID: fd9554bdf42481aaa762164b3d9d374deff0fd65c360dea1acb51f0ad1d8cddc
Opcode Fuzzy Hash: ed716538b8bc32af3de0c9b4dc3e6309f3b2e36bd515acdd168b7fcd11196a95
Instruction Fuzzy Hash: D6415331A00205CFC725EBA4F458BAEF7B7EF84354F148539C12697690DF74A949CBA1

Function 0BDF01C8 Relevance: .1, Instructions: 103COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000022.00000002.3350571102.000000000BDF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0BDF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_34_2_bdf0000_FastestVPN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5bfa7122595574e832b552d965f46cc63b784c6d080ca26720da0c1b9605f4e7
Instruction ID: 27346ebb9151144bb3fce9cad6b7b3eb458c9665b218fe3974c63a9fd7524bcc
Opcode Fuzzy Hash: 5bfa7122595574e832b552d965f46cc63b784c6d080ca26720da0c1b9605f4e7
Instruction Fuzzy Hash: CF41BF30704255CFCB15DF68D888A6EFBFAAF89310B044969E146C7366DB34ED09CB60

Function 0BD60EAC Relevance: .1, Instructions: 103COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000022.00000002.3349809863.000000000BD60000.00000040.00000800.00020000.00000000.sdmp, Offset: 0BD60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_34_2_bd60000_FastestVPN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b62ef82fab3433dbeaaf6a039789f6ea0f5239a226935f7036a01366d45707f2
Instruction ID: fe023eeb53a8eed874a986ab1db52ec38ad8e94a43612e1020672c6f4b213eda
Opcode Fuzzy Hash: b62ef82fab3433dbeaaf6a039789f6ea0f5239a226935f7036a01366d45707f2
Instruction Fuzzy Hash: 7841E3B1D01209DBDB20DFA9C584ADDFFB5BF49714F24802AE408BB251D775AA4ACF90

Function 0BDF9570 Relevance: .1, Instructions: 100COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000022.00000002.3350571102.000000000BDF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0BDF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_34_2_bdf0000_FastestVPN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0708b085dceb4413c2a98b9420ef1d2975a86daa402910d26a188362df75a168
Instruction ID: 79d1a30a91c442a375e406501570ddfe8ee0979c983cfe25142ed921081bb3c6
Opcode Fuzzy Hash: 0708b085dceb4413c2a98b9420ef1d2975a86daa402910d26a188362df75a168
Instruction Fuzzy Hash: 5F31B430F082069FDB249F65D47876ABBF2AB80711F628868D642CB781DB38D945CB41

Function 0BD618EE Relevance: .1, Instructions: 99COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000022.00000002.3349809863.000000000BD60000.00000040.00000800.00020000.00000000.sdmp, Offset: 0BD60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_34_2_bd60000_FastestVPN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c0398613838461f0d2cf83baa88aea78f68d4f12eb390a1e6b517b424af11302
Instruction ID: a1bf847a2d022d2fe7bf2afcede107d462beb6ed432c810ad423382df7b66f65
Opcode Fuzzy Hash: c0398613838461f0d2cf83baa88aea78f68d4f12eb390a1e6b517b424af11302
Instruction Fuzzy Hash: 9731C131B05219CBDB15EB7AD0146EEFBB2EFC8364F10882DC416A7384EF3589469B51

Function 0BD60EB8 Relevance: .1, Instructions: 96COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000022.00000002.3349809863.000000000BD60000.00000040.00000800.00020000.00000000.sdmp, Offset: 0BD60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_34_2_bd60000_FastestVPN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6b6c829446e16f9549334352fcbc55fcea618b68b101811462ac666aad403625
Instruction ID: 176629530a58254670f5580369caa993a5a5ca7156c0d07296df4f104402bcf3
Opcode Fuzzy Hash: 6b6c829446e16f9549334352fcbc55fcea618b68b101811462ac666aad403625
Instruction Fuzzy Hash: C341D2B1D01309DBDB20DFA9C584ADDFBB5BF48354F24812AE408BB254D775AA4ACF90

Function 0BD61E30 Relevance: .1, Instructions: 94COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000022.00000002.3349809863.000000000BD60000.00000040.00000800.00020000.00000000.sdmp, Offset: 0BD60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_34_2_bd60000_FastestVPN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 01c082d1b99220c8a28b17bfbd4463dcb4b58e513f663767a16f5c40396bf2cd
Instruction ID: fbdd9698484137376b9dcba7eb1d16b47363acad38dca580756ea621c7aed1e6
Opcode Fuzzy Hash: 01c082d1b99220c8a28b17bfbd4463dcb4b58e513f663767a16f5c40396bf2cd
Instruction Fuzzy Hash: CF31E530B012258FDB24DF6AE984B6ABBF6AF84350F049564D404FB2A6DB30DC40D7A1

Function 0BDF6980 Relevance: .1, Instructions: 92COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000022.00000002.3350571102.000000000BDF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0BDF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_34_2_bdf0000_FastestVPN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4bdb3f7bd5b22a5900869ed4ebbaa11e0abcf2efb6f4a0ad8d8268c8913c6889
Instruction ID: 2bd8c2a6e0e25f4bede5990c59d219abdc8941139040c193dc6e40c892b99aad
Opcode Fuzzy Hash: 4bdb3f7bd5b22a5900869ed4ebbaa11e0abcf2efb6f4a0ad8d8268c8913c6889
Instruction Fuzzy Hash: 913167352046059FC754DF29D884E6ABBF9FF88724B11846AE946CBB60EB70F845CB50

Function 0BDF1803 Relevance: .1, Instructions: 90COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000022.00000002.3350571102.000000000BDF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0BDF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_34_2_bdf0000_FastestVPN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6983d231890f1d062cf6b68cd045c7169d9c755316a8c38df7cef82a624a66e5
Instruction ID: 4c9218af785286bda99043e76a42957860e050fb39a504c572ae62e0903e6410
Opcode Fuzzy Hash: 6983d231890f1d062cf6b68cd045c7169d9c755316a8c38df7cef82a624a66e5
Instruction Fuzzy Hash: 6531263160460AEFC715DB69D880D9AFBB5FF85320B118A66D52DC7611CB30F855CBE1

Function 0BD61E2A Relevance: .1, Instructions: 90COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000022.00000002.3349809863.000000000BD60000.00000040.00000800.00020000.00000000.sdmp, Offset: 0BD60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_34_2_bd60000_FastestVPN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eb5e9c7be3206d2a0fb943026e290abba755c95b1cfc52ae3499c074fca713a4
Instruction ID: ba5e1b9bf114903ae0196739e1aa56fd4182146209bc96939d18e2252290da8f
Opcode Fuzzy Hash: eb5e9c7be3206d2a0fb943026e290abba755c95b1cfc52ae3499c074fca713a4
Instruction Fuzzy Hash: A231C330B011258FDB24DF69E984B6ABBF6AF84364F0495A5D404FB2A6DB30DC44DBA0

Function 0BD60DA1 Relevance: .1, Instructions: 89COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000022.00000002.3349809863.000000000BD60000.00000040.00000800.00020000.00000000.sdmp, Offset: 0BD60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_34_2_bd60000_FastestVPN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 74dfd24720f8c1f0ee569e1d1a50835040e211a5ab8e3de817fa28e3fe3b7627
Instruction ID: f38c91c1e412103af0c23ae834b239f5565d0acad39fef6532f0794f50b7ff22
Opcode Fuzzy Hash: 74dfd24720f8c1f0ee569e1d1a50835040e211a5ab8e3de817fa28e3fe3b7627
Instruction Fuzzy Hash: 0D31F4326046404FCB01EB78D4945DABFF6EF86310B1589AED586CB352EB31D80ACB91

Function 0BD60C50 Relevance: .1, Instructions: 89COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000022.00000002.3349809863.000000000BD60000.00000040.00000800.00020000.00000000.sdmp, Offset: 0BD60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_34_2_bd60000_FastestVPN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 684db0d833b304f0dc1bc06d8ead6915f70f9689d9e443783de39c77d1baf2ce
Instruction ID: 2f8af7005dfd778ae465af72e3b1191ed04a86622562c0060de10ede9613e898
Opcode Fuzzy Hash: 684db0d833b304f0dc1bc06d8ead6915f70f9689d9e443783de39c77d1baf2ce
Instruction Fuzzy Hash: 75312BB1E002489FCB14DFAAD844ADEFFF9EB49210F10846AD419E7351D774A9458BA0

Function 0BD62A30 Relevance: .1, Instructions: 88COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000022.00000002.3349809863.000000000BD60000.00000040.00000800.00020000.00000000.sdmp, Offset: 0BD60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_34_2_bd60000_FastestVPN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ef2c3451c14e2b3a13a1c72b1e7389add78b8060784a12110d85d7b54c9d73db
Instruction ID: 4ed919202bb8b41efaf56887f497a1e4f75450ac731a05ec37929bdb3302609a
Opcode Fuzzy Hash: ef2c3451c14e2b3a13a1c72b1e7389add78b8060784a12110d85d7b54c9d73db
Instruction Fuzzy Hash: 63313A71D106198FCB15CF95D844ADDFBB2FF89310F558195E848BB214DBB0698A8F90

Function 012DECD0 Relevance: .1, Instructions: 83COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000022.00000002.3302126104.00000000012DD000.00000040.00000800.00020000.00000000.sdmp, Offset: 012DD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_34_2_12dd000_FastestVPN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 71f95744be975ac10e59efd4f8b5ffca5af7884ea7d0be2e6f49e35a59a02fe4
Instruction ID: 111dfd031f35faf6c20eb156710b31129ffa289eca71eed9724165c40ff25740
Opcode Fuzzy Hash: 71f95744be975ac10e59efd4f8b5ffca5af7884ea7d0be2e6f49e35a59a02fe4
Instruction Fuzzy Hash: F031F872110200EFDF069F58D9C0F167F6AFF88310F258599EE090E25AC736D455DBA1

Function 0BDF32E8 Relevance: .1, Instructions: 82COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000022.00000002.3350571102.000000000BDF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0BDF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_34_2_bdf0000_FastestVPN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 18367f8dcb0051160e1f8785a23cea27dd7814ff025c5d03a52fe8ecf8fcbe1a
Instruction ID: 773705914e089c38242ed723aa900572c8ca381b1a4c63481105120245740a3d
Opcode Fuzzy Hash: 18367f8dcb0051160e1f8785a23cea27dd7814ff025c5d03a52fe8ecf8fcbe1a
Instruction Fuzzy Hash: 6C210031B046108FCB09EB38D85482EB7E2EF8967031284A9D906DB365DE30DC06CB65

Function 012DEBD4 Relevance: .1, Instructions: 80COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000022.00000002.3302126104.00000000012DD000.00000040.00000800.00020000.00000000.sdmp, Offset: 012DD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_34_2_12dd000_FastestVPN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8ac0d3d878edd67943988d6ba7f18f9e9737d0813c8371fb82df78f26dd168ec
Instruction ID: 444003ffa6a9d0d6da9a899947351d104f65dc77c06d46b1d86328a29ae8375f
Opcode Fuzzy Hash: 8ac0d3d878edd67943988d6ba7f18f9e9737d0813c8371fb82df78f26dd168ec
Instruction Fuzzy Hash: C821F7B2514240EFCF069F54DAC0F26BF65FB88314F25C6A9EE090E256C376D416DBA1

Function 0BDF93D9 Relevance: .1, Instructions: 79COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000022.00000002.3350571102.000000000BDF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0BDF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_34_2_bdf0000_FastestVPN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 53e42f947033f2667a8cac9980113b3a2f210aa8cea196bedf1a7b0f45af60bd
Instruction ID: e443ee3da7dff18194102c585db7c864ce54bb56b864dca1abe2d042e78ff6e8
Opcode Fuzzy Hash: 53e42f947033f2667a8cac9980113b3a2f210aa8cea196bedf1a7b0f45af60bd
Instruction Fuzzy Hash: 4221CF35F006068F8B04ABA9E89497EFBFBFFC5220361456AE215CB360DE31DC068B51

Function 0BD622BA Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000022.00000002.3349809863.000000000BD60000.00000040.00000800.00020000.00000000.sdmp, Offset: 0BD60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_34_2_bd60000_FastestVPN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3a1d2d52051cfd57f2b608a1eb271420cace00d19c645cb834d3b85aeafe85ba
Instruction ID: 5fd3f594b7835bf760f666647c1446841f366f8903b2d83df90c1a3c1c4f02b4
Opcode Fuzzy Hash: 3a1d2d52051cfd57f2b608a1eb271420cace00d19c645cb834d3b85aeafe85ba
Instruction Fuzzy Hash: D1316F35A01228DFCB05EF66E4546EEBBB7EF88350F144529D805A7359DB349C46CBA0

Function 0BD61F87 Relevance: .1, Instructions: 74COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000022.00000002.3349809863.000000000BD60000.00000040.00000800.00020000.00000000.sdmp, Offset: 0BD60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_34_2_bd60000_FastestVPN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9e1487713fb0bb539cd835e95c2174fdcd13542340122717cc33464c66dd520b
Instruction ID: 081f178df5704cb58d4a2b15b664e1cc44d810b80b33c7451f037f7e8deaa67d
Opcode Fuzzy Hash: 9e1487713fb0bb539cd835e95c2174fdcd13542340122717cc33464c66dd520b
Instruction Fuzzy Hash: 6F21A134B001158FCB04DF75E5546ADBBB6AF88350F144929D502EB3A4DF79DD058BA1

Function 012DD320 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000022.00000002.3302126104.00000000012DD000.00000040.00000800.00020000.00000000.sdmp, Offset: 012DD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_34_2_12dd000_FastestVPN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8296f912b2922b2ad21a72ea52991da7e27f9894a6f6bd2605a6e464d96cecea
Instruction ID: df5c5f507663b31b32040e1525ef31ef6d257208b49fe9f74192d9770f1a3197
Opcode Fuzzy Hash: 8296f912b2922b2ad21a72ea52991da7e27f9894a6f6bd2605a6e464d96cecea
Instruction Fuzzy Hash: 81216470214608DFCB45DFA8D9C0B26BF65FB84314F20C96DEA494B292C77AD446CF61

Function 012DD01C Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000022.00000002.3302126104.00000000012DD000.00000040.00000800.00020000.00000000.sdmp, Offset: 012DD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_34_2_12dd000_FastestVPN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d556fb7c36634c8207b7d6e34912d4e4eab4fa2b420bbffd86311fc1c04f33f0
Instruction ID: 6a9e1533d5c2f4b996ef846caa8e47105515a688e78513a38283c90cb7934fe0
Opcode Fuzzy Hash: d556fb7c36634c8207b7d6e34912d4e4eab4fa2b420bbffd86311fc1c04f33f0
Instruction Fuzzy Hash: 24212271614608DFCB15DF68D980B26BF65FBC8315F20C56DD90A0B296C37AD407CAA1

Function 0BDFC338 Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000022.00000002.3350571102.000000000BDF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0BDF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_34_2_bdf0000_FastestVPN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f3f91730a3a06e263f351cb8960f6be3cfca85e45ccd95b73f9614b27fd33a41
Instruction ID: a040b68efe0c5635e52d044935e6d7d1fccd13b3ac33f7e67235e1e88acf6877
Opcode Fuzzy Hash: f3f91730a3a06e263f351cb8960f6be3cfca85e45ccd95b73f9614b27fd33a41
Instruction Fuzzy Hash: ED11DF31E1820DEFCB05EFA9E9505ADBFF5EF85250B1445AAC545A7240DA309F05DB81

Function 0BD6AF62 Relevance: .1, Instructions: 67COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000022.00000002.3349809863.000000000BD60000.00000040.00000800.00020000.00000000.sdmp, Offset: 0BD60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_34_2_bd60000_FastestVPN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8543c14a05919135a7dd7856f2c8215ea7f1e8784e7f0fc1b673abcaea9aa0d9
Instruction ID: 0d587f53ebba5e19a65f86695bb575fbe0e1078cad901c5110a90470c1aa699f
Opcode Fuzzy Hash: 8543c14a05919135a7dd7856f2c8215ea7f1e8784e7f0fc1b673abcaea9aa0d9
Instruction Fuzzy Hash: 0E215170E053099FCB04DFA8D5919AEBFF1FF89310F504599D486AB365D730AA41CB92

Function 0BD61F89 Relevance: .1, Instructions: 65COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000022.00000002.3349809863.000000000BD60000.00000040.00000800.00020000.00000000.sdmp, Offset: 0BD60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_34_2_bd60000_FastestVPN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c796608960d5ac655b93808341d643078c547307028ef8eed24f1875b0d93368
Instruction ID: 702bd1fb71136ea2d85b75b8e843be44ea742656440ea6d068041b30234fe7a0
Opcode Fuzzy Hash: c796608960d5ac655b93808341d643078c547307028ef8eed24f1875b0d93368
Instruction Fuzzy Hash: 19219334B001059FDB04DF79D4546AEBBE7AFC8710F154868D541AB3A5DE74D8058B62

Function 012DECCB Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000022.00000002.3302126104.00000000012DD000.00000040.00000800.00020000.00000000.sdmp, Offset: 012DD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_34_2_12dd000_FastestVPN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fd3f4ac0631ff22dd56ccf4d2f47cf00efda065eea4add5a65fc2f6b0320be09
Instruction ID: d0a355e0d9e6d52adb4d352c516ec6c72c39a509f32cc84f2c2c83580d9e2061
Opcode Fuzzy Hash: fd3f4ac0631ff22dd56ccf4d2f47cf00efda065eea4add5a65fc2f6b0320be09
Instruction Fuzzy Hash: 4321AC76404240EFCF028F48D9C4B56BF72FB88320F258699EE090E26AC336D466DB91

Function 012DEBCF Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000022.00000002.3302126104.00000000012DD000.00000040.00000800.00020000.00000000.sdmp, Offset: 012DD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_34_2_12dd000_FastestVPN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ac706478ed8e0b975fac9fbf98c0c10b3f55379ed33725949e2df8455e538a30
Instruction ID: d558e7e67cb695c57b747a6b8979852bb119563324bd5a6a7c2e5bcfbcc7427e
Opcode Fuzzy Hash: ac706478ed8e0b975fac9fbf98c0c10b3f55379ed33725949e2df8455e538a30
Instruction Fuzzy Hash: 70218BB2404240DFCF06CF54D9C4B56BF72FB88314F2586A9EE090E26AC336D426DBA1

Function 0BDF696F Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000022.00000002.3350571102.000000000BDF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0BDF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_34_2_bdf0000_FastestVPN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2add6d694c15ea8b31184a58c3410e914b5d01580b85b5618b07efe9f969bb86
Instruction ID: eb9a9466825a24b3d540808d11f933189e651821942b36955e39a0ef68fdb0a3
Opcode Fuzzy Hash: 2add6d694c15ea8b31184a58c3410e914b5d01580b85b5618b07efe9f969bb86
Instruction Fuzzy Hash: 4011C435204605DFC710CF19C884BAABBF8FF4A720F15806EE586C7A61DB30E949CB60

Function 012DD006 Relevance: .1, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000022.00000002.3302126104.00000000012DD000.00000040.00000800.00020000.00000000.sdmp, Offset: 012DD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_34_2_12dd000_FastestVPN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9fa774e5799602d37aa726b9e9e74e898c9338544e2bd90670080484946ae2ad
Instruction ID: a435041a3b69595f97622f90364de522a3a168b4a2a452b4f7f62c7cac5ae9fc
Opcode Fuzzy Hash: 9fa774e5799602d37aa726b9e9e74e898c9338544e2bd90670080484946ae2ad
Instruction Fuzzy Hash: 0521D1755083848FCB03CF24C990711BF71EB86314F28C5EAD9498B2A7C33AD40ACB62

Function 0BDFFB08 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000022.00000002.3350571102.000000000BDF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0BDF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_34_2_bdf0000_FastestVPN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3dff8aa441dbdc2c5cba188b8961fa40b9e758e60bc0a9f421a63a69f43badde
Instruction ID: 6c68d681ebd7fdb6dbed8f92ac9cb5bf078393e3bb91c05bc9de215236583508
Opcode Fuzzy Hash: 3dff8aa441dbdc2c5cba188b8961fa40b9e758e60bc0a9f421a63a69f43badde
Instruction Fuzzy Hash: 0B119071B001059FCB14DF6AC4A5AEEBBF2AF9C760F20445ED502EB364CA715D058BA4

Function 0BDF9269 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000022.00000002.3350571102.000000000BDF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0BDF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_34_2_bdf0000_FastestVPN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4ee5267a5176d9a11cc91f101b3420e9c6910ef1d79a6bbca43d19c6873f82bd
Instruction ID: 4dc84ef6692041bc402cc73b8cf8e0e594c0c1d244bdf3d08337432e82f0d014
Opcode Fuzzy Hash: 4ee5267a5176d9a11cc91f101b3420e9c6910ef1d79a6bbca43d19c6873f82bd
Instruction Fuzzy Hash: 5D11E330F141158BCB14EA6A84547EEBBEBEFCD660F250469D102E7394DEB58D018BA1

Function 0BD62200 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000022.00000002.3349809863.000000000BD60000.00000040.00000800.00020000.00000000.sdmp, Offset: 0BD60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_34_2_bd60000_FastestVPN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dd80e33794c67bff9640cacb200945c5c453cef13fc68f62f12b2d4859636ca3
Instruction ID: e6377bebedc5e09239a7363efeb7fd37ce068885c975a8aaa6ffc93cb1a85b22
Opcode Fuzzy Hash: dd80e33794c67bff9640cacb200945c5c453cef13fc68f62f12b2d4859636ca3
Instruction Fuzzy Hash: 120128327082804FD703577884B46AEBFF19F87664B0A48EAC4C8CF173EA18D806C382

Function 0BDF84F1 Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000022.00000002.3350571102.000000000BDF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0BDF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_34_2_bdf0000_FastestVPN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2686beb05630d625a08a92d31f3d9ec6180b5479ab2be6f9a07a7490fc667c49
Instruction ID: 50e583e65187de79c2bad685fea40b8bbd0d8b801d0f17121e9ca33464262a38
Opcode Fuzzy Hash: 2686beb05630d625a08a92d31f3d9ec6180b5479ab2be6f9a07a7490fc667c49
Instruction Fuzzy Hash: E4118E31714511CFDB158F28E49882EBBF6FB8972531105A9F606CB361EB32DD41DB51

Function 0BD6AF80 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000022.00000002.3349809863.000000000BD60000.00000040.00000800.00020000.00000000.sdmp, Offset: 0BD60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_34_2_bd60000_FastestVPN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cc5ba937f898c18587c2d97848f0fc710cc4168ea45b7c5c0175c7f47d8cd562
Instruction ID: 29ecf0d1c619e057dc7737445aff4d0557b9fdf5cddfd790a2271653e3f314b0
Opcode Fuzzy Hash: cc5ba937f898c18587c2d97848f0fc710cc4168ea45b7c5c0175c7f47d8cd562
Instruction Fuzzy Hash: BB21DB74E0020A9FCB04DFA8D5919AEBBF1FF48350F504599E546AB364DB30AA41CB92

Function 0BDFCB69 Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000022.00000002.3350571102.000000000BDF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0BDF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_34_2_bdf0000_FastestVPN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a0452b08aa2c2c6caf40b1f8a99c9c56302265633d88a1428f425505368c20f9
Instruction ID: e5ce11ae6118aa034261d5cd5a0d025136717a4beac8c8d7f355720cf86ee570
Opcode Fuzzy Hash: a0452b08aa2c2c6caf40b1f8a99c9c56302265633d88a1428f425505368c20f9
Instruction Fuzzy Hash: A7012D3B7042095BDB114E65E880BABF797EFC43A0F198536FA058A150D732C4A1E760

Function 0BDF5568 Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000022.00000002.3350571102.000000000BDF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0BDF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_34_2_bdf0000_FastestVPN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3f724ec8831f12e6dbd47e19e320592168a868e1fe1d7a58a27bafac743b0dcb
Instruction ID: 87c2399fe2241de880d94bda50066061282f9e63a8c2d38d7e79e1246840acb4
Opcode Fuzzy Hash: 3f724ec8831f12e6dbd47e19e320592168a868e1fe1d7a58a27bafac743b0dcb
Instruction Fuzzy Hash: 9E01F7337081158BDB109E19F8809BEFFAAFBD5339725803BEA49CB341C932C8019750

Function 012DD31B Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000022.00000002.3302126104.00000000012DD000.00000040.00000800.00020000.00000000.sdmp, Offset: 012DD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_34_2_12dd000_FastestVPN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 945d3a080ad63b5e32bcc5b18ec1e97d0272151c1fb78e482730898ede984437
Instruction ID: 8eb1aef90e3619e73bc32b139106c5e30a8923c202b29996631afbf3398b67d2
Opcode Fuzzy Hash: 945d3a080ad63b5e32bcc5b18ec1e97d0272151c1fb78e482730898ede984437
Instruction Fuzzy Hash: 1311D075504684CFDB02CF58D5C4B15BF71FB44314F24C6A9DA494B696C33AD44ACF61

Function 0BDF8500 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000022.00000002.3350571102.000000000BDF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0BDF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_34_2_bdf0000_FastestVPN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b0d1ab02ae3f4fe30caecccb1348766c44111246e3145aa4045ce935f411f3b2
Instruction ID: 936c577a0904f1e6463404f7be236d26c7e532ef9c7acc0c6c9f0b3be3749916
Opcode Fuzzy Hash: b0d1ab02ae3f4fe30caecccb1348766c44111246e3145aa4045ce935f411f3b2
Instruction Fuzzy Hash: 15016D31704511CFDB148F2CE498C2EBBE6FB897253510569E616CB360DB32ED019B91

Function 0BD62918 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000022.00000002.3349809863.000000000BD60000.00000040.00000800.00020000.00000000.sdmp, Offset: 0BD60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_34_2_bd60000_FastestVPN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2614c89f7ab3b133e99baaad548af6fe0b63fa64177e5cda923bfdea9079f0da
Instruction ID: 0a95f51624d72fcdc7567d1c5e4041cc863a3bc3787138a433dfb4d25115899b
Opcode Fuzzy Hash: 2614c89f7ab3b133e99baaad548af6fe0b63fa64177e5cda923bfdea9079f0da
Instruction Fuzzy Hash: C711C432D0160ADFCB06DFA8D9904CCFBB1EF9A320F250626D011B7160E7702A8BCB50

Function 0BD6E288 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000022.00000002.3349809863.000000000BD60000.00000040.00000800.00020000.00000000.sdmp, Offset: 0BD60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_34_2_bd60000_FastestVPN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a5838133674d1b90f64c8f995b4e63a0ecb53dbc321d5e785cfad9e27381133f
Instruction ID: 5443c8b476ae00d72694b9e9306673505b71c59181e308295559de70426dcad8
Opcode Fuzzy Hash: a5838133674d1b90f64c8f995b4e63a0ecb53dbc321d5e785cfad9e27381133f
Instruction Fuzzy Hash: 5501A43A74012687DB1465AAF400BAAF38BDBCC6F5B044476EA0DCB641EA25C842E7A0

Function 0BD62620 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000022.00000002.3349809863.000000000BD60000.00000040.00000800.00020000.00000000.sdmp, Offset: 0BD60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_34_2_bd60000_FastestVPN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f08f097d498cb30a7fa1145ffaf156c9071de4e3eb73c5eae72edc9d0ce7343c
Instruction ID: eb1e733e9f4d52f53315de4439dadf37068e8940c90512be86e7292d5ae4069f
Opcode Fuzzy Hash: f08f097d498cb30a7fa1145ffaf156c9071de4e3eb73c5eae72edc9d0ce7343c
Instruction Fuzzy Hash: 91115E32E0060A9BCF16DFA9D8544CDFBB2FFC9310F164656D011B7254D7B0254ACBA1

Function 0BDFFB18 Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000022.00000002.3350571102.000000000BDF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0BDF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_34_2_bdf0000_FastestVPN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a290ac0e286948cd99287a88820d56cbd1e353860de50ee118e2305bf25e7582
Instruction ID: 2910402f9e54dac5975dfaa724e6587dcf630d17bb5e61d59f995abcf4b88a32
Opcode Fuzzy Hash: a290ac0e286948cd99287a88820d56cbd1e353860de50ee118e2305bf25e7582
Instruction Fuzzy Hash: 5E115E71B001059FCB04EF6AC4A5AAEBBF6EF8C760F104069D506EB3A4DE715D058BA4

Function 0BDF4F62 Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000022.00000002.3350571102.000000000BDF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0BDF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_34_2_bdf0000_FastestVPN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3f6245bf491f5928383564d4bc385ea62b182b3234c8254de31668136803a944
Instruction ID: 79d3712614755135379fe25f03228d3d07aa568fffe20224f92d7360fc92291c
Opcode Fuzzy Hash: 3f6245bf491f5928383564d4bc385ea62b182b3234c8254de31668136803a944
Instruction Fuzzy Hash: F9018031E0921ADFCB10DFA4E84069EFBF1FF49320B11856AC56AAB611D335A946CF91

Function 0BD60C25 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000022.00000002.3349809863.000000000BD60000.00000040.00000800.00020000.00000000.sdmp, Offset: 0BD60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_34_2_bd60000_FastestVPN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c89ed040f64c0de16e3a8054c6d0a0929eb6718b72f0b1831a116d1f6dcd5205
Instruction ID: d6e809ed9ed937f5222922f3200a64a7595fb31fd324d524a63b31d4f2e87501
Opcode Fuzzy Hash: c89ed040f64c0de16e3a8054c6d0a0929eb6718b72f0b1831a116d1f6dcd5205
Instruction Fuzzy Hash: E7F0FC72A092805FD706DBB84CA05E77FF9DF5715071584EBD044DB252EA306906C7A0

Function 0BD6C710 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000022.00000002.3349809863.000000000BD60000.00000040.00000800.00020000.00000000.sdmp, Offset: 0BD60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_34_2_bd60000_FastestVPN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 19412e1a5469a6866fa424e52494b83b31014674009bc46fb01f54fdf403a4b1
Instruction ID: 20ce90c021c0852f7d8d7fcfeb00b1937d97f3a69021f774eec7a4c2652853f7
Opcode Fuzzy Hash: 19412e1a5469a6866fa424e52494b83b31014674009bc46fb01f54fdf403a4b1
Instruction Fuzzy Hash: F201F5347116129FC7269B64D840812FBB5FF8976131D82F6D8998B326CB32EC42CBE1

Function 0BDFCBF8 Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000022.00000002.3350571102.000000000BDF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0BDF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_34_2_bdf0000_FastestVPN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f31b6455244ed6ea5688c453da7a6204af93c524b2526659483948bed84c1d50
Instruction ID: 385f1b04b667f8d3661fa0f4113a88193e38f6976a8d432b843719d01a601139
Opcode Fuzzy Hash: f31b6455244ed6ea5688c453da7a6204af93c524b2526659483948bed84c1d50
Instruction Fuzzy Hash: AF019E3592421A9FCF118A69CC449DABBB1FF95320F1A4267E504EB250E7715926DB80

Function 0BDF7BF8 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000022.00000002.3350571102.000000000BDF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0BDF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_34_2_bdf0000_FastestVPN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 37d11644c86164c629e0b35a6af2e04fd0a200d284bd4b1d9605232e3da07500
Instruction ID: 2686c6e467b61ef7024b9e225b1e748348e8b2d14189b8ebe0e5b44140c091e5
Opcode Fuzzy Hash: 37d11644c86164c629e0b35a6af2e04fd0a200d284bd4b1d9605232e3da07500
Instruction Fuzzy Hash: F501F235608220EFDB258A16C8909B7FBBAFFC5721715841EE68286940C671AC42E7E1

Function 0BD62928 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000022.00000002.3349809863.000000000BD60000.00000040.00000800.00020000.00000000.sdmp, Offset: 0BD60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_34_2_bd60000_FastestVPN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e1a63fea97b1b1afbaa4ceb7ab3f6638a4d264542dda818261f298052a3d4080
Instruction ID: ad2f6fba667e760281cefe999703d1e953b70d423a0574e81c9f72d6b709482b
Opcode Fuzzy Hash: e1a63fea97b1b1afbaa4ceb7ab3f6638a4d264542dda818261f298052a3d4080
Instruction Fuzzy Hash: 1C017132D1060E9BCB05DFA9D9804CDFBB6EFD9320F654626E501B7260EB703A4ACB50

Function 0BD64368 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000022.00000002.3349809863.000000000BD60000.00000040.00000800.00020000.00000000.sdmp, Offset: 0BD60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_34_2_bd60000_FastestVPN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9828fe9195766d46ba4c600037f9ab3aa6486ff11c0583277bda089624893be2
Instruction ID: 70305ffe5f6210dd7bfba745a7dc1d395dab49e16129bfd0b12fe18f24ec112b
Opcode Fuzzy Hash: 9828fe9195766d46ba4c600037f9ab3aa6486ff11c0583277bda089624893be2
Instruction Fuzzy Hash: BF01D6313187814FD7069B3DE86199A7FE9DF8725070944EAD080CF266DA25D809C796

Function 0BD62630 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000022.00000002.3349809863.000000000BD60000.00000040.00000800.00020000.00000000.sdmp, Offset: 0BD60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_34_2_bd60000_FastestVPN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3b17219308ef580b7024b89493f03031cd1b7caf77b23291b7585bd9f7304ce7
Instruction ID: 019c56d29019ff32245e0ad6d60359fffc5f86214c8b256a69b81154c53c689a
Opcode Fuzzy Hash: 3b17219308ef580b7024b89493f03031cd1b7caf77b23291b7585bd9f7304ce7
Instruction Fuzzy Hash: A4017C32E0061AD7CF059FA9D8904CDFBB6EFC9320F114626E11173254EBB0258A8BA1

Function 0BD6C720 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000022.00000002.3349809863.000000000BD60000.00000040.00000800.00020000.00000000.sdmp, Offset: 0BD60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_34_2_bd60000_FastestVPN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 39a3b87879016996de5bc90d73aa45c41173321e2a468ba058dad2c7dea1ebbb
Instruction ID: a64007933432f9d155a60f74d135504246c4f893545e9009f600eb6cdece7d6b
Opcode Fuzzy Hash: 39a3b87879016996de5bc90d73aa45c41173321e2a468ba058dad2c7dea1ebbb
Instruction Fuzzy Hash: E701F9353002129FC3399669E800856F7AAEFC427631886B9E94D87704CB35EC03C7D0

Function 0BD6E98B Relevance: .0, Instructions: 41COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000022.00000002.3349809863.000000000BD60000.00000040.00000800.00020000.00000000.sdmp, Offset: 0BD60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_34_2_bd60000_FastestVPN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 864e31f23aa88b2cff3133339ee773074d4e2df19ee47dfc1c8782b6294c094b
Instruction ID: cd1e5b79afa8b61db0e80c67248de85253c150cf50118dcfa0c6d9a0eede40c4
Opcode Fuzzy Hash: 864e31f23aa88b2cff3133339ee773074d4e2df19ee47dfc1c8782b6294c094b
Instruction Fuzzy Hash: 9501F9367002118BC705EB55E8607AEB367FFC47A0F54861AC5556B348EFB4AC0B87D1

Function 0BDF4108 Relevance: .0, Instructions: 40COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000022.00000002.3350571102.000000000BDF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0BDF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_34_2_bdf0000_FastestVPN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 574e1dc26ae0d3ce70fa388c001b341959fb09b28ee6d41882369b704329ea07
Instruction ID: c9d9e7fcbc4cd96ad2e0d201aad079a715075219077020b612c614ebd0d1f85a
Opcode Fuzzy Hash: 574e1dc26ae0d3ce70fa388c001b341959fb09b28ee6d41882369b704329ea07
Instruction Fuzzy Hash: 57F0E933B081604F870196AE7C954EEFBB5FFCA2B13050167D215E7301C9214C1AC361

Function 0BD6E90A Relevance: .0, Instructions: 40COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000022.00000002.3349809863.000000000BD60000.00000040.00000800.00020000.00000000.sdmp, Offset: 0BD60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_34_2_bd60000_FastestVPN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e3b679c997bb7adc122c8bbeb2eede0cfd6a5e0a57d869c2eb3d9c4d3e5cb5a9
Instruction ID: 9fa99c71ea7ac531eaffbeba6bc30dedb8d215d651f2015227c1691e45397257
Opcode Fuzzy Hash: e3b679c997bb7adc122c8bbeb2eede0cfd6a5e0a57d869c2eb3d9c4d3e5cb5a9
Instruction Fuzzy Hash: 77F02D377002114BC705E6549C203AEB367FFC46A0F548529C5156B344EFB0AC0747E0

Function 0BD629A8 Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000022.00000002.3349809863.000000000BD60000.00000040.00000800.00020000.00000000.sdmp, Offset: 0BD60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_34_2_bd60000_FastestVPN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 48ff190f56ae0883ccefeaa5d24e176a7a5efbf9c23f3160a3a6c5ba9a051dea
Instruction ID: 3a21c2a78c24dc02bb4c87493fd1d162e2e1c20a5cd7579fd754a24daa66e4bc
Opcode Fuzzy Hash: 48ff190f56ae0883ccefeaa5d24e176a7a5efbf9c23f3160a3a6c5ba9a051dea
Instruction Fuzzy Hash: B5F0C232D501099BDF25DAA4C45A9FEBFB26B88350F04852AC013B7244DEB45507DA85

Function 0BD6B3A1 Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000022.00000002.3349809863.000000000BD60000.00000040.00000800.00020000.00000000.sdmp, Offset: 0BD60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_34_2_bd60000_FastestVPN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 609ec6c04d8a7bca27bff0cebf0976ab0aff89bce705d9c6ead241212ee9436c
Instruction ID: af42ac0616c2010c22b6f50725ce3d18522772a932975bd339c2fcf5fc473ad3
Opcode Fuzzy Hash: 609ec6c04d8a7bca27bff0cebf0976ab0aff89bce705d9c6ead241212ee9436c
Instruction Fuzzy Hash: 34F0B4217046154F8B084B6EA8C595BFBEEEFCA674350806BE409CB365EF60DC068361

Function 0BDFFBD8 Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000022.00000002.3350571102.000000000BDF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0BDF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_34_2_bdf0000_FastestVPN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bc3475f4f71ce4690bd86f5aac30ea2c3fda91f19842ff50ddc58e0ed4325d56
Instruction ID: 8dcd7c971aa5fdc644ff257bc9cbaf7ccf7c3b4ce55e947b7b29fa9aa1ca6313
Opcode Fuzzy Hash: bc3475f4f71ce4690bd86f5aac30ea2c3fda91f19842ff50ddc58e0ed4325d56
Instruction Fuzzy Hash: 99F0BD393005109FC704DF1AD898C5ABBE6FF8972135680A9EA0ACB371DA61EC42CB94

Function 0BDF7C08 Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000022.00000002.3350571102.000000000BDF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0BDF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_34_2_bdf0000_FastestVPN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2f9ed989047092ca260236b464f37375e295df9de762082d5a8e9ad6bc72552c
Instruction ID: 906c6f50fce8aa97e31b669a61923d49ea48d72d08ae4b6776e0d3336a7c6401
Opcode Fuzzy Hash: 2f9ed989047092ca260236b464f37375e295df9de762082d5a8e9ad6bc72552c
Instruction Fuzzy Hash: BBF0C231604625AFD7244F46D844EB7FBFAFFC4725B00842DE68742A40C675EC42D7A0

Function 0BD626BA Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000022.00000002.3349809863.000000000BD60000.00000040.00000800.00020000.00000000.sdmp, Offset: 0BD60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_34_2_bd60000_FastestVPN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 15705aba106bc1f62d441e54d2347e785a66ebe0a1cf6af533c480c238fbf178
Instruction ID: 89966dbe630272c355bc6ed152996d0df0414f12cd6b3e66c4ab52780011c29f
Opcode Fuzzy Hash: 15705aba106bc1f62d441e54d2347e785a66ebe0a1cf6af533c480c238fbf178
Instruction Fuzzy Hash: D6F0C832A0114A9BDF16DB74C4A59EFFFB15F85350F044469C412AB241CE74150ACB81

Function 0BD639C4 Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000022.00000002.3349809863.000000000BD60000.00000040.00000800.00020000.00000000.sdmp, Offset: 0BD60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_34_2_bd60000_FastestVPN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 69a16ae24326c0fe5b7ffb139164f728ca8b224735bc0fbb1e957246025e85ed
Instruction ID: 1e206c8fc17a856677686e18a39921db13b2093fa0885cc334f65cce529c9eff
Opcode Fuzzy Hash: 69a16ae24326c0fe5b7ffb139164f728ca8b224735bc0fbb1e957246025e85ed
Instruction Fuzzy Hash: E0F0F42080D284DFC701CBB8A8618A9FFB4EE473A071505DEC084DB227E6348A05EB15

Function 0BD63F10 Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000022.00000002.3349809863.000000000BD60000.00000040.00000800.00020000.00000000.sdmp, Offset: 0BD60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_34_2_bd60000_FastestVPN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ddd1ccdd50a0f2df87bdab1110e05a2a13e81570fd7cd269fb4b7f3725f4b719
Instruction ID: fede68d1e7d17f69a3d100452e03677a2a36c30f5142ab3cf1c775fe9a399b8c
Opcode Fuzzy Hash: ddd1ccdd50a0f2df87bdab1110e05a2a13e81570fd7cd269fb4b7f3725f4b719
Instruction Fuzzy Hash: E7F050312006428BCB05E35CA46095EFBA6FEC57B0311493DD10DCB301DE20D80D8799

Function 0BD66840 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000022.00000002.3349809863.000000000BD60000.00000040.00000800.00020000.00000000.sdmp, Offset: 0BD60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_34_2_bd60000_FastestVPN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3f4441d4d6f0ed357eae577c7f18aa430170a9aa81987e8af10fe8b9ad9dcddd
Instruction ID: 486e63f35962fb3b81b955628ceee7c1754cbfa32db5e08801400e7017512364
Opcode Fuzzy Hash: 3f4441d4d6f0ed357eae577c7f18aa430170a9aa81987e8af10fe8b9ad9dcddd
Instruction Fuzzy Hash: D4011270E00209EFCB44EFA8E551AADF7B6EF84744F1085A98505A7354EA305E09CF81

Function 0BD66089 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000022.00000002.3349809863.000000000BD60000.00000040.00000800.00020000.00000000.sdmp, Offset: 0BD60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_34_2_bd60000_FastestVPN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7dcca246c5810514578abaf18bde99f1391756971449b9844dae6f63987ed35a
Instruction ID: 45a7ed05602bc5ecf25cc8c6e83ebdc171cc3502ab1d98b8dd989d5876bdc835
Opcode Fuzzy Hash: 7dcca246c5810514578abaf18bde99f1391756971449b9844dae6f63987ed35a
Instruction Fuzzy Hash: F8F0AF31214BA0CFC321CBA9E404A46FBF5EF86719B14486DD0C687A62DBF5A948C792

Function 0BDFC128 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000022.00000002.3350571102.000000000BDF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0BDF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_34_2_bdf0000_FastestVPN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e58aec6fd3868db4e957d036dfc6a6678bdc309d6705fed1f9c799ad56e98a42
Instruction ID: 601ec69fd697c4a804019def3c3e13713f566da1aa9aa41feb4eb84399375b8c
Opcode Fuzzy Hash: e58aec6fd3868db4e957d036dfc6a6678bdc309d6705fed1f9c799ad56e98a42
Instruction Fuzzy Hash: B3F030373141545F57109A9EA884DABFBEDEB89231355807AF61CC7211CA21D81197A0

Function 0BDFFC31 Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000022.00000002.3350571102.000000000BDF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0BDF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_34_2_bdf0000_FastestVPN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4a3887ae3bafbaaebfacb7756395dacb9a48144b46fc19f4f0da9b9c3c2129c7
Instruction ID: 3ef16b443601a3cd257004a57136e3e6cc36d65fa63b96ac93b54b26b5cb73a3
Opcode Fuzzy Hash: 4a3887ae3bafbaaebfacb7756395dacb9a48144b46fc19f4f0da9b9c3c2129c7
Instruction Fuzzy Hash: EDF030393092548FC715CB1AD894C56FBF9BF8A720315819AE949CB732C671EC01CF50

Function 0BD62B75 Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000022.00000002.3349809863.000000000BD60000.00000040.00000800.00020000.00000000.sdmp, Offset: 0BD60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_34_2_bd60000_FastestVPN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ad125dc45d409c3e0fe6c59a4fa42819da504619a31f3cab54364355b1751ae8
Instruction ID: 1f4e0334beea9d420f1a6481eca7d2956784b43dd470848c3d4629c086105d37
Opcode Fuzzy Hash: ad125dc45d409c3e0fe6c59a4fa42819da504619a31f3cab54364355b1751ae8
Instruction Fuzzy Hash: 57F090357012208FCB51EF39E85066937B2EF89670B4082E9D459DB3B9DB309C52CB51

Function 0BDF7BA8 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000022.00000002.3350571102.000000000BDF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0BDF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_34_2_bdf0000_FastestVPN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ec7292c2f63952cffdeda4abcad5b7d2f1ec00f81b5e2b1acf21c806654b5b08
Instruction ID: 26b9235433528be5f2528951065a1c08c076c2678b542d2ada46c816e0f80b40
Opcode Fuzzy Hash: ec7292c2f63952cffdeda4abcad5b7d2f1ec00f81b5e2b1acf21c806654b5b08
Instruction Fuzzy Hash: 11F0A0353042148FC3159649E444AE6F7EAEBC9731F1540AAEA0A87B61CBB1FC01CB90

Function 0BDFFC40 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000022.00000002.3350571102.000000000BDF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0BDF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_34_2_bdf0000_FastestVPN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8312c2ffad0b4b51a7599849441f7168ce3c1a256284c37670f97187e9d0ddf9
Instruction ID: e0fe57b1426d37892dbf834dd18e8202bfbc3585c91b2dab7eb9eb86bffee99e
Opcode Fuzzy Hash: 8312c2ffad0b4b51a7599849441f7168ce3c1a256284c37670f97187e9d0ddf9
Instruction Fuzzy Hash: 99F0D43A3105008FC714DB1EE488C9AFBEAEFD972131580AAEA09CB731CA71EC01CA50

Function 0BDF4F88 Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000022.00000002.3350571102.000000000BDF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0BDF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_34_2_bdf0000_FastestVPN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1004d90b381589828cd6270dd0cb2362a5d6c353120926fc4511dac9e63bc6c9
Instruction ID: 2d1bdb1c4fffa90def80179916cf77706e01370f64c95665dc0fd9ebe3cb02dc
Opcode Fuzzy Hash: 1004d90b381589828cd6270dd0cb2362a5d6c353120926fc4511dac9e63bc6c9
Instruction Fuzzy Hash: E1F01430D0021ADFCB14DFA9E9406AEFBF1FF48310B208929C569A7210D335AA42CFD0

Function 0BDF5559 Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000022.00000002.3350571102.000000000BDF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0BDF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_34_2_bdf0000_FastestVPN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cc765469e7b4c62433d4792707f8f326e263c2e066bf7c57c7c2287bdf200289
Instruction ID: 146876f9f2769b403e3c8d8015e36319cc868cd7247c2935fc627c266c77890e
Opcode Fuzzy Hash: cc765469e7b4c62433d4792707f8f326e263c2e066bf7c57c7c2287bdf200289
Instruction Fuzzy Hash: 9DE09232608650DBCB118A1AEC80D5BBFBDEE8B7707628277E508C7251C631D90097A0

Function 0BD6CC00 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000022.00000002.3349809863.000000000BD60000.00000040.00000800.00020000.00000000.sdmp, Offset: 0BD60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_34_2_bd60000_FastestVPN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 200888c7309d16c514c5a59bc2dc71a1863298c181b2636d71811520890504cb
Instruction ID: 5e75b6b4f8220860e6d88912ec96ab6b65298678c06bc1082e4014d1882216e4
Opcode Fuzzy Hash: 200888c7309d16c514c5a59bc2dc71a1863298c181b2636d71811520890504cb
Instruction Fuzzy Hash: 7FE0D83262D2814FE741C61DEC85650FBE4DB456F8B2C05FAC0D6CB043D921E496CB41

Function 0BDFFAD8 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000022.00000002.3350571102.000000000BDF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0BDF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_34_2_bdf0000_FastestVPN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6c4155fe773a18dc873b89d547868b1752a02a882a0470f271e6c17459173ddb
Instruction ID: 12b86378239d86bacf29ea8065b4afd15d4e3ecc296dc891cfe2efc4b406f42a
Opcode Fuzzy Hash: 6c4155fe773a18dc873b89d547868b1752a02a882a0470f271e6c17459173ddb
Instruction Fuzzy Hash: CAE026617095608FCB25A32688207C2BF66DFCB61071A40CBC242CB296CA720D09C3E1

Function 0BD63942 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000022.00000002.3349809863.000000000BD60000.00000040.00000800.00020000.00000000.sdmp, Offset: 0BD60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_34_2_bd60000_FastestVPN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7c34f89ac4535388e4fafd6d011293652cf08ec434a86d3958267bbfb9d392da
Instruction ID: e5f879713225828ebae641656d891eecb4b804e6623e4764a650a91510d36c8f
Opcode Fuzzy Hash: 7c34f89ac4535388e4fafd6d011293652cf08ec434a86d3958267bbfb9d392da
Instruction Fuzzy Hash: 46E0D8223095A0DF8716539C642487ABFEACECBB6031900EED145CB343CD118C019795

Function 0BD621BE Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000022.00000002.3349809863.000000000BD60000.00000040.00000800.00020000.00000000.sdmp, Offset: 0BD60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_34_2_bd60000_FastestVPN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d5c5f30716588d932f69da62faf82daec31a7f5b4a45a1f05af95db0f1ad5ec3
Instruction ID: b3ea0f3cdb69f8c030bc87464c70d46e31882dec637c46567f59d3e033e39604
Opcode Fuzzy Hash: d5c5f30716588d932f69da62faf82daec31a7f5b4a45a1f05af95db0f1ad5ec3
Instruction Fuzzy Hash: E2E0DF2470C7820B972227766C602ABBFE59F877B030508A8C9E6CA215FA18C620A751

Function 0BD64488 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000022.00000002.3349809863.000000000BD60000.00000040.00000800.00020000.00000000.sdmp, Offset: 0BD60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_34_2_bd60000_FastestVPN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c72b03b30a2c00629876360f24ba24cf381585874e89dbaa28eef84524f0586f
Instruction ID: c86f07a485330c7dbfd49065e790b392c65dad7105d131e2703ced960c288845
Opcode Fuzzy Hash: c72b03b30a2c00629876360f24ba24cf381585874e89dbaa28eef84524f0586f
Instruction Fuzzy Hash: 72F0F870E08248AFCB45DBA8D46449DBFF4EF45200F0048EAD4859B265EA345A15CB85

Function 0BD66BF9 Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000022.00000002.3349809863.000000000BD60000.00000040.00000800.00020000.00000000.sdmp, Offset: 0BD60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_34_2_bd60000_FastestVPN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 473d31cd2c17630a04a71a52c71ed3ef745d995b2324742640c0c115802d29c5
Instruction ID: bdffe1da8547d1976834b40cf1a87807518907eea70f1ce1f2fda04487e68368
Opcode Fuzzy Hash: 473d31cd2c17630a04a71a52c71ed3ef745d995b2324742640c0c115802d29c5
Instruction Fuzzy Hash: AEE09270A10109EFCB00DFB4E981DAEBBF5FB91310B1046A9C409D7240F6308B04D751

Function 0BD63980 Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000022.00000002.3349809863.000000000BD60000.00000040.00000800.00020000.00000000.sdmp, Offset: 0BD60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_34_2_bd60000_FastestVPN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 108ad9dd263c58b042eaa8527f8f578f9c3533cea6b1c46499025bae8cc7a8d6
Instruction ID: 64132e6701dd134959f02433f8b93d1a503503b49e8ad86fa39faa61b13de38d
Opcode Fuzzy Hash: 108ad9dd263c58b042eaa8527f8f578f9c3533cea6b1c46499025bae8cc7a8d6
Instruction Fuzzy Hash: BEE06D70909249DFCB01DFA4E95299EBBB5EB46310B2046AAC408DB202E6315A05AB45

Function 0BD60D48 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000022.00000002.3349809863.000000000BD60000.00000040.00000800.00020000.00000000.sdmp, Offset: 0BD60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_34_2_bd60000_FastestVPN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6b4d082f6e84914bf663b40ed19964240385c47a03a95ca795ed4620258b77b5
Instruction ID: 72133db0df668057d443bc0969d6ab8e1d277112a60fdc987ad316f145a1bccf
Opcode Fuzzy Hash: 6b4d082f6e84914bf663b40ed19964240385c47a03a95ca795ed4620258b77b5
Instruction Fuzzy Hash: 1DF0E534909258EFC701EFB1FC5099D7FB4FB06300B1142AED80487355DA314E04DB46

Function 0BDF8BC9 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000022.00000002.3350571102.000000000BDF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0BDF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_34_2_bdf0000_FastestVPN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8d91b872cae0fc769947882fac352688fc29a12980178e4b37eb71ecf0c3b154
Instruction ID: 8a40e7ae53d1565500631be6e9a02c88dd68eccb0ecf6ee1f0e5041e836826b3
Opcode Fuzzy Hash: 8d91b872cae0fc769947882fac352688fc29a12980178e4b37eb71ecf0c3b154
Instruction Fuzzy Hash: 94E017346442248FCB04EB98D4949A53FB9EF4A724B1100E6E604CF672DEA6EC428BA5

Function 0BDF8BF7 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000022.00000002.3350571102.000000000BDF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0BDF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_34_2_bdf0000_FastestVPN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 44b9bd529f42d84a12dd260d1754f88b10f07f8f4253a8f53c94d0d397e5a5b4
Instruction ID: 325399256f919acb2cd1a777d8427201ec1aee91c6b2a6185b5a79e01f3c06c0
Opcode Fuzzy Hash: 44b9bd529f42d84a12dd260d1754f88b10f07f8f4253a8f53c94d0d397e5a5b4
Instruction Fuzzy Hash: ADE08C36545901CFCB009F58C888AA077F1AF4671671900E0E6048F972DA3AE852EB60

Function 0BDF4118 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000022.00000002.3350571102.000000000BDF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0BDF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_34_2_bdf0000_FastestVPN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c5341b9e7826623a4773119cff55284320e6c55e3432fd74de9be0c15458c3dd
Instruction ID: 0aa8f3281ab995a720b2ff6719eee7488ef8144966e449da0e8bab411a2c86ca
Opcode Fuzzy Hash: c5341b9e7826623a4773119cff55284320e6c55e3432fd74de9be0c15458c3dd
Instruction Fuzzy Hash: 47D05226304520270208719F388486FEACEEACD8F1358403AE20DD3300EC218C0682E6

Function 0BDFBF00 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000022.00000002.3350571102.000000000BDF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0BDF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_34_2_bdf0000_FastestVPN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c1bd05e286a8bcc61ac32103b13787bb50ca089a3f3b41a159b18a7e461262f8
Instruction ID: 9045e1afda43bcacdc9d2969f704b63a62f327a15ae788a4fa839d8f266b7b41
Opcode Fuzzy Hash: c1bd05e286a8bcc61ac32103b13787bb50ca089a3f3b41a159b18a7e461262f8
Instruction Fuzzy Hash: 30E012357401109BC7186A6AE80DE6A7FE9EBC9B25F15016AF909CB391DEB1EC028794

Function 0BD668F1 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000022.00000002.3349809863.000000000BD60000.00000040.00000800.00020000.00000000.sdmp, Offset: 0BD60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_34_2_bd60000_FastestVPN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6dc6a48d98d551aec223d16cd3c8ab91ab4a77f8136cccf358aee4b89ac5cb2e
Instruction ID: ce95ac8c8c37577f9c801a732f8eb2ffe553afd747db98e729e98f4a1c3bc08d
Opcode Fuzzy Hash: 6dc6a48d98d551aec223d16cd3c8ab91ab4a77f8136cccf358aee4b89ac5cb2e
Instruction Fuzzy Hash: A2E04F31609251CFC342CB29E854682FFB5FF8A36131A46DAE049DB219C770D84AC791

Function 0BD6D298 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000022.00000002.3349809863.000000000BD60000.00000040.00000800.00020000.00000000.sdmp, Offset: 0BD60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_34_2_bd60000_FastestVPN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 995c48f34299f275b120fea20bfbdf9e56c87a7857bb18a2b7a535fd885e5c5c
Instruction ID: 3a412a80a8d9a330c7816169dd00daac748a9e4059cbf8eae8bf3c1024f96096
Opcode Fuzzy Hash: 995c48f34299f275b120fea20bfbdf9e56c87a7857bb18a2b7a535fd885e5c5c
Instruction Fuzzy Hash: E9E0C2293093A41BC7063BED286487FBF6ECAC757431880A7D560CB346CDA58D01AFB1

Function 0BD6D2D8 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000022.00000002.3349809863.000000000BD60000.00000040.00000800.00020000.00000000.sdmp, Offset: 0BD60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_34_2_bd60000_FastestVPN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f6bb4767fca2781fb5edc9276ab31c58bb2758a3ba6ceefc176ab820659ab243
Instruction ID: 247eaefd9dbf73ac7b794bad5517f41971d6cd490d2f7de0ec6bc43e3f0d69b1
Opcode Fuzzy Hash: f6bb4767fca2781fb5edc9276ab31c58bb2758a3ba6ceefc176ab820659ab243
Instruction Fuzzy Hash: 29E092309046089FC705DFA4F9409ACBBB9EB45200B0041EED804E7251EA355E04E751

Function 0BD63950 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000022.00000002.3349809863.000000000BD60000.00000040.00000800.00020000.00000000.sdmp, Offset: 0BD60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_34_2_bd60000_FastestVPN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 05ac80c17a84b07d0325e0538d2ff0b11d0f5b3da0669bb8fb9f9925e86c3d95
Instruction ID: 6f8882804334860cce05daff524d96b5266cdf14ba0261f18b661108e32598a3
Opcode Fuzzy Hash: 05ac80c17a84b07d0325e0538d2ff0b11d0f5b3da0669bb8fb9f9925e86c3d95
Instruction Fuzzy Hash: 40D05E36300520D70518629D740486EF6DEDAC5BB1315002EE60AC3341DE519C010B95

Function 0BD6390A Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000022.00000002.3349809863.000000000BD60000.00000040.00000800.00020000.00000000.sdmp, Offset: 0BD60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_34_2_bd60000_FastestVPN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aa736e2a75fa568c569f6b209bce13dcb2291f2c0a022213602ecda691d1de20
Instruction ID: 27b883d6a6ead23f6efc809838e496bb2aba6ee21cb92c3207f64d311402c266
Opcode Fuzzy Hash: aa736e2a75fa568c569f6b209bce13dcb2291f2c0a022213602ecda691d1de20
Instruction Fuzzy Hash: 61E04F302092808FDB4A9778A4B057ABFE4DF8A62031448AAD486CB252DA2198129B15

Function 0BD618A8 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000022.00000002.3349809863.000000000BD60000.00000040.00000800.00020000.00000000.sdmp, Offset: 0BD60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_34_2_bd60000_FastestVPN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e2db1b3cac87752773f7b6cfed973e69b09d31da03749ce3f6543bd0979d7ae1
Instruction ID: 281a2b84895a9fd1107d02d452ae97094a03c68147f5a07c91f6cb39f1f1d4e7
Opcode Fuzzy Hash: e2db1b3cac87752773f7b6cfed973e69b09d31da03749ce3f6543bd0979d7ae1
Instruction Fuzzy Hash: F1E01271D01119EF9B80DBB9A8016EEBBF4AB08310F1141A6C449E3202E2304A00CB90

Function 0BD61832 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000022.00000002.3349809863.000000000BD60000.00000040.00000800.00020000.00000000.sdmp, Offset: 0BD60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_34_2_bd60000_FastestVPN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e39e9a05cdb223f61023302a12d4e0e91ced7d9a76c82aede170ef5cf0fb2a52
Instruction ID: 97b50bd003cf7137572ed605294faa5e2f1538e062e093bd96d894170502a4a0
Opcode Fuzzy Hash: e39e9a05cdb223f61023302a12d4e0e91ced7d9a76c82aede170ef5cf0fb2a52
Instruction Fuzzy Hash: 23E0C238B083824F97021B7260242953FF16F8725034840A0C805DB20BEA20C802D391

Function 0BD60D58 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000022.00000002.3349809863.000000000BD60000.00000040.00000800.00020000.00000000.sdmp, Offset: 0BD60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_34_2_bd60000_FastestVPN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e89eaf253f52dcb818d7d1094a195b449901e39fd274fc9d9983ca7aabca6b06
Instruction ID: ea27248d24cba7cecf6f8d575a5ea33542c53b253f3392d3db47ee601e458b05
Opcode Fuzzy Hash: e89eaf253f52dcb818d7d1094a195b449901e39fd274fc9d9983ca7aabca6b06
Instruction Fuzzy Hash: B8E04F34A11119EFC700EFA5F94489DBBB9FB49300B108269D80493314DA315F14DB55

Function 0BD621D0 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000022.00000002.3349809863.000000000BD60000.00000040.00000800.00020000.00000000.sdmp, Offset: 0BD60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_34_2_bd60000_FastestVPN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b824167694f8c6b722733314f02df9aa4e6286eee1c020a503f59751a728484a
Instruction ID: 5224df5afcdd272386e5659018f62342cf31b9b34abb8c6c08f6f2749c7de32c
Opcode Fuzzy Hash: b824167694f8c6b722733314f02df9aa4e6286eee1c020a503f59751a728484a
Instruction Fuzzy Hash: D6D09E34B087075B57146A7AAC4072AB2D9AB897E43544560DA65D7304FA28DA016760

Function 0BD64498 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000022.00000002.3349809863.000000000BD60000.00000040.00000800.00020000.00000000.sdmp, Offset: 0BD60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_34_2_bd60000_FastestVPN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5bbad197fc9ba875648d6d86b769886e3433a2a977d6b574430300fa0eb62692
Instruction ID: 94bf25f026abbbf0dab116c0252a248c5e12ca600a332bffc33e6a90f9b4fdb4
Opcode Fuzzy Hash: 5bbad197fc9ba875648d6d86b769886e3433a2a977d6b574430300fa0eb62692
Instruction Fuzzy Hash: B3E09270E0430CAFCB44EFA9E54599DFBF9EB48300F0085A9D809A7354EA349A098F81

Function 0BD61DC2 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000022.00000002.3349809863.000000000BD60000.00000040.00000800.00020000.00000000.sdmp, Offset: 0BD60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_34_2_bd60000_FastestVPN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2320653987fd72931e814069aee1e75772f2aa576a1c2242f437fc81df7b537b
Instruction ID: bcff5a8dc7952d27b91aa78cb6ebad951e33411b63c5debb8732a8b89c720f15
Opcode Fuzzy Hash: 2320653987fd72931e814069aee1e75772f2aa576a1c2242f437fc81df7b537b
Instruction Fuzzy Hash: 4DE0ECB5D05219DF8B40EFB8A9451DEBFF4EF49660F2005A9D999E7211E7308620CBD2

Function 0BDFC02B Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000022.00000002.3350571102.000000000BDF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0BDF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_34_2_bdf0000_FastestVPN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 03689a14f4543045fbd419357b5a1939b3154838162368e7a43219ef0ac05703
Instruction ID: d405efe5588adce816522f8e2bebc2a200dcd0844614e72aec1713d19fa07820
Opcode Fuzzy Hash: 03689a14f4543045fbd419357b5a1939b3154838162368e7a43219ef0ac05703
Instruction Fuzzy Hash: 3AD05E36B401069FC7109A59EC80EAAFBEDEF88225B4480A3F128C7262DA35E9119730

Function 0BD618B0 Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000022.00000002.3349809863.000000000BD60000.00000040.00000800.00020000.00000000.sdmp, Offset: 0BD60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_34_2_bd60000_FastestVPN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 45bcc194ce0b6337db064ce929f01276155993b4963b0f819a3f104a0182ea11
Instruction ID: 87e19e32665b95b7de40c2ec1f0f7a318956aa245713661a577b67c7b3ea2aad
Opcode Fuzzy Hash: 45bcc194ce0b6337db064ce929f01276155993b4963b0f819a3f104a0182ea11
Instruction Fuzzy Hash: 00D0E2B1D00219EF8B84EBA9A9056DEFBF8AB08220F000076D51DE3201E2308B108BD1

Function 0BD66C08 Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000022.00000002.3349809863.000000000BD60000.00000040.00000800.00020000.00000000.sdmp, Offset: 0BD60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_34_2_bd60000_FastestVPN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d06f5c6e0f7d08e064964975b7402a5441d07dc4476642d5f444add573f38e45
Instruction ID: 3d6b72bbbe66ec07f4096574e6f9dd842d4200eda1c70acff6bd8f73cd094b5e
Opcode Fuzzy Hash: d06f5c6e0f7d08e064964975b7402a5441d07dc4476642d5f444add573f38e45
Instruction Fuzzy Hash: 4ED01270A10109EFCB04DFA4E941D5DBBF9FB45200B1045A9D509D3310FA315F049751

Function 0BD6C6F3 Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000022.00000002.3349809863.000000000BD60000.00000040.00000800.00020000.00000000.sdmp, Offset: 0BD60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_34_2_bd60000_FastestVPN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cb8f8b662f8c161022ae97b6d2f7c7484033abe031c49e3669966472949af0a9
Instruction ID: c8f75a1fed3aaa7a5ba01490b1e565599d4bdd5420b06590b9e8d0c67d739534
Opcode Fuzzy Hash: cb8f8b662f8c161022ae97b6d2f7c7484033abe031c49e3669966472949af0a9
Instruction Fuzzy Hash: E1D0A731604540CFCF025B54E848809FFF1EFC931131504E7D045CB272CA72E811DB51

Function 0BD63990 Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000022.00000002.3349809863.000000000BD60000.00000040.00000800.00020000.00000000.sdmp, Offset: 0BD60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_34_2_bd60000_FastestVPN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d7868365f4ee5d5f41a9ff08dc2c84b34190b152971777d4c8806c5077883414
Instruction ID: c69a61f821dcecae36d3d74dad092543befece403f12c93a6a92147043d7a429
Opcode Fuzzy Hash: d7868365f4ee5d5f41a9ff08dc2c84b34190b152971777d4c8806c5077883414
Instruction Fuzzy Hash: 36D01730A01209EFCB00EFA8F90199EB7F9EB44310B2086AD9409E7301EA316F049F91

Function 0BD61868 Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000022.00000002.3349809863.000000000BD60000.00000040.00000800.00020000.00000000.sdmp, Offset: 0BD60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_34_2_bd60000_FastestVPN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fc52aa060085db6791c925894a9d27e92f7511ceea5b06b57ad78ce567b2e10d
Instruction ID: 5c7c2a536fde87f38aff9e3cb45be1baa4924250ccdd554d361a17a3a9704631
Opcode Fuzzy Hash: fc52aa060085db6791c925894a9d27e92f7511ceea5b06b57ad78ce567b2e10d
Instruction Fuzzy Hash: B8E01234245284DFD71A5F74D464954BFB4AF4A72430508D5E489CB373CB31D810DB12

Function 0BD6D2E8 Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000022.00000002.3349809863.000000000BD60000.00000040.00000800.00020000.00000000.sdmp, Offset: 0BD60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_34_2_bd60000_FastestVPN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 72b2b48bf4f01cd9dbc560ec4b7a51d04a0b641746582ac9772ee1f5a8e187dd
Instruction ID: e243bb5a2feb887a1bac81d5c29ebc1bcd8656f43419d4ece2e1af059e7102dc
Opcode Fuzzy Hash: 72b2b48bf4f01cd9dbc560ec4b7a51d04a0b641746582ac9772ee1f5a8e187dd
Instruction Fuzzy Hash: 8FD0123090110CEFCB00EFA4F94059DB7B9EB44210B1046ADD508E7300EB315F049B51

Function 0BDFDEFD Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000022.00000002.3350571102.000000000BDF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0BDF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_34_2_bdf0000_FastestVPN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cc40ec44fca32fd2b8d962ae9eac89de32684d12dbe567eb9d912afbe411dc80
Instruction ID: 21df5bf8de5d14040ededebbf1645eaec432c2b440e9d09263ccc106f791eaeb
Opcode Fuzzy Hash: cc40ec44fca32fd2b8d962ae9eac89de32684d12dbe567eb9d912afbe411dc80
Instruction Fuzzy Hash: 8ED0C933B041259F8B045F9AF8044BDB7F9FB88626721486FF51AD2791DB7585458B80

Function 0BD6E8CA Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000022.00000002.3349809863.000000000BD60000.00000040.00000800.00020000.00000000.sdmp, Offset: 0BD60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_34_2_bd60000_FastestVPN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c89aaca75dccf0ac946c5c1c2139760b69fa3e3220080ed8d966a5357b946305
Instruction ID: cb4625937c42462db2cee689b4b2bf6884c0cbc977556d60a8403b1fa4e0fafa
Opcode Fuzzy Hash: c89aaca75dccf0ac946c5c1c2139760b69fa3e3220080ed8d966a5357b946305
Instruction Fuzzy Hash: E9E0123890020ECBDB14DF91D45466EF771BF44758F208819D412AB244EB759547CF91

Function 0BD64460 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000022.00000002.3349809863.000000000BD60000.00000040.00000800.00020000.00000000.sdmp, Offset: 0BD60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_34_2_bd60000_FastestVPN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6c19898e5b154d70067316f3896878326d695b2dbe4b9ca06d3c4f1d5a5f4d4d
Instruction ID: 50fcf5f9f316c00549b16f614eb6e607b2af9cecc7e8e98bfe12224fb7d6e755
Opcode Fuzzy Hash: 6c19898e5b154d70067316f3896878326d695b2dbe4b9ca06d3c4f1d5a5f4d4d
Instruction Fuzzy Hash: 90D0A73064D3C89FD7218BA488B08667FB8CE0721075608CED9858F233C8229410D341

Function 0BD61878 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000022.00000002.3349809863.000000000BD60000.00000040.00000800.00020000.00000000.sdmp, Offset: 0BD60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_34_2_bd60000_FastestVPN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a8e110abbd8f7cc28be690ad5cb7eb2ce9f6900598be15ea2ccb5d0957262dcd
Instruction ID: b728cfe00e42922a3d68a73d248c330edc5a33718c3f8715b86acb2b1ef9cc9a
Opcode Fuzzy Hash: a8e110abbd8f7cc28be690ad5cb7eb2ce9f6900598be15ea2ccb5d0957262dcd
Instruction Fuzzy Hash: D7D0C935280509CFD7089FA4E448D25FBF8AF89B2534004A4E40DC7331DB31EC10EA55

Function 0BD61C72 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000022.00000002.3349809863.000000000BD60000.00000040.00000800.00020000.00000000.sdmp, Offset: 0BD60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_34_2_bd60000_FastestVPN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 702d35408e155d4e328f3c9490cdd2b2911e8d4258c65b26453075cc1a83714d
Instruction ID: 43c0ed08e36ae70a02232d0b252ef7b0e4c6527e6802c2ddd2c393d9e25f0c73
Opcode Fuzzy Hash: 702d35408e155d4e328f3c9490cdd2b2911e8d4258c65b26453075cc1a83714d
Instruction Fuzzy Hash: D1D05E79704019CFCB04DF95E040AEDF7B2FB88726F2041A9E6196B754D730AE15CB91

Function 0BDF8BD8 Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000022.00000002.3350571102.000000000BDF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0BDF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_34_2_bdf0000_FastestVPN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e0e811a279fe8ae5684a7ac1915c29fc62e92abb23e0ef0a8536fe9a2332b37d
Instruction ID: 7b2085e62cf76747fad1be9c2f078284f7f90304a2fc79a104f2e5f9fc1420be
Opcode Fuzzy Hash: e0e811a279fe8ae5684a7ac1915c29fc62e92abb23e0ef0a8536fe9a2332b37d
Instruction Fuzzy Hash: 80C080313402244FC708A65CD410D6937DDDF49724B0100A6F509CB371CD92EC4147D5

Function 0BD61840 Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000022.00000002.3349809863.000000000BD60000.00000040.00000800.00020000.00000000.sdmp, Offset: 0BD60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_34_2_bd60000_FastestVPN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6d8d39f26eece20c3f566be1ff02409839c600506513f30e3a20b94065d4e57b
Instruction ID: 3e855a54beb9ade6697db8095504d7f586a42cc34d2a2b96a36f44ea59eb2916
Opcode Fuzzy Hash: 6d8d39f26eece20c3f566be1ff02409839c600506513f30e3a20b94065d4e57b
Instruction Fuzzy Hash: 2CD01238B4470A5B57046777740421A73EA7BC62947944120DD08E2309FF34DD028590

Function 0BDF8C08 Relevance: .0, Instructions: 13COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000022.00000002.3350571102.000000000BDF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0BDF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_34_2_bdf0000_FastestVPN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 200ab1ff26a44c684e22f076b179de13ef433e0d7935b5d8a0753a5a3d210369
Instruction ID: 2d714e57377d2e69d92233cf7175ec4ebaeca491f529007112ceb7155fe0e313
Opcode Fuzzy Hash: 200ab1ff26a44c684e22f076b179de13ef433e0d7935b5d8a0753a5a3d210369
Instruction Fuzzy Hash: 46D01236145906CFC7009E19D845AB473E5AB4071AB5D40F4E3088F972D326DD91E650

Function 0BDF84D0 Relevance: .0, Instructions: 9COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000022.00000002.3350571102.000000000BDF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0BDF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_34_2_bdf0000_FastestVPN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bc3136a8b08b2e1bb10d6732676ec70cd3533cc67b9cbbbf3129ad986771ae9e
Instruction ID: ef874623ebf05c29eb0304b12d8526e978dbc27e0c0e33d31d043fae0b035cbc
Opcode Fuzzy Hash: bc3136a8b08b2e1bb10d6732676ec70cd3533cc67b9cbbbf3129ad986771ae9e
Instruction Fuzzy Hash: 09C09B7452D580DFEF816670D5747C77A54DB523C5F2004D2C111C5557C16A8585D635

Function 0BDF4484 Relevance: .0, Instructions: 3COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000022.00000002.3350571102.000000000BDF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0BDF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_34_2_bdf0000_FastestVPN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f7fa15f7c548b749c48086f68aa33cda2e259a937700cae4efc8e1463ca47e96
Instruction ID: dd50615a6dd8f3d56f56ef5282829c3c0b9ae69fc0b9ecc1234ea5f0851f34c0
Opcode Fuzzy Hash: f7fa15f7c548b749c48086f68aa33cda2e259a937700cae4efc8e1463ca47e96
Instruction Fuzzy Hash:

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Compromised credentials may be used to bypass access controls placed on various resources on systems within the network and may even be used for persistent access to remote systems and externally available services, such as VPNs, Outlook Web Access, network devices, and remote desktop.Compromised credentials may also grant an adversary increased privilege to specific systems or access to restricted areas of the network. Adversaries may choose not to use malware or tools in conjunction with the legitimate access those credentials provide to make it harder to detect their presence.
Tactics:	Defense Evasion, Initial Access, Persistence, Privilege Escalation
Data Sources:	Logon Session: Logon Session Creation, Logon Session: Logon Session Metadata, User Account: User Account Authentication
Platforms:	Azure AD, Containers, Google Workspace, IaaS, Linux, macOS, Network, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse the Windows service control manager to execute malicious commands or payloads. The Windows service control manager ( `services.exe` ) is an interface to manage and manipulate services.The service control manager is accessible to users via GUI components as well as system utilities such as `sc.exe` and Net .
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Traffic Flow, Process: Process Creation, Service: Service Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify or add LSASS drivers to obtain persistence on compromised systems. The Windows security subsystem is a set of components that manage and enforce the security policy for a computer or domain. The Local Security Authority (LSA) is the main component responsible for local security policy and user authentication. The LSA includes multiple dynamic link libraries (DLLs) associated with various other security functions, all of which run in the context of the LSA Subsystem Service (LSASS) lsass.exe process.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Driver: Driver Load, File: File Creation, File: File Modification, Module: Module Load
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may create or modify Windows services to repeatedly execute malicious payloads as part of persistence. When Windows boots up, it starts programs or applications called services that perform background system functions.Windows service configuration information, including the file path to the service's executable or recovery programs/commands, is stored in the Windows Registry.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Driver: Driver Load, File: File Metadata, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Creation, Service: Service Creation, Service: Service Modification, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may circumvent mechanisms designed to control elevate privileges to gain higher-level permissions. Most modern systems contain native elevation control mechanisms that are intended to limit privileges that a user can perform on a machine. Authorization has to be granted to specific users in order to perform tasks that can be considered of higher risk. An adversary can perform several methods to take advantage of built-in control mechanisms in order to escalate privileges on a system.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Modification, Windows Registry: Windows Registry Key Modification
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file time attributes to hide new or changes to existing files. Timestomping is a technique that modifies the timestamps of a file (the modify, access, create, and change times), often to mimic files that are in the same folder. This is done, for example, on files that have been modified or created by the adversary so that they do not appear conspicuous to forensic investigators or file analysis tools.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata, File: File Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary (ex: Ingress Tool Transfer ) may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Deletion
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report PVUfopbGfc.exe

Overview

General Information

Detection

Compliance

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: LummaC

Yara Signatures

Dropped Files

Memory Dumps

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Exploits

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

E-Banking Fraud

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Program Files\FastestVPN\BouncyCastle.Crypto.dll (copy)

C:\Program Files\FastestVPN\FastestVPN.BLL.dll (copy)

C:\Program Files\FastestVPN\FastestVPN.Common.dll (copy)

C:\Program Files\FastestVPN\FastestVPN.DI.dll (copy)

C:\Program Files\FastestVPN\FastestVPN.DI.dll.config (copy)

C:\Program Files\FastestVPN\FastestVPN.Data.Local.dll (copy)

C:\Program Files\FastestVPN\FastestVPN.Data.Remote.dll (copy)

Windows Analysis Report
PVUfopbGfc.exe

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to hide configuration information within Registry keys, remove information as part of cleaning up, or as part of other techniques to aid in persistence and execution.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may sniff network traffic to capture information about an environment, including authentication material passed over the network. Network sniffing refers to using the network interface on a system to monitor or capture information sent over a wired or wireless connection. An adversary may place a network interface into promiscuous mode to passively access data in transit over the network, or use span ports to capture a larger amount of data.
Tactics:	Credential Access, Discovery
Data Sources:	Command: Command Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of valid accounts, usernames, or email addresses on a system or within a compromised environment. This information can help adversaries determine which accounts exist, which can aid in follow-on behavior such as brute-forcing, spear-phishing attacks, or account takeovers (e.g., Valid Accounts ).
Tactics:	Discovery
Data Sources:	Command: Command Execution, File: File Access, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre